Tor vs. I2P – Anonymization and B2B Opportunity

The internet is a far stranger place than the average user gets to experience. It’s used not only for everyday activities such as looking up recipes and updating Facebook statuses, but also for activities that might land users in jail.

Because we’ve become so privacy-oriented, completely dismissing the idea of being tracked for advertising purposes or for national security concerns, this hidden part of the internet has become a lot more accessible to average uses. If the Darknet was only used by drug dealers, hackers, or even terrorists in order to encrypt and anonymize their activity and traffic, the average user running from tracking services has become interested in Tor and I2P.

However, while anonymization can be used for illegal activities, the concept behind the technology is sound and could be used by organizations to deploy their own private anonymization clouds, offering the same level of security but without running a hidden service.

Tor versus I2P

The Tor network has been advertised as an anonymization network designed for the distribution of illegal goods ranging from drugs and weapons to child pornography and stolen or counterfeit credit cards. It has survived mostly because its anonymization and encryption mechanisms were sufficient to thwart any attempt from law enforcement to crackdown on these activities.

Tor also developed a user-friendly interface that allowed anyone with an internet connection to anonymize their traffic just by downloading a specially designed web browser that bounced traffic through Tor’s distributed network, ensuring complete anonymity. The successful combination of usability and anonymization contributed to Tor’s popularity amongst end users as a tool for dodging web tracking, but also amongst those who wanted to buy illegal stuff.

The downside of Tor is that, because it has been used to illegal activities, law enforcement has been actively trying to monitor its exit nodes and identify potentially terrorist activities On the upside, Tor has a high user base and potentially more funding that I2P to invest in continued development.

While I2P seems like the underdog in this privacy battle, the difference is that it wasn’t specifically built to run any proxies to the internet, but as an internal network. However, client outproxies could be used to allow a sort of incognito web browsing.

I2P was designed as an extra layer that applications can use to anonymously and securely communicate with each other, without using traditional IP address but cryptographic identifiers. That means both parties engaged in the peer-to-peer communication need to run I2P. Naturally, developing applications and wrapping the entire communication with an I2P tunnel should allow for both encryption and anonymization, if using the I2P API.

Consequently, I2P could be used by cybercriminals or terrorists to run anonymized IRC networks or build file transfer applications, ensuring that law enforcement has little chance of figuring out what they’re discussing.

While both Tor and I2P were built with anonymization in mind, they’re usually used for different purposes. However, cybercriminals have been actively using both when hiding C&C (Command & Control) servers or distributing malware.

Anonymization and B2B

While illegal business on the Darknet is thriving, legitimate organizations and companies don’t usually employ these services for anonymizing traffic.  VPNs are usually their preferred method when anonymizing or encrypting traffic.

However, it’s interesting to note that Microsoft’s Outlook Web App (OWA), which allows users to connect to their Exchange Server email address from their browser, can be configured as a hidden service, much like Tor. Plus, there’s the added benefit that you can wrap a VPN service over Tor services to ensure both anonymization and encryption.

There’s also the fact that a certificate authority decided to issue a valid and legitimate SSL certification for a .onion website (Tor website) for Facebook, showing not only that Tor has gained popularity amongst end users, but that companies have acknowledged anonymization and are trying offer their customers what they want.

Companies could adhere to Facebook’s approach or even start implementing their own private Tor Clouds. This could provide security without running a Tor hidden service, allowing clients and employees to connect to a private Tor network that looks and operates just like a regular network.