Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question is inspired by this article (in Russian) about a website called I Know What You Download. From what I understand, they scan the DHT networks and display torrents that any given IP participated in, and although it is sometimes inaccurate, it can provide data on Internet usage, and thus presents a threat to anonymity.

Most people suggest using VPN in order to conceal torrent traffic. However, in another article (also in Russian) same author shares his experience with torrenting over VPN set in Azure. Apparently, he received DMCA notice for torrenting a film (author specifically notes that he did not fully download the film, and everything was done for the sake of experiment). They provided the name and the size of the file, along with IP address and port.

But, some (if not all) torrent-sharing programs have an encryption feature. For instance, Tixati can even enforce encryption for both incoming and outgoing connections:

enter image description here

enter image description here

Question is: what does this feature encrypt? Name of the file, its contents, size? Could it prevent DMCA notices? If not, what does it actually do?

Related: the answer there mentions encryption — does this kind of encryption count?

share|improve this question
    
Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop yesterday
    
Do not go to "I know what you download", it tried to force me to download an extension – Rohan Jhunjhunwala 11 hours ago
1  
Short answer: It is useless for privacy. Back years ago when ISPs first started throttling it managed to bypass some of it, but it's been ineffective for years now. Just use it "enabled" - so you can connect to both encrypted ad unencrypted. – Shiki 1 hour ago

Think of it like an underground fight club. Encrypting the traffic means nobody on the outside can see you enter or leave, but once you're inside, everybody there knows who you are and can monitor your participation.

This feature is really only useful if you have an ISP that blocks torrent traffic. Encrypting it means it doesn't appear to be torrent traffic, it's just an encrypted stream, but once you get past the ISP and connect to the swarm everybody else participating knows exactly who you are and what you're doing.

share|improve this answer
    
So, this makes it safe when the government uses the ISPs to track traffic? – J. C. Leitão Jan 25 at 21:40
32  
Wouldn't it be more accurate to say : "Anybody on the outside can see you enter or leave but doesn't know what you are doing. Once you're inside, everybody there can monitor your participation."? Encryption doesn't hide to who you are connecting. It just protects the content. – Gudradain Jan 25 at 22:45
3  
If that's the only way the government in question is tracking it, maybe @J.C.Leitão. In particular, a government could even host a version of the file with a torrent client supporting encryption, and then they would be able to fully see who all was downloading it no matter what. – DaboRoss Jan 26 at 4:57
1  
@Gudradain Yes, it is, but it breaks my analogy :) – Johnny 2 days ago
    
Also, if your ISP is clever enough, the regular "encrypted only" approach won't even stop them from noticing and blocking it as torrent traffic. I've implemented a similar system for a school WiFi system, and it worked as far as I could test. – akaltar 2 days ago

The "encryption" hides the content of the torrent data traffic from a casual observer and makes it harder to determine that the traffic is in fact torrent data traffic. It was designed to make it harder for ISPs to snoop on torrent traffic (and either block it, throttle it or send nastygrams). It can also be useful for evading the effects of buggy firmware in network devices*.

The cryptography used is relatively weak. The DH key exchange is only 768 bit with a fixed prime which is almost certainly crackable by a well-funded attacker. The actual encryption is rc4 which is known to have weaknesses though I don't know how relevant they are to this particular application. MITM attacks are possible if the attacker knows the "info hash" of the torrent in question.

Also it only protects data connections. It DOES NOT hide the fact you are present in the swarm from someone scanning the tracker or dht. It DOES NOT stop the bad guys from connecting to your client and downloading a copy of the file from you to demonstrate that you are illegally offering it for distribution.


* I have encountered cases where the same peice of a file was repeatly failling hash checks, turning on encryption fixed it. I suspect a buggy and/or overzealous NAT implementation was responsible.

share|improve this answer

what does this feature encrypt?

It encrypts the entire communication stream with other BT peers.

Name of the file, it's contents, size?

All of the above. Note that it is completely and utterly useless to encrypt these things as they are already PUBLIC.

Could it prevent DMCA notices?

It can prevent a residential ISP from casually snooping the traffic. In some countries this doesn't matter, as residential ISPs have no business snooping your traffic. In other countries, rightsholders have programs to cooperate with ISPs to detect piracy and serve out nastygrams.

If not, what does it actually do?

