Skip to content
This repository has been archived by the owner on Aug 15, 2024. It is now read-only.

Home

Jump to bottom
Linus Gasser edited this page May 5, 2022 · 2 revisions

Anonymous Communication in Mobile Apps

Since the beginning of the commercial internet, and even more so with the start of mobile apps, there is a tendency to collect as much data from the users as possible. This data is used to monetize the users by selling it to other companies [1]. But it can also be used by governments to track users, even when the government said they will not do it [2].

Fortunately, over the last couple of years, there has been an outcry over all this data usage, which is often opaque to the end user. So a lot of apps, specifically government-funded apps, are looking for a way to gather data in a privacy-preserving, anonymous way.

An example of this is the SwissCovid app, which showed that it is possible to keep the anonymity of the users, while still offering a service. But even in SwissCovid, the ISPs could see that the app is connecting to the central server. And the central server needed to take extra steps to make sure it didn’t log the IP addresses of the users. This made it impossible to collect statistics about the app usage.

There are two main technologies that can help to anonymize the users network traffic: VPNs and Tor.

Difference Between VPN and Tor

A Virtual Private Network (VPN) creates a protected connection between two computers on the internet. This protects the user against a curious ISP, but the VPN servers will still know which user communicates with which server.

The Tor network, on the other hand, hides the user traffic from both the ISP and the destination server by sending all packets from the user through a series of randomly selected nodes. It is set up in such a way that no single node has a complete overview of the traffic. Only a global observer can try to deanonymize the traffic, and only with a very high cost [5].

While using Tor on a desktop computer is quite easy, using it on mobile devices is difficult for at least two reasons:

  1. Finding a library that is suitable for inclusion in a mobile app
  2. Handling the additional bandwidth requirement for using tor

Finding a Suitable Library

The solutions to include Tor in a mobile app presented in the Annex A all have different shortcomings:

  • The need to install an additional app for the user (Orbot)
  • Not available for both Android and iOS
  • Difficult to set up and integrate (original Tor client)
  • Outdated libraries

Bandwidth Requirements for Tor

Using the Tor network has a very high overhead because the client needs to download a list of all available nodes. This list weighs more than 10MB and needs to be updated a couple of times per day. So for clients relying on a small mobile data plan, and an app that is used on a daily basis, this solution will use 500MB or more per month, which might exceed the bandwidth budget of the client.

ADD HERE: This is not as secure as the original Tor.

Lightarti-rest

There is a new Tor-library called arti [3], which is written in Rust and is being actively developed, supported by a grant from the ZCash foundation [4]. We built a wrapper around this library that can be included directly in mobile apps for Android and iOS. It solves the two problems above in the following way:

  1. The library is available natively for both Android and iOS
  2. It reduces the required bandwidth by using a set of nodes that is only updated once a week

Our wrapper over arti led us to collaborate with the authors of arti to make sure that our libraries can use unmodified code [6]. This is important for maintaining the project over a longer timespan.

Native Library

Our library is based on arti, which is not a complete replacement for Tor yet, as of April 2022. But it is stable enough to be used as a client. Using this library we created a wrapper that offers a simple REST interface for your application.

The library is available for both Android as a java package, and for iOS as a Swift package. We also offer small test-applications that show how to use the library. This includes the code to download the node-list and initiate a request.

Through our work with the original arti team, we make sure that our code can follow the code of the project and is easily maintainable.

Bandwidth Reduction

To reduce the bandwidth requirement, we use an honest but curious attacker model: the server is thought to be honest, but will look at all the traffic. We suppose this is either a democratic government that wants to protect its citizens, or a company with strong commitment to privacy.

Using this attacker model, our library creates a list of the fastest and most reliable nodes, and offers it for download to the mobile clients. Once per week the mobile clients can download this packet, which only has the size of about 100kB. To improve reliability, the client can download a file that is created daily and which indicates nodes that don’t work anymore.

An example of this list is available on github, and updated daily. But the scripts are available to create your own list on your own servers.

Where to get it

The libraries themselves are available here:

We made two very simple applications to show how to use the library. For Android, the test app is in the same repo as the library itself. For iOS, it is here: https://github.com/c4dt/lightarti-rest-ios-test

The repository for creating the node list has a github-workflow which automatically creates a new list of nodes every week, and a list of inactive nodes every day:

https://github.com/c4dt/lightarti-directory

Contact

If you have questions, requests, or ideas how to improve this further, don’t hesitate to open a github-issue in one of the projects, or contact us at c4dt-dev@listes.epfl.ch

Links

Appendix A - Other Tor Libraries for Mobile Applications

App Description Android iOS Last Update
Orbot Mobile app that offers a proxy for other apps Yes Yes 2022/04
Tor.framework Library depending on the original Tor source No Yes 2022/03
Tor-android Library depending on the original Tor source Yes No 2022/03
Tor_Onion_Proxy_Library Library that creates a Tor proxy directly in your app Yes No 2021/01
Lightarti Library using arti to connect to the Tor network with bandwidth reduction Yes Yes 2022/04
Clone this wiki locally