Terminology
TOR- "the onion router" or the idea of wrapping a communication in several layers of encryption
Mixnet - series of servers that changes the order in which messages are sent and received before being delivered
Staying under the radar
Privacy comes in many different forms when we think of the internet. Most people are probably familiar with the idea of private accounts on social media, being able to restrict who sees what you post, and private browsing options on things like Google Chrome and Safari. The word privacy in these cases is a matter of personal comfort and a sense of security, but what if your actual safety depended on this privacy? Would you trust Facebook, or your favorite web browser to safeguard your anonymity? Probably not.
Countries around the world practicing internet censorship obviously don't support internet privacy and so anyone interested in skirting these censors has to find another, safer way to achieve privacy, or risk heavy penalties and potentially even their life. Privacy in this context is more than hiding your embarrassing photos from potential employers.
One well known and popular option for internet anonymity is the Tor browser. With Tor, a message is essentially unwrapped by a series of servers until reaching its destination where it can be completely deciphered. Only the problem with this is that lately researchers have proved it possible to "fingerprint" Tor circuits using machine learning algorithms and a little luck to identify servers hosting hidden services. (1)
In order to defend against the possibility of a single server along the 'onion route' being malicious, reshuffling messages and verifying their authenticity in a system called "Riffle." Riffle makes sure that at every handoff between servers the message it sends is a valid manipulation of the one it received. (2) In practice, as long as one server remains safe from adversaries, the message is still secure. This could have massive applications in countries with less internet freedom, or in nations battling censorship.
Relation to Computer Science
As seen in prior cyber security related topics I've covered, the use of randomization is a powerful technique in preventing easy access to sensitive information and securing all sorts of information. Communications, infrastructure, and sensitive data are all potential target for cybercriminals, so implementing computer principles of computer science is now more than ever, a crucial aspect of both public and private security. There are plenty of tools and techniques to safeguard or systems, we just need the minds to implement them for the good guys.
Resources
(1) http://news.mit.edu/2015/tor-vulnerability-0729
(2) http://news.mit.edu/2016/stay-anonymous-online-0711
I like the explanation you have given about TOR. This is something I have never heard about and your explanation of the concept was easy to follow. You also mention some things that would be interesting topics to further research. For example, I would like to hear about the work of the researchers who discovered the "fingerprints" you mentioned. Overall, this is a very interesting blogpost.
ReplyDeleteAs an everyday user who is not familiar with TOR or Riffle, I have to put a certain amount of trust in the system because in a sense the privacy is out of my hands. When I send an email on Google, I am putting my faith in Google keeping that message private, but in reality I have no control over whether or not they do. Will we ever be able to achieve true privacy online? Will large companies monitor us for targeted advertising or sell our information for profits? It seems to me that Google, Apple, Facebook, etc. have such a dominant market share that they can do whatever they want without anyone being able to do anything about it.
ReplyDeleteI completely agree with Laughlin. A majority of people put a blind trust on the internet and the safety/privacy of the information we provide on social media and other sources. I, too, was not familiar with TOR or Riffle. The randomization technique is definitely a very successful approach for security, however it seems like there will always be some way to beat the system and find anything you want on the internet. It's hard to imagine a time where personal information will be completely private.
ReplyDelete