The article is really interesting and valid.
Tor's Fall Harvest: The Next Generation of Onion Services
51–60 of 86 posts
Re: Tor's Fall Harvest: The Next Generation of Onion Services
#52I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to…
Whistleblower drops for example. In case of Facebook the point is that some countries forbid access to Facebook and those can easily just use Tor now.
Re: Tor's Fall Harvest: The Next Generation of Onion Services
#53Does it fix the LONG standing issue that Dr. Krawetz keeps discussing on his blog that makes it trivial to DOS an onion site? Description in the section about ‘Eddie’. https://www.hackerfactor.com/blog/index.php?/archives/762-At...
He didn't discover an issue - he just FUD'd long enough until a few people believed he did. That he believes there is something "suspicious" about Tor nodes because their IP doesn't match to any country or AS name in the free distribution of the GeoIP database built into Tor is just smh bad Why he also believes bots accessing his HS has anything to do with Tor Exit nodes is also beyond me .. but he provides no eviden…
To add: at the time that original story was posted I left this comment[0] explaining what I believe he was seeing
He was asked to ping tor-security or file an issue and never did, afaik - nor was it ever really seriously discussed
Re: Tor's Fall Harvest: The Next Generation of Onion Services
#54If you are looking for a practical use of hidden services: we use them as ingress for Docker and K8 management.
You start a container that runs just tor with a config and can read the routing endpoints from your config, or link to localhost:2375
HiddenServicePort :
You setup HiddenServiceAuthorizeClient with stealth auth type and a list of authorized clients.
You can lock your firewall rules down as the hidden service only requires outbound to HTTPS.
On the client end you setup regular Tor with HidServAuth
With stealth auth other tor users won't see the serivce and port published without the auth cookie
You can then use socat to bind the remote hidden service and port to a local host and port:
socat tcp-l:127.0.0.1:2023,fork socks4a:onionaddr.onion:localhost:23,proxyport=9050
You then have the remote ssh server available locally with no public interfaces, no public ports, and an additional layer of confidentiality and authentication
Re: Tor's Fall Harvest: The Next Generation of Onion Services
#55Earlier quoted context omitted.
Which is why information like that should be stored in the blockchain where it can't be modified.
This is a remarkably good idea. You can store an onion hash in a blockchain transaction and then use the signature of the key which sent that transaction to verify it.
Or just use IPFS.
Re: Tor's Fall Harvest: The Next Generation of Onion Services
#56I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to…
With the new protocol you could use it to protect IOT services, which identity you would naturally know but no one else would. A security camera for example.
An other use case would be access to a server IPMI/Online KVM switch, which has a tendency to not get updated regularly.
In general any situation where you in the past had to go through a third-party hub could be replaced with a hidden service for a end-to-end solution, as long latency isn't a major requirement.
Re: Tor's Fall Harvest: The Next Generation of Onion Services
#57I used to use Tor to bypass censorship on pr0n in my country and ended up trying to run a hidden service for fun. My biggest peeve with was the domain name. I mean, sure I understand why it isn't human readable but then there are so many ways to counter that. We've got the blockchain and we have the IPFS way to handle these things too. I'm hoping at some point blockchain DNS systems are adopted by mainstream (or nich…
How fast/convenient is Tor for downloading large files, like video (e.g. via Bittorrent)?
PS: It seems that Bittorrent over Tor is a bad idea, [1].
[1] https://blog.torproject.org/bittorrent-over-tor-isnt-good-id...
Re: Tor's Fall Harvest: The Next Generation of Onion Services
#58If you are looking for a practical use of hidden services: we use them as ingress for Docker and K8 management. You start a container that runs just tor with a config and can read the routing endpoints from your config, or link to localhost:2375 HiddenServicePort : You setup HiddenServiceAuthorizeClient with stealth auth type and a list of authorized clients. You can lock your firewall rules down as the hidden servic…
Awesome, this is what I had in mind for using a stealth way to manage infrastructure.
Thanks for sharing a blueprint as I'd only theorycrafted it and now I have a path to experiment with.
Re: Tor's Fall Harvest: The Next Generation of Onion Services
#59Being undiscoverable is a big help. For our ancillary services, we're taken to using Tor2Web to auth mode HS servers because some random domain is less likely to look interesting for people to poke at. Publishing a .onion, especially with some general-purpose software hosted on it screams that there is something of interest there.
Gotta be the change you want to see. None of my hidden service .onion sites are anything "of interest". They're just electronics and radio hobby stuff like the web has always had. Put everything on Tor as a hidden service and eventually the stigma will go away.
Do you have a guide to doing that? I would love to host some stuff on Tor just because.
Re: Tor's Fall Harvest: The Next Generation of Onion Services
#60If you are looking for a practical use of hidden services: we use them as ingress for Docker and K8 management. You start a container that runs just tor with a config and can read the routing endpoints from your config, or link to localhost:2375 HiddenServicePort : You setup HiddenServiceAuthorizeClient with stealth auth type and a list of authorized clients. You can lock your firewall rules down as the hidden servic…
> additional layer of confidentiality and authentication
and additional layers of attack surfaces