▲ 275 points
back
223 comments
From an average of significantly below 500k to almost 2.5M users.
This drives up the global number of connecting users from approx. 3M to almost 5M.
Hard to imagine that so many people in Germany suddenly switched to TOR, especially since there has not been any significant event lately that may have triggered such a decision (afaik)?
My personal experience with TOR (as an administrator of various websites and services) is that it is a major source of unwanted/malicious traffic (spam, etc.) and most of it is automated. The big increase is probably not users but bots?
The interesting question is if there is a bot net spreading in Germany since the 17th of June. What would be the likelihood of that going undetected. If you like conspiracy theory, the rise in one country could point to state actors.
I faced a recent distributed attack averaging 20,000 RPS[1] around the same time which makes me think that there might be a bot. I wonder if there’s a network of website operators similar to NANOG or the RIPE NCC mailing lists where I could compare my own experience with those of other operators.
Any UX changes to something like Brave browser perhaps? Making it easier to use tor mode. Although this is a big jump.
Note that the growth is not just in Germany. Ireland, Sweden, Switzerland also show jumps (however in absolute terms they are still much smaller). I would not rule out it's people or bots connecting from third country/countries through VPNs based in Europe... for whatever reason.
do you believe these numbers?
Interestingly a similarly drastic increase in German Tor clients also happend back in 2017: https://www.chip.de/news/Raetselhafter-Nutzeranstieg-Zahl-de...
if you configure the graph to show more years you can see the similarities: https://metrics.torproject.org/userstats-relay-country.html?...
Is someone trying to compromise the Tor network?
I read that Tor needs a certain percentage of non-malicious nodes to function, though I am not sure if that is applicable clients.
It's not applicable to clients. A clients traffic never touches another client, only the nodes.
Of course, malicious clients can ruin it for everyone else in the form of DoS attacks but that's clearly not happening here.
I think you're thinking of blockchain
Could these be attempts at data mining for unmasking Tor users?
Back in 2017 the German BND was revealed to have a history with that: https://netzpolitik.org/2017/secret-documents-reveal-german-...
Seems most likely, either by academics or government.
Not really the most subtle way about it though and likely to face some response.
I'd assume both have the capability to run a fairly accurate simulated network without anyone noticing so it's a bit strange.
It's not clear to me how you'd do that with clients, rather than relays.
Would regularly changing circuits/identities mitigate this? E.g., pressing ctrl/cmd + shift + L every few minutes?
It’s quite an interesting spike, though I doubt that such an operation would be so obviously.
Most of the comments suggest strange conspiracy theories, but the traffic is an exponential ramp (drive into 2023). Also, there has been rapid growth in some neighboring countries.
It could be organic growth. There have apparently been a few wiretapping scandals this year; people may be using it to access Ukraine/Russia, and a bunch of laws passed last year that incentivize US companies to block EU traffic (to avoid fines for data leaks).
Any of those seem more plausible than a single actor renting a rack or dc in one country, and using tor to try to evade detection.
Clicking around and looking at the chart for random other countries shows a spike for Sweden too, whereas Finland has a different but interesting pattern all of its own.
Wonder if the fact that they’re related to NATO, who is at war, have anything to do with it.
Does anyone understand the mass flagging and downvotes going on in this comment section? I'm very confused as I've never seen anything like it.
Just the usual political flamewar that happens here from time to time, not sure why it escalates on some threads and not on others though.
If you click the timestamp there should be a "vouch" button for comments to restore them.
It's quite annoying, possibly NAFO or similar.
I'm guessing that there is some automatic system that works on certain words in comments. Flame detection has been mentioned before. Probably in combination with account age or karma. I also imagine that users vouching for these might offset the behaviour.
There is no way these are organic users. Could it be, that some VPN is using Germany as an entrypoint?
Could be that someone is using a Cloud Provider in Germany, for example Hetzner
The obvious explanation is that German ISP's blocked 711chan, so the onion service is the only way for them to access the site.
Jk, but if you change 711chan to Krautchan maybe it's true
From around September 2022 to March 2023 media in Germany promoted the Snowflake Browser Extension (https://addons.mozilla.org/de/firefox/addon/torproject-snowf...) to help Iranians circumvent censorship. Is this a possible explanation?
„These estimates are derived from the number of directory requests counted on directory authorities and mirrors.“
Depending on how these numbers are obtained, there is a non-zero chance at least part of this increase is caused by us.. note that this number is not indicative of the amount of users or origins (i.e. physical source addresses), but only count directory requests.
Plausible options seem to be malware, another attempt to crack tor by enforcement or some sort of app that added tor browsing
I'm not sure who titled this post, but the word "drastic" isn't found in the target web page. And as a native English speaker, "drastic" feels wrong for this usage. I would say it's an inadvertent swap of meaning with the term "dramatic" which would make more sense.
"Drastic" has a negative connotation of intent behind it. For example, "drastic increase in police enforcement of laws in Germany" would make sense. In the case of the headline, it just rubs me the wrong way.
Tor metrics don't really tell you much about the actual human users of the networks. They mostly tell you about current bot/etc usage. It's why inferred tor v3 datarates have been wildly inflated (10gbps) ever since support was turned on in the release binaries despite 99% of human people using tor v2 (at the time).
Have something changed in how German police goes after drug dealers? It's the most important use case for Tor anyway.
I have to wonder how many of these are from cheap German servers, from criminals trying to DDoS rival markets.
I've noticed VPN severs in Germany to be busier than usual too.
Any updates in regards to this data?
It could be INTERPOL
Germany is blocking a lot of websites ( i.e. rt.com)
Maybe related to the Proto-Nazi party AfD winning a district a few days ago. And this 5 day old news story: https://www.politico.eu/article/germany-far-right-afd-securi... "Germany’s far-right AfD placed under security service surveillance" - "The party is now treated as a ‘suspected case’ for far-right extremism".
I wonder if anyone can see inside the right-wing chat networks and if they've been mentioning Tor.
Although in the raw CSV's the spike started around mid-June...
China has the great firewall, the UK has Hadrian's firewall, I guess this is the Berlin firewall.
Looking at the chart it seems to line up with the war in Ukraine. Germany was a target of Prigozhin’s Internet Research Agency (troll farms). I wonder if we will see a drop in Tor usage now that his coup has failed and his organization is being dissolved.