Matthew Toseland wrote:
I am not sure about what you mean by "mixmastering the first two hops". I read it like you're talking about sending originating requests to a random node (no matter if it's nearer to the data), which might work as long as the enemy isn't all around you (in a good %).>Fixed default HTL is evil. Add (signed) a random number to each request.Even that is not sufficient. If you access a site with lots of images and many of the requests go through a particular node, then it can deduce a probability for you being the originator, which gets pretty high if it's a big freesite. The correct response is to implement mixmastered first two hops, which we will not implement before 1.0.
But what about the second hop (the first is you)? How does he know it has to randomize the path? If the packet is tagged then he knows it's you the sender. If it is not, the "best" path will be chosen, which in turn might as well go to those nodes you're trying to avoid.
Am I missing something?
>Fixed default maximum HTL is even more evil. To be more protected you must >not use that number, so you have a max HTL=24, with might not suffice for >some content.
Why you shouldn't use 25? Because it is a flashing neon light saying "it was me who sent that".Hmmm. Why? BTW, please don't modify the maximum HTL parameter unless you _really_ know what you are doing, if you modify it by hand then future increases in the default value won't be implemented by your node because it will use the overridden value.
Why not all content will be reachable? Well, I see that for some content I really have to search thoroughly (more than 20HTL) before I get it.
About setting the max HTL, that is not a problem right now. I might as well set it to 1024, I doubt anyone will set the default that high in the near future :). In other words, anyone except me will clamp that value to 25 or whatever default it becomes, and almost nothing changes.
I argue that any default fixed value for max HTL could compromise anonimity. I also think max HTL should be a (partially randomized) value. If code for that change will be included I guess it won't matter if I have set my max HTL or not, since max HTL will change over requests.
Please correct me if I am wrong.
Greetings :)
--
--- TLD
"There is no Good, one thorough, there is no Evil, there is only Flesh"
[Pinhead]
_______________________________________________
support mailing list
[EMAIL PROTECTED]
http://hawk.freenetproject.org/cgi-bin/mailman/listinfo/support
