Tor anonymity compromised by researchers

Tor has been dealt another blow after researchers found a way to deanonymise certain hidden services with a very high level of accuracy.

First reported by Ars Technica, the researchers from the Massachusetts Institute of Technology and Qatar Computing Research Institute were able to denonymise the sites with an alarming 88% accuracy.

Using the method, malicious actors can carry out an attack by gathering network data from a pre-compiled list of hidden services in advance. Careful analysis of the patterns of packets passing between the hidden service and entry guard it uses to access Tor allows researchers to obtain a unique fingerprint of each one. This can then be later be used to identify the service but the traffic could not be decrypted.

Foreign governments, especially the US, could well be interested in the research considering that the FBI recently seized a Tor-hidden site hosting child pornography and hid there for weeks to allow evidence gathering.

Not successful in the real-world

Tor project leader Roger Dingledine reacted to the article in an email that doubted how successful it would be in a real-world setting. One reason for this is that the entry guard of the hidden service must be controlled by the attacker. Secondly he pointed to research last year that showed researchers routinely exaggerating the risk of website fingerprinting.

Tor's anonymity is one of its biggest selling points as it uses a system of protocols to make sure that no one can trace your IP address and not even your ISP will know the sites you're visiting, which makes the latest claims worrying.

• How to maximise your privacy online with Tor