Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MoreOnionsPorfavor: Onionize your website and take back the internet

blog.torproject.org

Post reply on HN
Print view View original

141–150 of 151 posts

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#141

Post by driverdan »

0xggus wrote: post #133
driverdan wrote: post #127

Earlier quoted context omitted.

Documentation and ease of setup have long been the biggest weaknesses of Tor. The browser is easy but setting up a server or any of the infrastructure isn't. The first time you setup a server or a relay expect it to take half a day to a full weekend.

The Tor community improved a lot the Tor Relay Guide in the last two years. Actually now you can easily setup a relay following the instructions: https://community.torproject.org/relay/setup/ And if you're an Ansible user, you will enjoy Nusenu's ansible-relayor: https://github.com/nusenu/ansible-relayor

You're right, those docs are a lot better than the last time I looked.

I forgot why exactly I didn't use ansible-relayor last time I setup relays but I had a reason. I'll try to use it next time I deploy a batch of relays.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#142

Post by yjftsjthsd-h »

glenneroo wrote: post #106
viraptor wrote: post #104

Earlier quoted context omitted.

I think you're confusing a relay and an exit node here. Pretty much everyone using Tor runs a node and for virtually everyone it's on IP also used for personal transactions. There are silly services which take every tor node as suspicious. They're wrong, but it doesn't matter if you get banned.

I also considered bringing up that point, but then I actually looked it up[0]: > Tor relays are also referred to as "routers" or "nodes." They receive traffic on the Tor network and pass it along. Check out the Tor website for a more detailed explanation of how Tor works. [0]: https://www.eff.org/torchallenge/what-is-tor.html

How does that change anything? The point is that a relay isn't an exit node, so there's no reasonable reason to block them.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#143

Post by salawat »

glenneroo wrote: post #91

I'm not sure how relevant this is to running your website on the "darknet", but a potential warning for future Tor service operators: I ran a TOR relay for about a year, eventually even ordering a static IP for 5€/month. One random day, I was unable to log into my online banking, receiving some obscure error code. After digging around and finally contacting the bank, they referred me to some "IP protection service" i…

Never use your home IP address is the conventional wisdom I've heard from relay operators and be aware there is a significant industry building up around figuring out whether or not traffic is tor'd and allowing to block based on that.

It's basically an arms race all the time; you'll need to pick as side. It's sad but there's a touch of "we don't want to do business with people who have something to hide" that has to get weeded out before you're not guaranteed to suffer any inconvenience from running a for relay.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#144

Post by glenneroo »

salawat wrote: post #143
glenneroo wrote: post #91

I'm not sure how relevant this is to running your website on the "darknet", but a potential warning for future Tor service operators: I ran a TOR relay for about a year, eventually even ordering a static IP for 5€/month. One random day, I was unable to log into my online banking, receiving some obscure error code. After digging around and finally contacting the bank, they referred me to some "IP protection service" i…

Never use your home IP address is the conventional wisdom I've heard from relay operators and be aware there is a significant industry building up around figuring out whether or not traffic is tor'd and allowing to block based on that. It's basically an arms race all the time; you'll need to pick as side. It's sad but there's a touch of "we don't want to do business with people who have something to hide" that has to…

Well that seems like all the more reason for more individuals to run a Tor (relay) node instead of consolidating into a minimum number of easily blockable VPS services. I personally am once again highly motivated after reading all the comments here basically excusing the shoddy behavior by lazy sysadmins.

If my bank blocks me again, my solution will be to use a VPN instead of giving in.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#145

Post by giantrobot »

eVeechu7 wrote: post #39
giantrobot wrote: post #28

Earlier quoted context omitted.

Look up remailers, think Tor for e-mail. No blockchain necessary. https://en.m.wikipedia.org/wiki/Cypherpunk_anonymous_remaile...

Are remailers in a healthy state at the moment? Do large email providers accept mail sent through them or just mark it as spam?

I doubt there's a ready network of cypherpunk remailers sitting around at the moment. I seem to recall (~20 years ago) a lot of remailers ended up with spam problems.

However the system by which they operate is relatively easy to implement by volunteers. The model is very similar to Tor's onion routing (they're both Chaumian mix networks). I could see middle relays run by volunteers on their Gmail accounts (or whatever) with exit nodes being established addresses specifically for the purpose of being exit nodes.

Exit nodes might require messages be signed by a publicly available key or one registered with the exit node. The sender does need a public key for all the hops. So the final recipient needs to have a key known to the sender.

While spammers could send stuff to people they know public keys for, they wouldn't necessarily be able to send random spam to people.

IIRC in the historical spam problems the sender would make an anonymous (non-crypto) remailer the final recipient so the network would forward the encrypted messages around but the last one would remail the unencrypted message to an included distribution list or listserve or something. Since anonymous remailers aren't a thing anymore that spam vector is closed.

Remailers were an interesting thing a long time ago. Because they work on extant infrastructure I think they could be a cool thing again.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#146

Post by lexicon0 »

danShumway wrote: post #68
lexicon0 wrote: post #60

Earlier quoted context omitted.

