Earlier quoted context omitted.
To me, .onion reminds me too much of The Onion.
The Onion really needs an .onion site.
They really should, the.onion would almost be perfect.
MoreOnionsPorfavor: Onionize your website and take back the internet
71–80 of 151 posts
Re: MoreOnionsPorfavor: Onionize your website and take back the internet
#72I tried this feature of Tor Browser, using the first example I saw in TFA (www.propublica.org)... and was surprised to see that the .onion equivalent of the www.propublica.com home page... tried to make requests to third-party non-.onion cross-site surveillance trackers. google.com/recaptcha connect.facebook.net static.chartbeat.com ak.sail-horizon.com pi.pardot.com htlbid.com A separate concern, besides this choice…
To be safe one should disable JavaScript and most if not all third-party requests on .onion sites. Thats why TorBrowser always includes NoScript. Unfortunately in an unsafe default configuration that allows too much.
So overall, I guess this move isn't intended to protect the masses but provide more cover traffic mainly.
Re: MoreOnionsPorfavor: Onionize your website and take back the internet
#73In this context OnionShare (https://onionshare.org/) is an excellent program that even non-technical people can use to either share files or even complete static websites over Onion routing. The main advantage is you don't need to grub around with Nginx, Apache and the Tor daemon manually setting everything up.
Re: MoreOnionsPorfavor: Onionize your website and take back the internet
#74Earlier quoted context omitted.
I wasn't as active on the Internet during the initial rise of HTTPS, but I wonder how many companies, schools, and public stores threw the exact same fits back then when they realized there might be a world where they could no longer MITM every web request that went across their routers. I do remember the "kids who use Linux are hackers" arguments from schools; arguments that still occasionally pop up on rare occasio…
There is no legitimate use for it in this context, and as such, every single instance of it has been associated with a crime, mostly CSAM.
> There is no legitimate use for it in this context
Do concerns about being tracked between websites suddenly disappear at work? Is it no longer legitimate for an employee to log in to a personal account for non-work purposes via the corporate network on (for example) their lunch break? Etc, etc.
Also I'm a bit confused by your stance given the realities of encryption. Does your network strictly block all outbound traffic that it can't actively MITM? If not, a nefarious employee could proxy their criminal (Tor or other) traffic through an external machine that they controlled. In fact this would be the obvious thing to do as visiting an HTTPS (apparently) website on a personal device would seem much less likely to arouse suspicion.
Re: MoreOnionsPorfavor: Onionize your website and take back the internet
#75Earlier quoted context omitted.
Naive question, as I am not a security professional. Why?
In some businesses it is important that all employee communications are captured and can be inspected in case there is suspicion of IP or customer data theft. For example in a hospital, there is no good reason for employee to use Tor on work computer.
That's an excellent example but I'd point out that in any such scenario devices ought to be thoroughly locked down and run strictly audited environments. If properly configured you wouldn't be firing an employee for using Tor but instead for maliciously tampering with company hardware.
Re: MoreOnionsPorfavor: Onionize your website and take back the internet
#76Earlier quoted context omitted.
I'm one of those people that leave it open. I think I instinctively just avoid clicking on any pop up/over on a page. That being said, I am curious what happens if you don't click "accept" on those ones. I'm assuming you're implicitly accepting by not leaving?
You can train uBlockOrigin to block them. A bit fiddly, and for every site, but that is my habit so I do not have to click 'accept'.
Or you can just use EasyList Cookie list.
Re: MoreOnionsPorfavor: Onionize your website and take back the internet
#77I'm in charge of a security for a reasonable sized company. I generally support the Tor project and the goals of having a surveillance free internet. However - if an employee would install tor browser or use tor on a company device, or a device attached to the company network, they would be fired immediately. I would then refer them to law enforcement after conducting a forensic audit. Should you make your site only…
You can use public onion gateways for this use case. No need to install or use Tor inside the company.
Re: MoreOnionsPorfavor: Onionize your website and take back the internet
#78I'm in charge of a security for a reasonable sized company. I generally support the Tor project and the goals of having a surveillance free internet. However - if an employee would install tor browser or use tor on a company device, or a device attached to the company network, they would be fired immediately. I would then refer them to law enforcement after conducting a forensic audit. Should you make your site only…
I note that you have not disclosed your identity here on HN. Should you therefore be banned?
Re: MoreOnionsPorfavor: Onionize your website and take back the internet
#79What’s the advantage of accessing an onion service (as opposed to accessing a normal https website over tor)?
I am not an expert but as far as I understand it's harder to do correlation attacks when you're able to monitor network traffic when communication stays inside the Tor network. Additionally, you're replacing (or extending) CAs with Tor's public key cryptography for authentication and encryption. Computerphile did an interesting video series on this!
> replacing (or extending) CAs with Tor's public key cryptography
Which is good because CAs are useless; they're complete overhead. Back when EV certificates meant something, they were marginally useful, but at this point, we might as well just switch to a TXT record that validates domain ownership. (Obviously, that doesn't protect against DNS MITM attacks, but that's a separate issue.)
Re: MoreOnionsPorfavor: Onionize your website and take back the internet
#80So let's say I run a few websites and do support the idea. I read that article and think "I should setup an .onion version of my site and then point to that". The article points to https://community.torproject.org/onion-services/setup/ - and I'm immediately lost. Setup a local webserver? Why would I need that? The documentation mentions that I have to configure the webserver correctly, but offers no details about that whatsoever. So that's not a good start.
https://community.torproject.org/onion-services/advanced/oni... works better, it shows the configuration, but assumes there is already an .onion address and does not point to documentation how to set it up.
Hey, I know documentation is hard. But this could be improved a lot. By now I figured out that I'd have to install Tor on the server (not my machine, as the docs stated), find the torrc (the documentation has to mention where it is), point to the localhost port active of the webserver, the .onion address is autogenerated (so this will be an unreadable mess?) and can be taken from a file the tor software generates.
And this:
> We're not going to cover how to set up a web server here. If you get stuck or want to do more, find a friend who can help you. We recommend you install a new separate web server for your onion service.
Just cut it out. I'm actually lucky enough to have friends that could help me with this, but what if I hadn't? Cover in the documentation what needs to be done, or at the very least don't show an attitude about it.