Why offer an Onion Address rather than just encourage browsing-over-Tor?
1–10 of 134 posts
Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?
#2> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent
Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it?
I mean, suppose all of the existing nodes weren't malicious. Could a government agency plausibly run 1000 exit nodes in a way that doesn't give away they are government-run? This would make the majority of exit nodes malicious.
Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?
#3> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes we…
The behaviour of not always using the same exit means that you, over time, will almost assuredly use a malicious exit should more than zero exist. It's reckless to suggest that anybody should be using this system, your situation is almost always going to be worse than not.
Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?
#4> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes we…
Even if every exit node in the US is operated by private people or organizations, courts can compel the node owners to work with the government and not talk about it.
Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?
#5> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes we…
Even if every exit node in the US is operated by private people or organizations, courts can compel the node owners to work with the government and not talk about it.
Aren't there warrant canaries set up to prevent this? Every website that can be compelled to behave that way should have one.
Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?
#6Most of the technical points listed here are pretty much entirely mitigated by TLS. Exit nodes can of course deny access to specific sites, but hidden services suffer from comparable (or worse) issues.
There are no other practical attacks that malicious exit nodes could execute against sites using TLS and HSTS preload lists. If you’re a website administrator, fixing those things should be your priority before implementing onion addresses.
Onion addresses also come with slight drawbacks. They’re difficult for users and more vulnerable to phishing. Hidden services are also extremely vulnerable to CPU-based DoS attacks.
Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?
#7> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes we…
It’s not even about three letter agencies; many exit nodes are being scanned for passwords, if you happen to go through http instead of https.
Here’s research conducted years ago about this matter: https://www.vice.com/en/article/mgbdwv/badonion-honeypot-mal...
Effectively they set up a honeypot and used clear text passwords to log in, and plenty of exit nodes picked up on this and those credentials were later used to (attempt to) log in into the honeypot.
Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?
#8This article beats around the bush but never explains why Onion addresses solve these issues.
From Wikipedia:
> Addresses in the onion TLD are […] automatically generated based on a public key when an onion service is configured.
> 256-bit ed25519 public key along with a version number and a checksum of the key and version number
That's all you need to know.
Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?
#9Earlier quoted context omitted.
Even if every exit node in the US is operated by private people or organizations, courts can compel the node owners to work with the government and not talk about it.
Aren't there warrant canaries set up to prevent this? Every website that can be compelled to behave that way should have one.
How could a warrant canary work when you don't know which exit node you will connect to?
Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?
#10> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes we…
Even if every exit node in the US is operated by private people or organizations, courts can compel the node owners to work with the government and not talk about it.
I know this is possible for organizations in the US, but for private persons too?