Local Alcoholics Anonymous and Narcotics Anonymous Meeting ...
Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential...
Transcript of Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential...
![Page 1: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/1.jpg)
Do You See What I See? Differential Treatment of
Anonymous UsersSheharbano Khattak (University of Cambridge)!David Fifield (UC Berkeley) Sadia Afroz (ICSI)!Mobin Javed (UC Berkeley) Srikanth Sundaresan (ICSI) Vern Paxson (UC Berkeley, ICSI) Steven J. Murdoch (University College London) Damon McCoy (ICSI)
Modified from “Humanist Night” by Munguia
![Page 2: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/2.jpg)
abc.com
How Regular Users See the Web
![Page 3: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/3.jpg)
abc.com
How Tor Users See the Web
![Page 4: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/4.jpg)
Internet
User-side Censorship
abc.com
Difference w/ Traditional Censorship
![Page 5: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/5.jpg)
Internet
Internet
User-side Censorship
Publisher-side Censorship
abc.com
abc.com
Difference w/ Traditional Censorship
![Page 6: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/6.jpg)
How Do Websites Block Tor?
abc.com
Entry Middle Exit
![Page 7: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/7.jpg)
How Do Websites Block Tor?
abc.com
Entry Middle Exit
Publicly known
![Page 8: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/8.jpg)
Measuring Tor Blocking by the Web
• Network layer blocking!
• Application layer blocking
![Page 9: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/9.jpg)
Network-layer Discrimination
![Page 10: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/10.jpg)
Does An IP Address Block Tor?
SYN (port 80)
SYN (port 80)
SYN-ACK
RESET / NO RESPONSE
![Page 11: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/11.jpg)
Measuring Tor Blocking at Scale
Tor Exit Node
Control Node
Scan IPv4
Scan IPv4
• IPv4 ~ over 3 billion addrs!!
• 4 Tor Exit Nodes (USA, Romania, Netherlands)!!
• 3 Control Nodes (Michigan,Cambridge, Berkeley)
![Page 12: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/12.jpg)
..But What is The Web?
• Web Footprint—a set of IP addresses that respond successfully to our control scans on port 80
Web Footprint
Fraction !that blocks !
Tor
![Page 13: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/13.jpg)
Challenges in Defining The Web• What if a probe or response is lost?!
✤ Redundant probing!
• Temporal and spatial churn in the Web Footprint:!
✤ Lax Web Footprint: IP addresses for which all control nodes see a response at least once (~96% of Web Footprint)!
✤ Strict Web Footprint: IP addresses for which all control nodes received a successful response on all days (~50% of Web Footprint)
![Page 14: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/14.jpg)
Challenges in Defining The Web• What if a probe or response is lost?!
✤ Redundant probing!
• Temporal and spatial churn in the Web Footprint:!
✤ Lax Web Footprint: IP addresses for which all control nodes see a response at least once (~96% of Web Footprint)!
✤ Strict Web Footprint: IP addresses for which all control nodes receive a successful response on all days (~50% of Web Footprint)
![Page 15: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/15.jpg)
At least 1.2% of the Web blocks Tor
![Page 16: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/16.jpg)
AS distribution of Top 5 Tor Blockers!(Lax Footprint)
![Page 17: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/17.jpg)
AS distribution of Top 5 Tor Blockers!(Strict Footprint)
![Page 18: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/18.jpg)
Geo Distribution of Top 5 ASes that do wholesale Tor blocking
![Page 19: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/19.jpg)
Application-layer Discrimination
![Page 20: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/20.jpg)
Does a Website Block Tor?
HTTP GET
HTTP GET
![Page 21: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/21.jpg)
Does a Website Block Tor?
HTTP GET
HTTP GET
200 OK
Not 200
![Page 22: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/22.jpg)
Does a Website Block Tor?
HTTP GET
HTTP GET
200 OK
Not 200
Berkeley
All Tor Exits (~900)
Alexa Top 1000
![Page 23: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/23.jpg)
3.67% of Alexa Top 1k block Tor
![Page 24: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/24.jpg)
!
• “You don’t have permission to access this website”!
!
• Shows CAPTCHA!
3.67% of Alexa Top 1k block Tor
![Page 25: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/25.jpg)
![Page 26: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/26.jpg)
![Page 27: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/27.jpg)
![Page 28: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/28.jpg)
![Page 29: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/29.jpg)
![Page 30: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/30.jpg)
![Page 31: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/31.jpg)
How many of the ~900 Tor exits are blocked?
