As far as I understand, Trackers in torrents somewhat provide the promise that the peers it shows you are non-malicious. In trackerless torrents however, you fetch peers from other peers. How does that system ensure malicious peers are weeded out from the pool and not passed around?

  • 5
    Private trackers belonging to invitation-only sites might achieve this, but public trackers certainly do not. – grawity Apr 13 '18 at 6:15
  • 1
    From my understanding of it, there is no promise of non-malicious peers. They way that peers get blocked is from bad block checksums. I.e 7 peers send what you expected, and # 8 fails the check (because the file has been my modified) peer # 8 gets blocked. If you require trust from peers, join a private torrent community. I might add you still can't really "trust" users you don't actually know on the internet. This is why you use image checksums when downloading, for instance a Ubuntu image via torrent client. You better make sure what you downloaded, is what you intended to download – Tim_Stewart Apr 13 '18 at 17:04

My question stems from the fact that I thought a malicious user would simply give the malicious file to other users and they would accept it. This turns out to be incorrect.

As far as I understand this - it seems like the .torrent file holds metadata about the SHA1 hash of each file block you will download.

This means that you can have malicious users send you malicious data but the torrent client checks the hash of the sent data and the expected hash. If they don't match - the file is discarded.

Consequently, the trust now depends on the .torrent file and the place you obtained it from. If it originally contains checksums for a malicious file, you cannot do anything but download the malicious file.

It semes like there is a mechanism in trackerless DHT torrents which eventually weeds out malicious peers, but I do not have access to the paper which describes it - https://link.springer.com/chapter/10.1007/978-3-540-79705-0_4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.