Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor's Fall Harvest: The Next Generation of Onion Services

blog.torproject.org

Post reply on HN
Print view View original

81–86 of 86 posts

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#81

Post by Teapot »

devrandomguy wrote: post #79
amelius wrote: post #57

Earlier quoted context omitted.

How fast/convenient is Tor for downloading large files, like video (e.g. via Bittorrent)? PS: It seems that Bittorrent over Tor is a bad idea, [1]. [1] https://blog.torproject.org/bittorrent-over-tor-isnt-good-id...

In Qatar, which has a national firewall, I was able to use Tor to browse torrent sites, and then use a regular bittorrent client to fetch the contents of the magnet links (encrypted connections only). That worked great for the few years that I was there. The Qatari internet was a fair bit faster than what I am used to from Canada, about 30 - 50 MB/s at max torrent.

Worth trying Tribler. Seems it's Torrent traffic inside its own Tor network. https://en.wikipedia.org/wiki/Tribler

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#82

Post by asn_tor »

Ajedi32 wrote: post #80
pault wrote: post #78

Earlier quoted context omitted.

Doesn't protect from rubber hose side channel attacks.

Yeah, ideally you'd want plausible deniability. In theory, you could achieve this by only storing the password DB in a cloud service you access through the Tor browser, but then you run into two other problems. First, how do you remember the address of the service you're using to store your password DB? If you store that address on your device, you've lost your plausible deniability. I guess you'd have to use a well-…

Indeed, an encrypted bookmark manager in Tor browser would be cool.

Also see this blog post: https://blog.torproject.org/cooking-onions-names-your-onions

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#83

Post by johnpython »

nikcub wrote: post #54

If you are looking for a practical use of hidden services: we use them as ingress for Docker and K8 management. You start a container that runs just tor with a config and can read the routing endpoints from your config, or link to localhost:2375 HiddenServicePort : You setup HiddenServiceAuthorizeClient with stealth auth type and a list of authorized clients. You can lock your firewall rules down as the hidden servic…

This sounds cool, but it's needlessly complicated. Why not simply configure SSH to use multiple forms of authentication [1]: password + public key auth + 2FA (Duo Security, Google Authenticator, Authy, etc.). That's all you need to achieve a very secure state.

1 https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Multi-F...

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#84

Post by jstanley »

dmix wrote: post #70
jstanley wrote: post #64

Earlier quoted context omitted.

Here you go: https://www.torproject.org/docs/tor-hidden-service.html.en It's dead easy. Setup a web server basically like normal, but make sure it's listening only on loopback if that's important to you. Then install tor, and add a couple of lines to the torrc and restart tor. HiddenServiceDir /usr/local/etc/tor/hidden_service/ HiddenServicePort 80 127.0.0.1:8080 The keypair will be generated and you'll find the onio…

How have you found long term maintenance of running these services? ie, running into random breakage and spending time debugging the system vs an nginx box or something... Is it set-it-and-forget-it type of system? I've always wanted to set up onion addresses but I'm always wary to open up a new bag of worms for my personal projects. The fact it sounds so easy is encouraging.

Yes, it's set-and-forget. It still runs nginx, it's basically the same as running a clearnet site.

I've not experienced any random breakages.

Re: Tor's Fall Harvest: The Next Generation of Onion Services

#86

Post by infogulch »

Ajedi32 wrote: post #80
pault wrote: post #78

Earlier quoted context omitted.

Doesn't protect from rubber hose side channel attacks.

Yeah, ideally you'd want plausible deniability. In theory, you could achieve this by only storing the password DB in a cloud service you access through the Tor browser, but then you run into two other problems. First, how do you remember the address of the service you're using to store your password DB? If you store that address on your device, you've lost your plausible deniability. I guess you'd have to use a well-…

IPFS over Tor?
Post reply on HN