Re: Anonymous Anonymity - Request For Comments

gandalf_at_digital.net
Date: 07/19/05

  • Next message: Williams, James K: "Re: SiteMinder Multiple Vulnerabilities (solution)" 
    Date: Tue, 19 Jul 2005 12:57:24 -0500 (GMT-05:00)
To: Craig Skelton <cskelton@gmail.com>, bugtraq@securityfocus.com

    Greetings and Salutations:

    From: Craig Skelton <cskelton@gmail.com>
    > Take a look at Tor.
    > http://tor.eff.org/
    > One of the biggest problems with Tor is bandwidth disparity.

    Many people have suggested that I take a look at TOR, and I have. In fact I was able to talk to some of the authors of that system (I need to add a reference to TOR in my paper). Extremely knowledgeable I must say.

    I have installed TOR on a network that I have pretty well locked down. My router filled up the syslog file with packets to "strange" ports when I started TOR up. If I wanted to block TOR it would be fairly easy.

    The other issue (I think I understand TOR correctly) is that if one of the "routers" is not a "trusted" machine (specifically the first one) then a rogue "router" can "act" like it is the other "routers" and will know the entire transaction. There is also a centralized server to hold the addresses of servers (which could be compromised). I don't want to have anything centralized. I propose that all nodes are servers. I am trying to get away from trusting anybody yet spreading the information around so much so that nobody can piece together the information.

    One other issue with TOR and FreeNet is searching. They do not have searches integrated into the design. Someone has to produce a web page that does the searching. The system I propose has searching as an integral part.

    I am looking for something that is almost invisible (i.e. port 80, 81, 443, 21, 22, 23, 8080 etc.) to any monitoring system. The alternative is to do like AOLIM and just start trying ports until something works. The other issue is making the traffic "look" like standard HTML to bypass application level firewalls.

    I like the idea of TOR, tho', and it is interesting and the people I spoke to gave me tons of pointers on other issues with Anonymous Systems. I will add / update to the file at:
    http://digital.net/~gandalf/Anonymous_Anonymity.htm

    Ken Hollis

    ---------------------------------------------------------------
    Do not meddle in the affairs of wizards for they are subtle and
    quick to anger.
    Ken Hollis - Gandalf The White - gand...@digital.net - O- TINLC
    WWW Page - http://digital.net/~gandalf/
    Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
    Trolls crossposts - http://digital.net/~gandalf/trollfaq.html
    Woodworking For Geeks - http://digital.net/~gandalf/woodmain.htm

  • Next message: Williams, James K: "Re: SiteMinder Multiple Vulnerabilities (solution)"

    Relevant Pages

    • Re: Where to find python c-sources
      ... Michael wrote: ... Clearly "Tor" did not try searching Google with two of the most obvious results, but I think at this point he should be considered to be soundly thrashed over the matter and we can all move on. ...
      (comp.lang.python)
    • Re: UKRMMA and BBC iPlayer
      ... Once it's started you can disable Tor again. ... Now I can forget to record Question Time without the hassle of searching ... for Torrents. ...
      (uk.rec.motorcycles)
    • Re: UKRMMA and BBC iPlayer
      ... Once it's started you can disable Tor again. ... Now I can forget to record Question Time without the hassle of searching ... for Torrents. ...
      (uk.rec.motorcycles)
    • Re: UKRMMA and BBC iPlayer
      ... Once it's started you can disable Tor again. ... Now I can forget to record Question Time without the hassle of searching ... for Torrents. ...
      (uk.rec.motorcycles)