A Critical Evaluation of Website Fingerprinting Attacks

Recent studies on Website Fingerprinting (WF) claim to have found highly effective attacks on Tor. However, these studies make assumptions about user settings, adversary capabilities, and the nature of the Web that do not necessarily hold in practical scenarios. The following study critically evaluates these assumptions by conducting the attack where the assumptions do not hold. We show that certain variables, for example, user’s browsing habits, differences in location and version of Tor Browser Bundle, that are usually omitted from the current WF model have a significant impact on the efficacy of the attack. We also empirically show how prior work succumbs to the base rate fallacy in the open-world scenario. We address this problem by augmenting our classification method with a verification step. We conclude that even though this approach reduces the number of false positives over 63%, it does not completely solve the problem, which remains an open issue for WF attacks.

Colin “Phoul” Childs is a privacy and anonymity advocate. His interests in privacy, security, and cryptography have led to his work with the Tor Project, co-founding the security conference BSides Winnipeg and the non-profit security, privacy, and freedom of speech advocacy group Coldhak. He can be found tweeting about security, privacy, and politics under the handle @Phoul.