There is no legitimate use for it in this context, and as such, every single instance of it has been associated with a crime, mostly CSAM.

> There is no legitimate use for it in this context There's no legitimate usage for World of Warcraft on a work computer, and I'd happily ban that from work computers. But I also wouldn't hop onto an unrelated article for new players and imply that all of them were criminals. The linked article never mentions work computers, it's talking to website operators. If your objection here is that you think Tor is inappropri…

I'm adding my thought that hosting a website on Tor primarily, will make it totally unavailable from many workplaces. Currently, Tor is not the place for a site that doesn't _require_ an extremely high level of anonymity of access.

The network policy does ban all personal devices, in order to control what connections originate from inside the network.

To be clear, I'm not demonizing Tor or Tor users. I like what the Tor project wants to do, and I support it, but believing it will be allowed in many corporate settings, in July 2020, is extremely naive. As I already mentioned, there's no legitimate use case to allow this in a corporate setting.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#147

Post by lexicon0 »

Reelin wrote: post #74
lexicon0 wrote: post #60

Earlier quoted context omitted.

There is no legitimate use for it in this context, and as such, every single instance of it has been associated with a crime, mostly CSAM.

> There is no legitimate use for it in this context Do concerns about being tracked between websites suddenly disappear at work? Is it no longer legitimate for an employee to log in to a personal account for non-work purposes via the corporate network on (for example) their lunch break? Etc, etc. Also I'm a bit confused by your stance given the realities of encryption. Does your network strictly block all outbound tr…

> Also I'm a bit confused by your stance given the realities of encryption. Does your network strictly block all outbound traffic that it can't actively MITM? If not, a nefarious employee could proxy their criminal (Tor or other) traffic through an external machine that they controlled. In fact this would be the obvious thing to do as visiting an HTTPS (apparently) website on a personal device would seem much less likely to arouse suspicion.

Yes - with some exceptions (lunch break facebook/youtube etc)

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#148

Post by saurik »

yjftsjthsd-h wrote: post #142
glenneroo wrote: post #106

Earlier quoted context omitted.

I also considered bringing up that point, but then I actually looked it up[0]: > Tor relays are also referred to as "routers" or "nodes." They receive traffic on the Tor network and pass it along. Check out the Tor website for a more detailed explanation of how Tor works. [0]: https://www.eff.org/torchallenge/what-is-tor.html

How does that change anything? The point is that a relay isn't an exit node, so there's no reasonable reason to block them.

You don't seem to understand what the terminology is... exit relays are relays.

> There are three kinds of relays that you can run in order to help the Tor network: middle relays, exit relays, and bridges.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#149

Post by viraptor »

saurik wrote: post #148
yjftsjthsd-h wrote: post #142

Earlier quoted context omitted.

How does that change anything? The point is that a relay isn't an exit node, so there's no reasonable reason to block them.

You don't seem to understand what the terminology is... exit relays are relays. > There are three kinds of relays that you can run in order to help the Tor network: middle relays, exit relays, and bridges.

There's dictionary definition and there's typical usage. When people say relay node, they typically don't mean exit nodes. Not 100% correct, but the assumption is common.

Re: MoreOnionsPorfavor: Onionize your website and take back the internet

#150

Post by salawat »

glenneroo wrote: post #144
salawat wrote: post #143

Earlier quoted context omitted.

Never use your home IP address is the conventional wisdom I've heard from relay operators and be aware there is a significant industry building up around figuring out whether or not traffic is tor'd and allowing to block based on that. It's basically an arms race all the time; you'll need to pick as side. It's sad but there's a touch of "we don't want to do business with people who have something to hide" that has to…

Well that seems like all the more reason for more individuals to run a Tor (relay) node instead of consolidating into a minimum number of easily blockable VPS services. I personally am once again highly motivated after reading all the comments here basically excusing the shoddy behavior by lazy sysadmins. If my bank blocks me again, my solution will be to use a VPN instead of giving in.

I'm just letting you know as someone who has been on the inside and actually talked with Risk departments at financial institutions.

They do it with rooted phones, and they do it with Tor. If you're using those, you're an acceptable loss based on their metrics. Unless you can figure out a way to set up your friends and family to be Tor'd, and everyone else does too, that won't change. Also, no matter how much you point out that from the inside, you can't avoid the fact that a lot of fraud inevitably ends up using the same tools.

I'm not saying I agree with or like that state of affairs, I've just fought that fight and it really doesn't go much of anywhere. They have their reasons, and what they deem to be acceptable reasons to make the decisions they do. As long as that is the case, you just end up having to live with it, or not do business with those companies. By fighting that fight, I mean doing things like pushing against things like adoption of device fingerprinting, and picking apart under what conditions it works and doesn't. From the perspective of the business these measures make sense. From the perspective of a society at large and what even a modest understanding of what courts would do with some meta-info if they knew it existed/was collected on the other hand, that resilience to fraud is not a luxury we may reasonably be able to afford for long.

Post reply on HN