Schneier on Security

Mouse • March 21, 2007 6:42 PM

@Stephen Samuel

“Getting a new IP address makes you more difficult to find, but that’s nowhere near impossible.”

Sure, I accept that. I’m not trying to hide the fact that a particular piece of Google search data is mine – I am trying to prevent automated logging of my searches by Google such as happened with AOL – http://www.aolpsycho.com/

As I see it, the task of associating my Google searches made on different IP addresses will be a lot of work because some human analysis would be required unless the Google traffic is cross referenced against ISP logs (more on that later). Automated analysis of my traffic by a single commercial party appears to be very difficult to me if I keep changing IP addresses.

“TOR does the same thing: it adds some more hops.”

Well it certainly adds more hops but more importantly, it claims to use reasonably good cryptology for all but the last hop between me and my target URL. On a whim on several occasions, I have monitored my TOR browsing traffic with Ethereal and could not find any plaintext in any packets. Of course I am taking it on trust that TOR:
1) Does not log
2) Uses strong cryptology without any serious implementation bugs
I wouldn’t bet my life on TOR if was into espionage or serious crime but it’s almost certainly enough to discourage commercial data miners.

“It only takes someone digging one level deeper — logs of intermediate computers, or your ISP’s time-stamped MAC-to-IP and UserID-to-IP logs — to find your information.”

My MAC is surely the unqiue marker that I cannot escape and my MAC is the logical way for my ISP to log my traffic. I noted the importance of my ISP’s logs in my first post.

In summary, I think my suggestions will stop any commercial data trawling/mining (including my ISP if I use TOR) but I cannot win against professionals working for national governments or the police.

Mouse • March 21, 2007 9:00 PM

@MikeA

“Escape” depends on the policies of your ISP. Every NIC I have ever come across has its MAC set by the driver, initially from some EEPROM or the like, but not “hard”.

I suppose this all boils down to the ISP/situation specifics. I use NTL cable broadband which requires a cable modem device. The modem has a MAC and there is no obvious way to change that; even worse, NTL staff talked me through the connection process which included me telling them the MAC address printed on the sticker on the modem. In my case, I suspect that my account is keyed to the MAC address of my cable modem. My modem is attached to a router which takes multiples NAT connections. The MAC address of my PC NIC is irrelevant.

When I set up my router, I deliberately made sure that the router MAC address was used – not the PC “MAC-clone” address. I can attach as many devices as my router has ports and it works fine.

According to some of my friends, I can change the router with something else and it will work after up to a 24 hour delay but the modem MAC still hasn’t changed and I suspect that is what my IPS logs are keyed by.

Perhaps a more interesting question is what if I use a telephone line modem from a workplace phone or another phone that I can surreptiously access? Some ISPs will permit effectively anonymous registration for dial-up access. Possibly a pay-as-you-go mobile that is not properly registered to the owner could be used as well.