Spy nodes know what websites you are visiting?

[kirkion]

Hey @dirk83, I think I found the answer to your question

What about nodes sniffing data?

Due to the de-duplication design, if an attacker wanted to identify people who retrieved a known document, the attacker would calculate the hashes for each chunk in the document. Any request for the document should involve a request for the hash of each chunk. If an attacker could map an IP to a GET request containing the hash of single chunk, the attacker could prove the IP requested the entire document. This is more likely to happen with public or shared documents, and could be an issue for t…

@vtnerd

I think its also worth mentioning that nearly all messages between peers are encrypted, which includes GET requests for documents. I think some messages in the initial connection phase cannot be encrypted, but that should be the only time (I haven’t scoured the initiation code much at all). Encrypting all messages between peers prevents attackers sniffing on the edge network in routers, etc, like @Blindsite2k mentioned. So an attacker in that position cannot map GET <–> safe_id or a safe_id <–> IP since the messages are an opaque encrypted blob.