On Sun, Oct 16, 2016 at 01:15:32AM -0400, Nick Mathewson wrote: > On Fri, Oct 14, 2016 at 11:09 AM, Philipp Winter <p...@nymity.ch> wrote: > [...] > > There are two ways to mitigate the issue. First, we need better > > defences against website fingerprinting, so an attacker learns less by > > observing the connection to your guard relay. Second, we need to > > improve the DNS setup of exit relays. I would like to see less relays > > use Google's resolver, and we need to move towards encrypted DNS. > > Thanks, Philipp! > > Could you comment at all about whether our current exit side dns > caching approach makes the attack harder, easier, or doesn't matter?
Generally, the longer exit relays cache domains, the less precise the attack. The trade-off is illustrated in Figure 10b in our paper [0]. At the moment, exit relays cache domains for only 60 seconds [1], regardless of the domain's TTL. If that bug is fixed, the attack becomes a bit harder to mount. It can become even harder if exit relays were to cache each domain for, say, 10 minutes or more. [0] <https://nymity.ch/tor-dns/tor-dns.pdf> [1] <https://bugs.torproject.org/19025> -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk