tl;dr: This vulnerability is quite serious, but it doesn’t affect
the Tor network any more than it affects the rest of the internet.
In particular, the Tor-specific attacks mentioned in the paper will
not work as described.
an excellent paper,
entitled “Off-Path TCP Exploits: Global Rate Limit Considered
Dangerous,” was published by Yue Cao, Zhiyun Qian, Zhongjie Wang, Tuan
Dao, Srikanth V. Krishnamurthy, and Lisa M. Marvel at USENIX Security
It feels rather sardonic to say this now, openly, after two years spent
alternating between trying to inhibit my rage and convince myself that I hadn’t
been hurt, followed by seeking out other victims, in order to develop the
collective capacity to defend ourselves and to have the simple ability to speak
out in a manner which would be heard and not discarded.
Jake and I had been friends and coworkers for years. Looking back on
it, I’m not sure why. From the very first Tor developer meeting I had
attended, he repetitively propositioned my partner and I for sex. He
even went so far as to, on the very first meeting on the first
morning, in front of all the other developers — whom I had not yet met
— tell me that he was okay with my partner and I fucking in the same
bed as him while he watched, causing both of my partner and I to feel
completely humiliated that our private sex life was being discussed in
front of colleagues we had hoped to build a good start towards
friendly, professional relationships.
While travelling, the first time he came to the city I lived in, I
invited him to stay at my house. As politely as I could, I explained,
“You can have the floor, and I’ll take my bed, or the other way
around. If you’re comfortable with it, we can share my bed, as
friends. Meaning no physical contact.” We both slept in my bed.
That turned out (mostly) fine. (Except, of course, being propositioned
again, this time for a threesome with Jake and one of my roommates.)
In fact, Jake and I proceeded to share beds in a friendly manner over
the years, and nothing bad ever happened.
Once Jake had moved to Germany, I came to visit friends there for a
while, and one night I stayed at Jake’s place. Again, we shared a
bed, as friends. There weren’t even any discussion or attempts
beforehand to convince me to do anything sexual with him. It was
freezing cold, and I went to bed with several layers of street clothes on.
Sometime around 5 o’clock in the morning, I woke up very confused and
startled because my pants were unzipped and Jake’s arm was wrapped
around me, his hands in my underwear and he was rubbing my clit and
rimming the edges of my vagina. I tried to shove him off me and wake
him up. He’s physically much bigger than me, so the shoving didn’t
work as well as it should have, but nonetheless he rolled over, a bit
exageratedly, mumbling as if asleep.
In the morning, I confronted him about it. I was really confused. I
didn’t know if he was actually asleep, but if he was, how did my
clothes come undone? Assuming that if I was super confrontational
about it, he’d have some excuse like “Oh, but I thought it was okay
that time because you didn’t explicitly give me the we’re-just-friends
lecture before bed…” When confronting Jake about this, I said, “Dude,
what the fuck. You started fingering me last night.” It took a few
seconds for there to be a reaction on his face, and then he seemed
confused, saying “Oh… what? I don’t remember that.” I glared at him.
The really disconcerting thing for me was that, half an hour later, he
said, “I thought you were her.” Here, “her” was Jake’s fiancée. At
the time, she didn’t live in Germany, and they hadn’t seen each other
in weeks. Jake’s fiancée was also gorgeous and super curvy, and I am
basically a scrawny, little twig. “I’m not sure how you could confuse
us, even asleep.” I said. He continued muttering some excuses about
having wet dreams about her. He seemed to suddenly and extremely
vividly remember whatever dream. Nowhere did he say, “I didn’t put my
hands in your panties,” nor did he apologise.