On Tue, Oct 18, 2016 at 10:39 AM, Philipp Winter <p...@nymity.ch> wrote: > On Sun, Oct 16, 2016 at 01:15:32AM -0400, Nick Mathewson wrote: >> On Fri, Oct 14, 2016 at 11:09 AM, Philipp Winter <p...@nymity.ch> wrote: >> [...] >> > There are two ways to mitigate the issue. First, we need better >> > defences against website fingerprinting, so an attacker learns less by >> > observing the connection to your guard relay. Second, we need to >> > improve the DNS setup of exit relays. I would like to see less relays >> > use Google's resolver, and we need to move towards encrypted DNS. >> >> Thanks, Philipp! >> >> Could you comment at all about whether our current exit side dns >> caching approach makes the attack harder, easier, or doesn't matter? > > Generally, the longer exit relays cache domains, the less precise the > attack. The trade-off is illustrated in Figure 10b in our paper [0]. > At the moment, exit relays cache domains for only 60 seconds [1], > regardless of the domain's TTL. If that bug is fixed, the attack > becomes a bit harder to mount. It can become even harder if exit relays > were to cache each domain for, say, 10 minutes or more. > > [0] <https://nymity.ch/tor-dns/tor-dns.pdf> > [1] <https://bugs.torproject.org/19025>
Thanks! I've just pulled #19025 (and its sibling, #19769) into consideration for 0.3.0. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk