[tor-talk] Find Real IP via ISP.

[Mirimir]

On 11/22/2016 07:22 AM, Jason Long wrote:
> Thus we must not Visit a site with and without Tor in a same time?

Unless you're very careful not to associate the connections, it's a bad
idea. For casual sock-puppetting, I suppose that it's OK ;)

> On Tuesday, November 22, 2016 5:25 PM, Mirimir <mirimir at riseup.net> wrote:
> 
> 
> 
> On 11/22/2016 04:48 AM, Jason Long wrote:
>> Hello.
>> As "Seth David Schoen" said, Governments can see that users using
>> tor but can't see what they are doing. My questions is that if an
>> ISP see that an IP address, For example, 100.100.100.1 connected
>> to the Tor network and user IP address changed to 200.200.200.1
>> then if the user visit a website with Tor then if the websites
>> owners show 200.200.200.1 to the ISP then can ISP give
>> 100.100.100.1 to the website owner?
>>
>> Thank you.
> 
> As others have pointed out, ISPs don't know Tor exit IP addresses.
> Websites, of course, know Tor exit IP addresses. Because they see them
> when users connect. But knowing them doesn't allow them, or even help
> them, find users' ISP-assigned IP addresses.
> 
> However, let's say that you've used a website without Tor. And let's say
> that you have an account. If you subsequently login to that account
> using Tor, the website operator could contact your ISP (which it knows
> from your prior use without Tor) and ask what you were doing at the time
> you logged in. And they would learn that you were using Tor.
> 
> Even without an account, cookies could mark you just as well.

Unless, I should have said, you're using separate browsers. Such as Tor
browser and Firefox.

> Even so, ISPs generally won't provide that sort of information without a
> court order. So you would need to attract major attention from the
> website, or interested third parties, before you'd be at risk.
> 
> There's also the possibility of website fingerprinting. So if you had
> used a website without Tor, your ISP could have collected data that
> allows them to identify connections to that website. Consider
> <http://hubblesite.org/gallery/wallpaper/>. There are many images, and
> they tend to load in a particular order. So the network traffic pattern
> is relatively unique. Many porn sites, for example, also have distinct
> fingerprints.
> 
> But generally, if a website has never seen you without Tor, they have no
> chance of even tracking you back to your ISP. Let alone getting your
> identity from the ISP.
>