There’s been a bit of hubbub in the geek media in the past few days about the dangers of using BitTorrent over Tor. This isn’t news to us here at ALE, but it’s come as a bit of an eyeopener to a lot of people. The TOR blog has written up a pretty good analysis about the problem called BitTorrent Over Tor Isn’t a Good Idea. In the comments, there are some kind words about Anomos. Unfortunately, there is a common misconception I’d like to dispel here: Anomos does NOT require that the tracker know your IP! You can be entirely anonymous while downloading and uploading over Anomos. I’ll explain.
Now normally when you connect, it looks like this:
In this case, yes, the tracker knows your IP, but other members in the network know nothing about your data transfers.
But, because Anomos announce requests to the tracker are done with HTTPS, you can also do this over Tor/Privoxy, like so:
In this case, the tracker has no idea who you are. First of all, this is hard to set up. It means installing additional software and fiddling with proxy settings, which is just too complicated for most users and goes against the Anomos philosophy of usable privacy. There are downsides to this – you will not be assigned to other peers in the network, you will only be able to connect out to peers, and not the other way around (this is the same effect as peers who don’t forward their ports.) This has a damaging affect on the network.
When all peers are reachable (the optimal scenario) – the graph of connectivity looks like this (where blue peers are connectable, and yellow ones aren’t):
And when 90% of peers are behind Tor, or aren’t forwarding their ports, the network looks like this:
He looks happy, but he’s not, because this means that there aren’t as many paths for file transfer to take, so the central peers will be overloaded and the network will become congested and slow. If every single person does this, nobody will be able to connect to each other, so it won’t work at all!
Anomos is designed with the assumption that at least some peers are only concerned about their neighbours spying on them, and that they trust the tracker enough to connect to it. However, those with more serious privacy concerns will be able to share files totally anonymously. This doesn’t only work with Tor, it will work with any proxy or anonymity network, like I2P. Some day, we’d like to distribute Anomos and Tor bundled together and configured for totally anonymous transfers right out of the box. For now, you’ll have to install Tor and Privoxy separately, then change the proxy settings on your own.
I hope this clears things up for everybody!
Rich
i use Tor to hide my ip address from tracker and isp.
why should use Tor if anomos send my ip address to tracker ?
You don’t have to send your IP address to the tracker.
You can if you want to, this will hide it from your ISP and possibly get around a blockage, but will not give you anonymity from the tracker. However, if you don’t supply your real IP, then you will be anonymous to ISP and the tracker.
if i don’t provide my ip address to tracker, how it will be able to find my node to send me data ?
#3 brad, I’ll have a go at answering that: It won’t. No peer out there will ‘send you data’ not first initiated by your own client in the form of an outbound connection to another peer if they’re unaware of an accessible IP:port to connect to you with.
Your client will learn of other peers out there through the outbound communication with the tracker via Tor. Your client will connect OUT to those peers based on the IP:port list the tracker returns.
The tracker will either have only the IP of your Tor exit node and your own configured client port (which is useless to allow remote peers to connect to you), or will have both your REAL IP and port depending on which client you use and whether you have configured it properly (some clients send your REAL IP to the tracker even if you proxy, like µTorrent). Neither of these will allow inbound connections to your client.
You say that you can use Tor to hide your IP from the tracker, but the article you cited specifically says that “since modern tracker designs use the UDP protocol for communication, and socks proxies such as Tor only support the TCP protocol”, clients like utorrent ignore the socks setting and end up sending the IP anyway. The article also says this about utorrent: “The attack is actually worse than that: apparently in some cases uTorrent, BitSpirit, and libTorrent simply write your IP address directly into the information they send to the tracker and/or to other peers.”
How can you use anomos and be COMPLETELY hidden?
Okay…
1. For technical design reasons, BT over Tor is not anonymous at all. Tor may be great for communications inside broken countries, but you will still get caught with Bittorent over Tor.
2. BT over abuses the Tor network. See, not only does it do nothing for your privacy using BT, but it puts a massive load on the Tor network. The Tor developers have made this VERY clear in the past.
So, TL;DR don’t use Bittorent over Tor, mkay?
SO using Tor + Anomos for downloading torrent will keep me anonymous from copyright trolls??