Torhoo onion mirror : torhoocc3yugradvhrppml2fin4xob7kgg7uf42s4xk7p6r5vzy62ead.onion

Does generating Tor noise make Tor more secure? : Tor | Torhoo darknet markets

There are a usual number of people that access tor on a daily, the more people that use Tor, the harder it is to find out who is who. What i want to know if creating traffic noise would help in any way. Of course contributing resources to nodes would seem to help more, but the end goal i have is to send same traffic, and or random traffic to make it harder for an adversary to identify what i am doing, since I would only be using a Guard entry node, and not a bridge. It's not illegal, but im sure im on a list for visiting Tor website and downloading it, and using it.

/u/RadioW0 📢

1 points

2 months ago

Using the tor network*

/u/rmrf P

1 points

2 months ago

Most probably not. Tor already has different attempts at making network analysis difficult (they add their own noise). The most value anyone can do is to run their own tor nodes so that it is more difficult to de anonymize users by owning a majority of the network.

/u/RadioW0 📢

1 points

2 months ago

Okay, my only issue is Tor doesn't have a lot of users, the few million of people isn't enough, and the amount of people that use Tor here locally is even lower, if i were to use Tor experimentally at home, then test it out in open networks, it would be potentially trace back to me, so that would have me as a suspect from my understanding. A bridge wouldn't fit my need because there is no network censorship that i need to circumvent, its the privacy and the need for me to manipulate and inflate numbers, or tor usage. Even with the mitigations for traffic analysis, mi unsure of how to assess risk management on preventing ISPs from knowing what im doing, and logging it forever and trying to figure out what i am doing, and what websites im going to.

I might lack understanding, so please educate me if i do, I just want to better understand how to mitigate my risk

/u/rmrf P

2 points

2 months ago

There is a lot of discussion abouts if you should use VPN before Tor and you should research this more.

The issue you are describing is something that a VPN before entering Tor would fix. A lot more users use VPN and they have legitimate usage where Tor is associated with more illegal activity. You can pay with cryptocurrency for almost any VPN and some have things like "stealth protocol" or various technology that acts sort of how obfsproxy works in Tor. Some VPN even have some features that protect against packet analysis by making all your traffic the same size. I would research what VPN's make most sense for you, mullvad and protonvpn get recommendations a lot but you need to research what one you will trust the most.

/u/DaVenom Mod

1 points

2 months ago

As /u/rmrf writes there are opinions about VPN or not.
Likewise, opinions about random noise or not.

A modern network analyzer uses package sizes, timing, maximum package size, etc. with pattern recognition to judge which site a particular Tor user is visiting. Each site has a unique set of HTML-files and images to be downloaded to the browser. Depending on which browser the user has, the downloading have slightly different patterns. The network analyzer must therefore both guess which browser is in use and what site the user is visiting. Darknet users has limited options and majority uses Tor browser, which makes life easier for the analyzer. These patterns are more distinct initially when all images and pages needs to be downloaded, latter in the session, cached images and pages makes the patterns more stochastic and harder to recognize.

For example, when we visit Dread the DDOS protection followed by the session assignment and finally front page download has a very distinct pattern. If there is no other traffic in the network from that particular user, the chances that the network packages reveals which site the user visit is relatively high. In combination with a timing attack where the site users activities are matched towards the observed network activity, there is a certain chance that site user can be uniquely matched with Tor usage.

Therefore obscuring the initial client-server interaction with random HTTP requests the network analyzers will have harder time to judge when the actual interaction starts and which packages belongs to what TCP session.

So, what potentially works is noise that opens lot of HTTP connections in parallel that returns different sizes of packages. During this random noise the intended site is visited. The rationale is that network analyzers can't detect and distinct between the TCP sessions and can therefore not with any high probability guess which site the user visits.

However, this is a poor mans solution and is not bullet proof in any sense.

Other options are Mullvad DAITA that do network package padding to a fix size, adds background noise and modifies the client-server interactions. Tor does not have corresponding obscurity features. Drawback is that the DAITA traffic is very distinct and an ISP can therefore block such network connections easily without disturbing "legit" traffic. (side note, some ISP:s has already blacklisted Mullvad servers and semi-block the traffic)

/u/RadioW0 📢

1 points

2 months ago

Are there any tools that are independent from Mullvad that has DAITA capabilities that i can use, not build it into Tor, but just to create random predictable https and random https on a device under the same LAN IP

/u/DaVenom Mod

1 points

2 months ago

Main issue is that Tor should have these features, thus as an user of Tor your ability to really make a difference is limited. With that said you can obscure your internet breakout by using leased lines, hacked internet connections, private Tor guards, injecting your traffic into Tor relays, VPN:s, Proxy-servers, etc. but there is no "wonder waffe" that makes you guaranteed anonymous.

/u/ringct

1 points

2 months ago

If you want to contribute, host some Tor nodes.
Spamming the network and not giving back any bandwidth is just going to make it slower for everybody else.
Use it how it is supposed to be used, if you are on a watch list use a bridge.
To make it better make it more decentralized!