![Page 32: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/32.jpg)
pantip.comolx.com.brsears.comlowes.comjcpenney.comnaukri.comgamespot.commilanuncios.comadme.rue−hentai.org jumia.com.ngmatch.com wayfair.comtarget.comflickr.comhilton.compinterest.comgroupon.comr10.net2ch.netneobux.comurdupoint.comkinogo.coelmogaz.combomb01.comhclips.comhdfcbank.comhespress.comcrunchyroll.comleagueoflegends.comlikes.comconservativetribune.comsubscene.comwhat−character−are−you.comclixsense.comalmasryalyoum.comyoum7.comyallakora.comprimewire.ag4chan.orgfeedly.comtubecup.comnmisr.comstatcounter.comgfycat.comthepiratebay.mnelance.comthepiratebay.gdmeetup.comsabq.orgashleymadison.comelaosboa.com2ch−c.netashleyrnadison.comvetogate.comchange.orgprntscr.comwikiwiki.jpglassdoor.comthepiratebay.laelwatannews.comel−balad.comgamepedia.comalbawabhnews.commasrawy.comijreview.comptt01.ccelfagr.orgagar.iotopix.cominfusionsoft.comextratorrent.ccupwork.comlapatilla.comzendesk.combuzzfil.netmacys.comredfin.combarnesandnoble.comavito.rufoxnews.combestbuy.comstaples.comwww.nike.comzara.comexpedia.comcraigslist.orgasos.comairbnb.comticketmaster.comadcash.comzappos.com6pm.comretailmenot.comnordstrom.comkohls.commercadolibre.com.vetrulia.comyelp.com
~20 of Alexa top 1k websites block > 50% of the exits
~60 of Alexa top 1k websites block < 25% of the exits
![Page 33: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/33.jpg)
• Two flavours:!
✤ Web services use Tor specific blacklist!
✤ Block all the Tor exits!
✤ Web services use abuse-based blocking!
✤ Block only exits with high abuse rate
Why do exits get blocked?
![Page 34: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/34.jpg)
Which exits are likely to have high abuse rate?
!
• Our hypothesis: high bandwidth and old age
![Page 35: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/35.jpg)
Which exits are likely to have high abuse rate?
!
• Our hypothesis: high bandwidth and old age!
• No statistically significant effect!!
✤ Except for few …
![Page 36: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/36.jpg)
Which exits are blocked?!Old and high bandwidth
0%
3%
6%
9%
1%0.01%0.0001%Exit probability
Frac
tion
of w
ebpa
ges b
lock
ed
Tor blocked by 4chan.org
![Page 37: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/37.jpg)
Which exits are blocked?!Old and high bandwidth
0%
3%
6%
9%
1%0.01%0.0001%Exit probability
Frac
tion
of w
ebpa
ges b
lock
ed
Tor blocked by change.org
![Page 38: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/38.jpg)
Akamai blocks most exits
0%
3%
6%
9%
1%0.01%0.0001%Exit probability
Frac
tion
of w
ebpa
ges b
lock
ed
Tor blocked by bestbuy.com
![Page 39: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/39.jpg)
• Google homepage was never blocked but searching was blocked from 23-40% of the ~900 exits.!
!
!
Homepage unblocked but blocked activity
Response to https://www.google.com/#q=hello
![Page 40: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/40.jpg)
• 42 exits were never blocked
!
!
!
!
Exits that were never blocked
![Page 41: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/41.jpg)
• 42 exits were never blocked
!
!
!
!
Exits that were never blocked
Uptime of one of the 42 exits
![Page 42: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/42.jpg)
Historical Tor Blocking
• Open Observatory Network Interference (OONI)!
✤ Studies censorship in different countries!
✤ Visits website through Tor and without Tor!
✤ Over 2300 websites visited (Sep’14-Aug’15)
explorer.ooni.io
![Page 43: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/43.jpg)
6.8% of 2300 websites blocked Tor
1%
2%
3%
4%
Oct2014
Nov Dec Jan2015
Feb Mar Apr May Jun Jul AugFrac
tion
of b
lock
ed re
ques
ts timeout CloudFlare all othersTor blocking rate over time
![Page 44: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/44.jpg)
• Convio: Not Implemented Tor IP not allowed!
• ezinearticles.com
Sites that explicitly block Tor
![Page 45: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/45.jpg)
Meanwhile at CloudFlare..
![Page 46: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/46.jpg)
Solution?
abc.com
• Contextual awareness
• Redesigning anonymitynetworks
![Page 47: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/47.jpg)
Solution?
abc.com
• Anonymous blacklisting
• Redesigning automated abuse-based blocking
• Contextual awareness
• Redesigning anonymitynetworks
![Page 48: Do You See What I See? Differential Treatment of Anonymous ......Do You See What I See? Differential Treatment of Anonymous Users Sheharbano Khattak (University of Cambridge)! David](https://reader030.fdocuments.us/reader030/viewer/2022040408/5eb78a260aebee6c7a0aab16/html5/thumbnails/48.jpg)
• At least 1.2% of the Web block Tor (n/w)!
• At least 3.67% of Alexa top 1k sites block Tor (app)!
• Fine-grained discrimination?!
• Who else is subject to this kind of discrimination?
Summary