Everyday people use the network to connect with people without worry of being tracked or their data being collected. In some cases people rely on the network when they need to be discrete or are doing sensitive work.
What is I2P?
The Invisible Internet Project (I2P) is a fully encrypted private network layer that protects your activity and location. You can use I2P to connect with people without worry of being tracked or data collection if you are doing sensitive work.
How does the I2P network function?
The I2P network is powered by other people. Peers donate a portion of their bandwidth to other network participants, which allows the network to function without relying on centralized servers.
How does I2P keep my internet use anonymous?
I2P hides the server from the user and the user from the server. Traffic inside I2P doesn't interact with the Internet directly, but uses encrypted tunnels between you and your peers, so no one can see where traffic is coming from, where it is going, or what the contents are. Additionally I2P offers resistance to pattern recognition. Because the network relies on peers to route traffic, location blocking is also reduced.
Privacy and Security By Design
I2P has created transport protocols that resist DPI censorship, and continuously improves its end to end encryption. Read the I2P Transport Overview.
Built For Communication
I2P has an application layer with easy to use APIs for creating your own privacy - aware apps.
What's New
This release contains fixes for CVE-2023-36325. CVE-2023-36325 is a context-confusion bug which occurred in the bloom filter. An attacker crafts an I2NP message containing a unique messageID, and sends that messageID to a client. The message, after passing through the bloom filter, is not allowed to be re-used in a second message. The attacker then sends the same message directly to the router. The router passes the message to the bloom filter, and is dropped. This leaks the information that the messageID has been seen before, giving the attacker a strong reason to believe that the router is hosting the client. This has been fixed by separting the bloom filter's functionality into different contexts based on whether a message came down a client tunnel, an exploratory tunnel, was sent to the router directly. Under normal circumstances, this attack takes several days to perform successfully and may be confounded by several factors such as routers restarting during the attack phase and sensitivity to false-positives. Users of Java I2P are recommended to update immediately to avoid the attack.
In the course of fixing this context confusion bug, we have revised some of our strategies to code defensively, against these types of leaks. This includes tweaks to the netDb, the rate-limiting mechanisms, and the behavior of floodfill routers.
This release adds not_bob as a second default hosts provider, and adds notbob.i2p and ramble.i2p to the console homepage.
This release also contains a tweakable blocklist. Blocklisting is semi-permanent, each blocked IP address is normally blocked until the router is restarted. Users who observe explosive blocklist growth during sybil attacks may opt-in to shorter timeouts by configuring the blocklist to expire entries at an interval. This feature is off-by-default and is only recommended for advanced users at this time.
This release also includes an API for plugins to modify with the Desktop GUI(DTG). It is now possible to add menu items to the system tray, enabling more intuitive launching of plugins which use native application interfaces.
As usual, we recommend that you update to this release. The best way to maintain security and help the network is to run the latest release.
Changes
- netDb: Throttle bursts of netDB lookups
- Sybil/Blocklist: Allow users to override blocklist expiration with an interval
- DTG: Provide an API for extending DTG with a plugin
- Addressbook: add notbob's main addressbook to the default subscriptions.
- Console: Add Ramble and notbob to console homepage
Bug Fixes
- Fix replay attack: CVE-2023-36325
- Implement handling of multihomed routers in the netDb
- Fully copy new leaseSets when a leaseSet recievedAsPublished overwrites a leaseSet recievedAsReply