It is mainly security theatre. It will still be obvious to your ISP that you are using BT. It will still be easy for rightsholders to find out which IPs are sharing their content. So, the encryption doesn't solve any real problem. Someone added it to their BT client to draw dumb users who don't understand the security aspects at all. Then everyone else had to add it to their BT client too, even though it is mostly useless.

share|improve this answer
1  
I don't think torrent protocol/clients ever claimed this to be security feature so labeling it “security theater” just obscures its actual purpose — dodging traffic shaping as per other answers. – Rarst yesterday
    
@Rarst The traffic shaping thing is just RetCon. It was initially developed to enhance privacy and confidentiality: en.wikipedia.org/wiki/BitTorrent_protocol_encryption. In terms of shaping it is nearly useless as an ISP has lots of options to combat network abuse, including just blanket rate limiting users who transfer a lot of data (which would be mainly BT users). – DepressedDaniel yesterday
1  
"Purpose" section of the article you linked talks exclusively about traffic shaping. Personally I had encountered cases where it had been useful against it. – Rarst yesterday
    
@Rarst From about the 3rd line of "Purpose": "These systems were designed initially to provide anonymity or confidentiality, ..." So it is now recognized that anonymity and confidentiality are not much improved and only traffic shaping evasion is potentially has a benefit, depending on the ISP in question. – DepressedDaniel yesterday

The DMCA notice was sent through Microsoft. Azure is not an anonymous service and makes no effort to conceal the fact that you're the owner of your IP. To protect your identity you need a VPN provicer which specializes in this, e.g., "PIA", "Hide my Ass", etc.

Bittorrent is not designed to anonymize. While it can be used through a proxy, it isn't 100% to protect you there either. See https://hal.inria.fr/inria-00471556 for information about anonymity leaks in bittorrent clients through the Tor network. Even if these holes are addressed, what motivation do the bittorrent client authors have to get security and privacy right?

Even if your client doesn't betray you and you find a VPN who's willing to hide your tracks, you have to question their motive. If they're served with legal papers, will they track you? why would they not operate in the legal framework of the country?

On encryption, Bitcomet has a good comment on this:

Please note that the encryption option is meant to hinder traffic shaping applications on the ISP side by obfuscating BitTorrent traffic between peers. However this doesn't anonymize you on the Internet as far as the other peers in the swarm are concerned, since your IP address will still be visible to each peer of that torrent swarm. If you aim for total anonymity you should look towards a VPN proxy solution which will masquerade your IP behind the VPN IP address, thus offering you a real degree of anonymity.

http://wiki.bitcomet.com/protocol_encryption

share|improve this answer

So, VPN is not an option.

This is where you're wrong.

VPN doesn't hide your identity. VPN merely shifts your identity to your VPN provider identity. VPN doesn't do anything for you directly, it merely allows you to hide behind someone's else skirt. Now, depending on what provider you've chosen, when authorities come asking who you are, it can either fight them for you or fight you for them.

Azure is not an identity-hiding service, so using it to conceal yourself cannot work. It doesn't mean that "VPN is not an option" it only means that "Azure VPN is not an option"

Question is: what does this feature encrypt?

It conceals the nature of the traffic from your service providers (your ISP, your VPN provider, and your VPN providers's ISP) to make traffic shaping (read: blocking torrents) more difficult.

share|improve this answer
    
Good catch! I didn't even register that he set up his own VPN on Azure. snicker – schroeder 2 days ago
    
@schroeder >_> – Gallifreyan 2 days ago
1  
@Agent_L no need to escalate when a simple comment will suffice. The OP is also free to make his own edits. – schroeder 2 days ago
    
@schroeder The need to escalate is to stop you from doing it again. It did changed the meaning and most of my answer addressees the part of the question that wasn't there in the first place. I wouldn't have answered otherwise, as earlier answers are, expectably, more than sufficient. – Agent_L yesterday
    
@Agent_L again, no need to escalate when a comment will suffice - I added the line to provide relevance to the OP talking about VPNs at all. Else I would have purged that entire 3/4 of the post and not just the pic of the email. The OP agreed with the edit. There is nothing to "stop". – schroeder yesterday

It doesn't encrypt the sources unless they too are using encryption. One sided encrypition is like hiding in a safe from the world outside that knows your inside the safe.

share|improve this answer
2  
This doesn’t add anything over the other answers. Note that the OP shows encrypted peers only, so I don’t see hiw the remark is even applicable. – JDługosz yesterday

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.