Tor's Fall Harvest: The Next Generation of Onion Services • Hacker News Board

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#11

Post by azernik » Fri, Nov 03, 2017, 1:01 AM UTC

wybiral wrote: post #8

I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to…

Tor hides the identity of the service provider to third-party eavesdroppers. You might know someone and have gotten the onion address of a file upload server from them, but not want the government or your ISP to know who you're talking to.

It also hides the a service provider's physical location (well, their IP address and hence location in the network graph) from even a user that knows their identity. You might know that I am an investigative journalist you're trying to send information to - or, given the origin or Tor, maybe you're a spy and you know I'm your handler - but I don't want to give away my location.

There are also a lot of use cases where the user doesn't care that much about knowing who the service provider is, and the service provider cares a lot about hiding their identity (enough so that they would not provide the service if they could not be anonymous).

For the example of, say, political commentary - often what you care about there is less the real-world identity of a person, and more their persistent identity and reputation. On the other side of the equation, though, in some environments people might not feel safe expressing their opinions at all if those opinions could be traced back to them.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#12

Post by wyager » Fri, Nov 03, 2017, 1:03 AM UTC

wybiral wrote: post #8

I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to…

You can have cryptographically anchored pseudonymous trust, which is what Tor does. In many ways it’s stronger than the kinds of trust you run into normally.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#13

Post by wybiral » Fri, Nov 03, 2017, 1:06 AM UTC

wyager wrote: post #12

wybiral wrote: post #8

I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to…

You can have cryptographically anchored pseudonymous trust, which is what Tor does. In many ways it’s stronger than the kinds of trust you run into normally.

You still have to get a correct onion address from a reputable source otherwise how do you know that you're going to the right onion and not a malicious mirror or something? So somehow there is a chain of trust, not too unlike the traditional PKI model.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#14

Post by MBCook » Fri, Nov 03, 2017, 1:11 AM UTC

Does it fix the LONG standing issue that Dr. Krawetz keeps discussing on his blog that makes it trivial to DOS an onion site? Description in the section about ‘Eddie’.

https://www.hackerfactor.com/blog/index.php?/archives/762-At...

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#15

Post by wybiral » Fri, Nov 03, 2017, 1:11 AM UTC

anamexis wrote: post #10

wybiral wrote: post #8

I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to…

There is another purpose, because when you access a hidden service, you are not using an (unknown, untrustable) exit node – instead, your data remains entirely encrypted until it reaches the owner of the address.

That's a valid point. Thanks for bringing that up.

So now I have a private channel to that address and I don't have to worry about the exit nodes (unlike when I use Tor for clearnet sites).

But now how do I know that I can trust the owner of that onion?

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#16

Post by zAy0LfpBZLC8mAC » Fri, Nov 03, 2017, 1:30 AM UTC

wybiral wrote: post #15

anamexis wrote: post #10

Earlier quoted context omitted.

There is another purpose, because when you access a hidden service, you are not using an (unknown, untrustable) exit node – instead, your data remains entirely encrypted until it reaches the owner of the address.

That's a valid point. Thanks for bringing that up. So now I have a private channel to that address and I don't have to worry about the exit nodes (unlike when I use Tor for clearnet sites). But now how do I know that I can trust the owner of that onion?

How do you know that you can trust the owner of any domain?

How can you trust anyone?

That's a deep philosophical question but doesn't really have anything to do with the technology you are using?

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#17

Post by zAy0LfpBZLC8mAC » Fri, Nov 03, 2017, 1:32 AM UTC

wybiral wrote: post #13

wyager wrote: post #12

Earlier quoted context omitted.

You can have cryptographically anchored pseudonymous trust, which is what Tor does. In many ways it’s stronger than the kinds of trust you run into normally.

You still have to get a correct onion address from a reputable source otherwise how do you know that you're going to the right onion and not a malicious mirror or something? So somehow there is a chain of trust, not too unlike the traditional PKI model.

What would be the "correct onion address" for 3fyb44wdhnd2ghhl.onion?

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#18

Post by hedora » Fri, Nov 03, 2017, 1:33 AM UTC

wybiral wrote: post #15

anamexis wrote: post #10

Earlier quoted context omitted.

There is another purpose, because when you access a hidden service, you are not using an (unknown, untrustable) exit node – instead, your data remains entirely encrypted until it reaches the owner of the address.

That's a valid point. Thanks for bringing that up. So now I have a private channel to that address and I don't have to worry about the exit nodes (unlike when I use Tor for clearnet sites). But now how do I know that I can trust the owner of that onion?

Maybe you know the owner personally, and obtained the onion address in person.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#19

Post by hedora » Fri, Nov 03, 2017, 1:36 AM UTC

zAy0LfpBZLC8mAC wrote: post #17

wybiral wrote: post #13

Earlier quoted context omitted.

You still have to get a correct onion address from a reputable source otherwise how do you know that you're going to the right onion and not a malicious mirror or something? So somehow there is a chain of trust, not too unlike the traditional PKI model.

What would be the "correct onion address" for 3fyb44wdhnd2ghhl.onion?

That is the “correct onion address” for that hashcode, but you have to obtain the hashcode somehow.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#20

Post by zAy0LfpBZLC8mAC » Fri, Nov 03, 2017, 1:37 AM UTC

azernik wrote: post #11

wybiral wrote: post #8

I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to…

Tor hides the identity of the service provider to third-party eavesdroppers . You might know someone and have gotten the onion address of a file upload server from them, but not want the government or your ISP to know who you're talking to. It also hides the a service provider's physical location (well, their IP address and hence location in the network graph) from even a user that knows their identity. You might kno…

To add to that, one useful application for hidden services is to enable SSH login on machines that are behind some impenetrable NATs/firewalls that you can't open up for inbound connections. Have a machine behind mobile, NAT only internet? Set up a tor hidden service and log in without any problems!