Millions rely on Tor, an anonymity network that has functioned for 25 years based on altruism and the support of unpaid volunteers. The network works by routing users’ traffic through a series of relays, with up to 9,000 scattered globally. This ensures that no single relay can identify both the user and their destination, thus preserving privacy.
At the DEF CON security conference, co-founder Roger Dingledine discussed the challenges Tor faces today, emphasizing that its greatest threat is not just surveillance but the centralization of its network due to the economics of cheap hosting. He reiterated that the foundation of Tor’s success is its volunteer-driven model: “The building block that Tor is based on is altruism,” he stated.
How Tor Operates Today
Tor’s structure relies on three relays: an entry guard, a middle node, and an exit node. These relays operate under a set exit policy defined by their operators, allowing some to forward only standard web traffic, while others do not serve exit traffic at all.
An hourly published directory consensus by nine directory authorities allows clients to find relays. Dingledine personally operates one of these directories, which adds a layer of control that, while centralizing to some extent, is crucial for the network’s integrity. If an attacker were to compromise a majority of these authorities, they could potentially conduct disruptive attacks.
In the past, the directory authorities were vulnerable to censorship, but Tor has mitigated this risk by distributing directory information among relays, ensuring clients don’t always need to connect to a specific authority.
Operational Security Concerns
Dingledine ranked the risks users face in terms of their frequency rather than severity:
- Operational Security Mistakes: User errors, such as accessing Tor through non-secure networks, are the leading cause of deanonymization.
- Browser Fingerprinting: Tor Browser aims to create uniformity among users, obscuring distinct behaviors that could be used for identification.
- Browser Exploits: Vulnerabilities affecting Firefox also impact Tor Browser, posing a significant risk due to the shared rendering engine.
- Confirmation Attacks: Adversaries suspecting a particular user can track their network activities alongside the target site, correlating the data to identify the user.
- Traffic Analysis: This involves monitoring traffic flows without prior knowledge of the user, making it a challenging threat to identify.
Additionally, malicious actors have attempted to corrupt Tor by adding compromised devices to its network as relays. While the network health team actively monitors for such anomalies, the threat persists.
The Impact of Cheap Hosting
The landscape for operating Tor relays has shifted significantly. Many relay operators now opt for Virtual Private Servers (VPS), leading to a concentration of hosts. As Dingledine noted, platforms like Hetzner are becoming the backbone for a large portion of the Tor network.
Moreover, geographical trends show that new relay operators are primarily located in Europe due to affordable bandwidth. This economic advantage has led to a situation where the routing algorithm favors European relays for speed, ultimately hindering the original intent of global traffic distribution across multiple jurisdictions.
“If the goal of the Tor network is to spread out all the traffic over many continents, then we’ve got a conflict here between making Tor fast and making Tor safe,” Dingledine explained.
To address these issues, the Tor Project is rewriting its relay software in Rust to enhance reliability. There is also a push to diversify relay operators beyond Europe, particularly amping up efforts in regions like the U.S.
In light of the challenges faced, Dingledine expressed his desire for help in making the Tor network more robust, highlighting the ongoing need for support and improvement to ensure user safety and network integrity in an increasingly centralized environment.
