MoreOnionsPorfavor: Onionize your website and take back the internet • Hacker News Board

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#121

Post by sva_ » Thu, Jul 09, 2020, 1:55 PM UTC

maxmouchet wrote: post #111

glenneroo wrote: post #91

I'm not sure how relevant this is to running your website on the "darknet", but a potential warning for future Tor service operators: I ran a TOR relay for about a year, eventually even ordering a static IP for 5€/month. One random day, I was unable to log into my online banking, receiving some obscure error code. After digging around and finally contacting the bank, they referred me to some "IP protection service" i…

I had a similar experience with my Xiaomi (robotic) vacuum cleaner. A few days after setting-up a tor relay (not an exit node!) on my home connection, my vacuum stopped working. The "Mi Home" app, which communicates with the vacuum via a server in China, was unable to find the vacuum. A traceroute to the Xiaomi servers revealed that my packets were dropped somewhere in the ChinaNet AS. I stopped my relay and everythi…

Is it really necessary for your vacuum to work, that it 1) connects to a server 2) on a different continent? Why would anyone willingly put something like this in their house?

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#122

Post by maxmouchet » Thu, Jul 09, 2020, 2:07 PM UTC

sva_ wrote: post #121

maxmouchet wrote: post #111

Earlier quoted context omitted.

I had a similar experience with my Xiaomi (robotic) vacuum cleaner. A few days after setting-up a tor relay (not an exit node!) on my home connection, my vacuum stopped working. The "Mi Home" app, which communicates with the vacuum via a server in China, was unable to find the vacuum. A traceroute to the Xiaomi servers revealed that my packets were dropped somewhere in the ChinaNet AS. I stopped my relay and everythi…

Is it really necessary for your vacuum to work, that it 1) connects to a server 2) on a different continent? Why would anyone willingly put something like this in their house?

It is the v1 of their vacuum which was not sold officially in Europe/America. The newer versions can work with servers located in Europe.

If you don't want to use the Xiaomi app there is an API to control the vacuum on the LAN. See also "34C3 - Unleash your smart-home devices: Vacuum Cleaning Robot Hacking" [1]

Privacy and security concerns aside, I find that pretty magical that you can control a device from the other side of the planet, with only a few hundred milliseconds of latency :-)

[1] https://www.youtube.com/watch?v=uhyM-bhzFsI.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#123

Post by buildbuildbuild » Thu, Jul 09, 2020, 2:08 PM UTC

isaack wrote: post #38

CloudFlare had a much more elegant solution: the Alt-Svc HTTP header [1]. It is entirely transparent to the user. Security is guaranteed because it uses the original SSL/TLS certificate for exchange (that is, on top of the usual safety guarantees provided by a Tor hidden service). Sadly they stopped doing that a while ago [2]. If anyone has insider knowledge about the reason behind, I would be really interested to he…

It’s so transparent that Tor Browser users cannot actually tell if Cloudflare’s Alt-Svc “Onion Routing” is actually working. Try to determine how your traffic was routed while browsing a site with Alt-Svc enabled.

A user should plainly know if _any_ traffic exited the Tor network and that is not always the case. (See mixed content on most HS mirrors of major sites like NYTimes)

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#124

Post by SuoDuanDao » Thu, Jul 09, 2020, 2:08 PM UTC

gowld wrote: post #116

SuoDuanDao wrote: post #113

Earlier quoted context omitted.

Keeping out the riff-raff is a time-honoured marketing strategy on the internet. Gmail/Facebook invites, You do not talk about /B etc.

The design of .onion is that it only works if the riffraff are in.

Same with Facebook, but exclusivity was still a major selling point in the startup days.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#125

Post by glenneroo » Thu, Jul 09, 2020, 2:15 PM UTC

bzb3 wrote: post #120

glenneroo wrote: post #105

Earlier quoted context omitted.

Excuse my ignorance, but why should I not be allowed to run a Tor relay (not an exit node!) at home when I have sufficient bandwidth and purchased a static IP through my IP which they advertise even "to allow running of private servers"? I thought one of the points of the article was the propagation and subsequent democratization of Tor/Onion sites? If I have to rent a VPS to run a node, isn't half the point defeated…

You're allowed, but you will be blacklisted by many services... I also agree that it shouldn't be a problem if you're not an exit node, but that's the way it works.

Many? What other services do you know of that will be blocked? You speak as if you have a lot of knowledge/experience in this area.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#126

Post by user_agent » Thu, Jul 09, 2020, 2:15 PM UTC

lexicon0 wrote: post #40

I'm in charge of a security for a reasonable sized company. I generally support the Tor project and the goals of having a surveillance free internet. However - if an employee would install tor browser or use tor on a company device, or a device attached to the company network, they would be fired immediately. I would then refer them to law enforcement after conducting a forensic audit. Should you make your site only…

I've been working for a couple multinational corporations during last 10 years or so and I never had ANY issues with using Tor in the workplace.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#127

Post by driverdan » Thu, Jul 09, 2020, 2:26 PM UTC

onli wrote: post #80

So let's say I run a few websites and do support the idea. I read that article and think "I should setup an .onion version of my site and then point to that". The article points to https://community.torproject.org/onion-services/setup/ - and I'm immediately lost. Setup a local webserver? Why would I need that? The documentation mentions that I have to configure the webserver correctly, but offers no details about tha…

Documentation and ease of setup have long been the biggest weaknesses of Tor. The browser is easy but setting up a server or any of the infrastructure isn't.

The first time you setup a server or a relay expect it to take half a day to a full weekend.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#128

Post by SketchySeaBeast » Thu, Jul 09, 2020, 2:28 PM UTC

gowld wrote: post #119

jakereps wrote: post #30

Earlier quoted context omitted.

A normal person won’t be able to access an onion site, let alone care about the pop up they’re getting about its availability. I’ve watched people navigate web pages with the half screen cookie banner still open. Tor is not targeting a “normal” person, as the media has already told the “normal” people that the only things available on the “dark”/“deep” web are illegal.

Tor doesn't work unless normal people usage it. Users need the camouflage normal users provide.

> Users need the camouflage normal users provide.

That's an interesting statement - what are the "users" doing there that "normal users" are not?

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#129

Post by driverdan » Thu, Jul 09, 2020, 2:29 PM UTC

glenneroo wrote: post #91

I'm not sure how relevant this is to running your website on the "darknet", but a potential warning for future Tor service operators: I ran a TOR relay for about a year, eventually even ordering a static IP for 5€/month. One random day, I was unable to log into my online banking, receiving some obscure error code. After digging around and finally contacting the bank, they referred me to some "IP protection service" i…

I ran Tor relays from home for a while. The only site I couldn't access was the Apple support forms which are mostly useless anyway.

If my bank blindly blocked IPs like that I'd switch banks.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#130

Post by vorpalhex » Thu, Jul 09, 2020, 2:35 PM UTC

easterncalculus wrote: post #107

caymanjim wrote: post #97

Earlier quoted context omitted.

They're not a tech support company or a hosting company. There are literally thousands and thousands of documents on basic web server installation and configuration already written. The information is trivial to find. It falls under "if you have to ask, you're not ready".

Have you actually run a hidden service before? Running a default or standard configuration of the bigger web servers like Apache or NGINX is a terrible idea if you're actually trying to hide the identity of your server. Setting up a secure hidden service usually requires that several default or common features be disabled, if one actually wants to hide the location of the service.

...can you link some details on how we should actually configure this? Because the answer to your question is "No" but I'm sure a good many of the people here would like to be able to say yes.