Hacker News Reader

Comment by runn1ng | Hacker News Reader

This is the good place to ask

Is, in your opinion, i2p really a good alternative to tor?

What I can personally think as positives/negatives:

* Tor is trivial to install (just download the bundle)

* Tor is working on TCP-level, i2p on IP level, which allows it to be used for BitTorrent (but it's really slow for that)

* Tor is usable for "normal" web browsing, i2p not really (it has one outwards proxy that you can use but that's it)

* Nobody uses i2p so it's really slow, and I am not sure if it doesn't decreases the actual anonymity

View on HN

> Nobody uses i2p

Here is an analysis that was done less than a week ago. https://thetinhat.com/articles/2015/i2p-survey.html

TL;DR ~25,000 constant nodes, mostly in Russia and United States. With Russia having a lot of short lived connections.

An important consideration when deciding if it is a good alternative is how good is it's security and ability to keep you anonymous? Since that's the whole point of using it anyway.

When evaluating, it's important to look at past vulnerabilities. The following links are to posts from Exodus Intelligence about a vuln they found in i2p in July, 2014. - http://blog.exodusintel.com/2014/07/23/silverbullets_and_fai... - http://blog.exodusintel.com/2014/08/25/tails-from-the-cri2p/

On the one hand you could say it is more secure now because Exodus Intelligence reviewed it, and said "I2P had many cross-site scripting vulnerabilities" of which all were fixed. Also the way in this could be exploited is a little unique (by using XSS to hit the internal I2P router configuration intranet), so it's hard to fault the developers too much for overlooking those XSS problems originally.

On the other hand, there is the view that the more vulns that are found, the more likely it is there are more as yet undiscovered vulns.

Disabling JS would be a good start to avoiding those issues.

I have not run i2p or otherwise paid much attention to the project for more than a year, but I did notice it had a remote code execution vulnerability discovered last summer or so (stemming from its default-on web admin interface: http://blog.exodusintel.com/2014/07/23/silverbullets_and_fai...). Just because of that I would not consider it an alternative to Tor. However it's not true that "nobody uses i2p". The network is somewhat lively. Another thing is that relay mode is the norm rather than the exception (unlike with Tor), meaning your relay going down can be correlated with your i2p torrent client going down etc.

I'd look to GNUnet (https://gnunet.org/) as the future. It is more than just a Tor alternative, since it also has non-realtime features. Unfortunately it also has few or no users. A neat feature for any aspiring network would be capability to run over Tor, so you don't start with an empty anonymity set.

> Nobody uses i2p so it's really slow, and I am not sure if it doesn't decreases the actual anonymity

From what I remember (many years since I used it) it's faster than Tor as all nodes are participating in the routing by default.

> Nobody uses i2p

This is the problem. Anonymity networks are based on the idea of "blend in with the crowd". If there is no crowd, even an iron-clad protocol isn't much benefit.

Yes, some people use i2p, but its adoption rate is much lower than Tor.

Yes and no

i2p and Tor is different in this. Tor has relays, and there are far fewer of them than its users.

I am not sure though, that's why I am asking

Reply on news.ycombinator.com