Introducing Defense against AI-guided Traffic Analysis (DAITA) | Mullvad VPN
mullvad.net
Even if you have encrypted your traffic with a VPN (or the Tor Network), advanced traffic analysis is a growing threat against your privacy. Therefore, we now introduce DAITA.

Even if you have encrypted your traffic with a VPN (or the Tor Network), advanced traffic analysis is a growing threat against your privacy. Therefore, we now introduce DAITA.

Through constant packet sizes, random background traffic and data pattern distortion we are taking the first step in our battle against sophisticated traffic analysis.

      • Pyrosis@lemmy.worldEnglish
        2·
        8 months ago

        I doubt it would matter in some environments at all.

        As an example a pc managed by a domain controller that can modify firewall rules and dhcp/dns options via group policy. At that point firewall rules can be modified.

      • thatsnothowyoudoit@lemmy.caEnglish
        16·
        8 months ago

        The Option 121 attack is a concern on networks where you don’t.

        Exactly where you’d want a VPN. Cafes, hotels, etc.

        • DefederateLemmyMl@feddit.nlEnglish
          4·
          8 months ago

          True that. Hadn’t thought of that as it’s not my typical VPN use case.

          I’m not sure what a VPN provider could do about that though, they don’t control the operating system’s networking stack. If the user or an outside process that the user decides to trust (i.e. a dhcp server) adds its own network routes, the OS will follow it and route traffic outside of the tunnel.

          The defenses I see against it are:

          • Run the VPN and everything that needs to go through the VPN in a virtualized, non-bridged environment so it’s unaffected by the routing table.
          • Put a NAT-ing device in between your computer and the network you want to use
          • Modify the DHCP client so that option 121 is rejected

          Edit: thinking about it some more, on Linux at least the VPN client could add some iptables rules that block traffic going through any other interface than the tunnel device (i.e. if it’s not through tun0 or wg0, drop it). Network routes can’t bypass iptables rules, so that should work. It will have the side effect that the VPN connection will appear not to work if someone is using the option 121 trick though, but at least you would know something funny was happening.

      • Pyrosis@lemmy.worldEnglish
        3·
        8 months ago

        Of course but you don’t control rogue dhcp servers some asshat might plug in anywhere else that isn’t your network