Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor's Fall Harvest: The Next Generation of Onion Services

blog.torproject.org

Post reply on HN
Print view View original

41–50 of 86 posts

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#41

Post by wybiral »

zAy0LfpBZLC8mAC wrote: post #40
wybiral wrote: post #26

Earlier quoted context omitted.

I see this as a valid point. You don't need Tor for that, any local app could proxy a connection that way. But, yes, it is a useful side effect of Tor.

First of all, actually, no, a "local app" can't do that. The problem is that the machine doesn't have a globally reachable address, and that's not something that you can solve by changing the software on the machine, you need some external service that provides you with a globally reachable address and a way to forward connection requests for that address to your machine. That is a service that the Tor network provid…

I care more about security and privacy than anonymity.

IPFS or Keybase seem like better approaches towards those goals. And, yes, Tor makes sense if you need to hide your IP address. But beyond that I don't see much further use.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#42

Post by zAy0LfpBZLC8mAC »

wybiral wrote: post #41
zAy0LfpBZLC8mAC wrote: post #40

Earlier quoted context omitted.

First of all, actually, no, a "local app" can't do that. The problem is that the machine doesn't have a globally reachable address, and that's not something that you can solve by changing the software on the machine, you need some external service that provides you with a globally reachable address and a way to forward connection requests for that address to your machine. That is a service that the Tor network provid…

I care more about security and privacy than anonymity. IPFS or Keybase seem like better approaches towards those goals. And, yes, Tor makes sense if you need to hide your IP address. But beyond that I don't see much further use.

I don't think many people care about anonymity as a primary value. Anonymity is simply one tool to achieve privacy and security against certain types of risks/attacks.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#43

Post by airwavves »

PhearTheCeal wrote: post #35
wybiral wrote: post #33

Earlier quoted context omitted.

But now you have to trust that community directory not to give you the wrong onions...

Which is why information like that should be stored in the blockchain where it can't be modified.

This is a remarkably good idea. You can store an onion hash in a blockchain transaction and then use the signature of the key which sent that transaction to verify it.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#44

Post by wybiral »

PhearTheCeal wrote: post #35
wybiral wrote: post #33

Earlier quoted context omitted.

But now you have to trust that community directory not to give you the wrong onions...

Which is why information like that should be stored in the blockchain where it can't be modified.

That does seem more secure compared to the way people often talk about onion link lists and search engines.

But the blockchain can still be flooded with fraudulent onions and at some point you're still putting all of your trust into a form of authority.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#45

Post by Ajedi32 »

wybiral wrote: post #33
na85 wrote: post #32

Earlier quoted context omitted.

Keep one bookmark to a community directory? The plausible deniability is that you just visit for the catpicures1685isbis.onion, and not for cocainehookerz3288uiop.onion

But now you have to trust that community directory not to give you the wrong onions...

Unless the bookmark entries in your directory are encrypted with a passphrase only you know.

So... it sounds like what you're looking for is a password manager.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#46

Post by [deleted] »

the_stc wrote: post #9
wybiral wrote: post #8

I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to…

My company (details in profile) relies on Tor. We help people, but governments would like to shut us down. We actually will expose everything via a non .onion, then proxy it to our HS (SSL term done on the hidden service). We'll expose via .onion as well and get a cert. We are hoping with HS v3 the rules will relax. For now, Digicert told us they were not going to issue any more. Maybe if we push.

[deleted]

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#47

Post by adrianN »

zAy0LfpBZLC8mAC wrote: post #20
azernik wrote: post #11

Earlier quoted context omitted.

Tor hides the identity of the service provider to third-party eavesdroppers . You might know someone and have gotten the onion address of a file upload server from them, but not want the government or your ISP to know who you're talking to. It also hides the a service provider's physical location (well, their IP address and hence location in the network graph) from even a user that knows their identity. You might kno…

To add to that, one useful application for hidden services is to enable SSH login on machines that are behind some impenetrable NATs/firewalls that you can't open up for inbound connections. Have a machine behind mobile, NAT only internet? Set up a tor hidden service and log in without any problems!

And if you don't want to trust some random Chinese servers for accessing your IoT Home stuff, TOR is an excellent way to do that:

https://github.com/n8fr8/talks/blob/master/onion_things/Inte...

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#48

Post by nikcub »

pault wrote: post #28

The issue I've always had with onion addresses is that you can't remember them, which means you need to keep a list of bookmarks saved locally somewhere, which–if you're using tor to avoid prosecution–is pretty incriminating. What's the solution?

There is a pluggable name resolution proposal:

https://gitweb.torproject.org/torspec.git/tree/proposals/279...

You'd be able to run namecoin and other systems

edit: to add, I haven't yet completely bought into the new onion services. I like a lot of the security improvements, but it is really going to depend on how name resolution works and how authenticating endpoints will work for users. Running a pluggable name resolution system means we can try out different solutions and see which takes off organically and practically.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#49

Post by nikcub »

wybiral wrote: post #21
zAy0LfpBZLC8mAC wrote: post #16

Earlier quoted context omitted.

How do you know that you can trust the owner of any domain? How can you trust anyone? That's a deep philosophical question but doesn't really have anything to do with the technology you are using?

Reputation is a typical force in society. Businesses might want to do malicious things but the fear of destroying their identity helps to keep them in line. Personally I trust something more when someone puts their reputation on the line for it.

Reputation is also a force in onion land. There are hidden services that are trusted and those that aren't.

You see it with the drug marketplaces - users self-organize a distributed reputation system that tells other users which sites can be trusted with bitcoin and drug transactions and which cannot.

It's a remarkably well functioning and resilient system - and its hosted across reddit, forums, blogs, etc.

Post reply on HN