

Researchers Develop Proxy-Less Anonymity System - TheloniusPhunk
http://threatpost.com/en_us/blogs/researchers-develop-proxy-less-anonymity-system-071811

======
daten
My concerns:

* "proxy-less" is a bad term, it sounds like they're still using a proxy, it's just using https encapsulation along the way to hide this from the first few hops.

* The participating entry-nodes (proxies?) could be systematically determined with a scanner for future blacklisting or investigation by someone trying to stop this circumvention of censorship.

* You have to trust the people running the entry nodes, if they have the key to decrypt your traffic. This sounds like a design that governments can use for monitoring.

~~~
pmjordan
_The participating entry-nodes (proxies?) could be systematically determined
with a scanner_

How, exactly? Measuring the run-time of packets and comparing to the expected
run-time? I suspect this could be masked by the proxy, but I'm not sure.

 _You have to trust the people running the entry nodes_

You can encrypt the payload independently and then re-encrypt it for the HTTPS
tunnel. But as with any proxy, they know the ultimate destination for your
traffic, even if they can't get at the data itself.

~~~
daten
If your path requires a participating station for the proxy-connection to
succeed, just measure successful and unsuccessful proxy-connections against
different network paths and logically determine which paths have participating
nodes and which don't. Compare the results and expand your search until you
narrow down which hops in your path are required for a success.

------
KevinEldon
I understand how this might work technically, but don't see why an ISP or
heavily trafficked web-business would be motivated to deploy and maintain one
of these Telex stations over the long term. You'd be adding an extra point of
failure, cost for maintenance of the Telex stations, most likely some latency,
and you'd have to cover the cost of bandwidth for traffic not headed to your
website... all while running the risk of being blocked by the censoring
country.

~~~
something
Because you don't like the censoring country's government and you want to
subvert their rule? Maybe you're another government yourself and you're
willing to pay for this?

------
mdaniel
If anyone else didn't know about Public-Key Stenography, this paper[1] showed
up almost everywhere in the search results.

It is heavier on the math than I would like for my "wha?" level curiosity, but
given the audience here it may be a hit.

1 = <http://www.cs.cmu.edu/~biglou/pubkeystego.pdf>

~~~
haliax
This seems to be a related idea:
<http://people.csail.mit.edu/rivest/Chaffing.txt>

------
trotsky
It seems that the system relies on a single private key for secrecy, but
deploys it widely - to every participating ISP. It seems difficult to believe
that you could distribute a key like that and have it stay private, especially
with so much active state sponsored cyber espionage going on.

I suppose you could solve this by generating a good number of key pairs and
only deploying new secret keys to ISPs when there was evidence of disclosure,
but if the government in question eavesdropped instead of blocked I'm not sure
you'd find out quickly enough. It's unclear what advantages you'd get by
eavesdropping, presumably little if it's really just used as a tunnel to tor.

------
meow
How will this stop governments from forcing ISPs to block sites? Its
ridiculous to assume that the governments censoring content will let ISPs
provide a loophole through which their users can access blocked sites..

~~~
KevinEldon
Although the article says ISP, what they mean is any intermediate hop between
the requester and the destination. So any network outside of the control of
the censoring government could provide this service.

------
aidenn0
It seems like inspecting packets at line-rate on a route to a site popular
enough to not be suspect would be prohibitively expensive.

------
gcr
How is this different than TOR?

~~~
mdaniel
It is my understanding that Tor has defined entry points into the network.
This mechanism obscures the diversion point even from the requesting user. It
claims to have the added advantage that traffic is not provably subversive,
unlike connecting to a Tor network which in and of itself raises suspicions.

