Quote from: crypto_zoidberg on December 03, 2021, 03:48:45 PM

Other ToR implementations works as a resident process/daemon, which is not suitable for mobile application, we wanted to have light implementation which create "circle" and deliver tx to outer world. Also, tx itself is not something private - this info is absolutely public, so exit nodes won't hurt any privacy aspects of transaction, only if someone can re-construct full circle of onion route and figure out ip address, which i guess quite hard with ToR.

Yes, figuring out IP addresses with Tor is quite hard precisely because of the mitigations stated above, which don't exist in tor-connect. Hence my reluctance of the use of this new and quite experimental library.

There is also a misunderstanding of what is currently a threat with using exit nodes : it's not per-se the information exchanged, which as you stated is public, the real risk here is a DoS and a fragmentation of the network. There is more details of these attacks on the research I linked in a previous comment.

This is also why I asked if onion services will be enforced by default, because it mitigate all of these risks. Basically, using Tor without enforcing the use of onion services (for all platforms, mobile or desktop) will do more harm than good privacy and security wise. And even if enforced, the effectiveness of it will largerly depend on its 'good' implementation by the developers, Tor is all but a silver bullet and require a deep understanding of its functioning in order to be effective.

Using the official Tor code/library would be a huge gain of time, while simultaneously more private and secure. I do understand that it took (maybe a lot of) time to develop tor-connect, and that it feels annoying not to use it, but still going for it just for that reason would be a sunk cost fallacy as there isn't objectively any good reason to do so.

Derloda

Posts

Merits