Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why offer an Onion Address rather than just encourage browsing-over-Tor?

alecmuffett.com

Post reply on HN
Print view View original

41–50 of 134 posts

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#41

Post by idontwantthis »

nextaccountic wrote: post #2

> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes we…

What does compromising the exit do? I thought the layering means you would need to compromise the entire path to do anything.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#42

Post by stingraycharles »

bauruine wrote: post #11

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServic…

For my understanding, usually establishing a connection with a hidden service involves two separate Tor circuits: one circuit for the visitor, but another full circuit for the hidden service.

This “Non Anonymous Mode” effectively omits the second circuit, and allows relays to connect directly to the hidden service’s IP address, thus significantly improving latency and reducing the strain on the Tor network?

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#43

Post by krageon »

Joakal wrote: post #40
krageon wrote: post #15

Earlier quoted context omitted.

> Aren't there warrant canaries set up to prevent this? No, because the police will tell you to not tell anyone about the court order. If you do so (for example using a warrant canary), you will be in big trouble. Those canaries were always a convenient fiction, almost to the point of it being entirely in question whether or not this fiction was created in good faith.

Can those warrant canaries holders who follow police/court orders, be sued for false advertising? Seems like a catch 22 that it's a lose-lose.

If being sued for false advertising was a real risk, advertising would be a lot more truthful :)

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#44

Post by nsotelo »

shp0ngle wrote: post #14

> The first benefits are authenticity and availability: if you are running Tor Browser and if you click/type in exactly the proper Onion address, you are guaranteed to be connected to what you expect — or not at all. What? Writing raw onion addresses is like writing raw IPv6 addresses. Nobody can remember then and check them. What is easier > https://nytimes.com or > ej3kv4ebuugcmuwxctx5ic7zxh73rnxt42soi3tdneu2c2em55…

You can use the onion location header[0] to redirect the user, as mentioned in another comment thread.

0: https://community.torproject.org/onion-services/advanced/oni...

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#45

Post by brnt »

bauruine wrote: post #11

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServic…

If I use Onionshare, where do I set this?

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#46

Post by bauruine »

stingraycharles wrote: post #42
bauruine wrote: post #11

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServic…

For my understanding, usually establishing a connection with a hidden service involves two separate Tor circuits: one circuit for the visitor, but another full circuit for the hidden service. This “Non Anonymous Mode” effectively omits the second circuit, and allows relays to connect directly to the hidden service’s IP address, thus significantly improving latency and reducing the strain on the Tor network?

Yes that's correct.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#47

Post by zekica »

stingraycharles wrote: post #42
bauruine wrote: post #11

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServic…

For my understanding, usually establishing a connection with a hidden service involves two separate Tor circuits: one circuit for the visitor, but another full circuit for the hidden service. This “Non Anonymous Mode” effectively omits the second circuit, and allows relays to connect directly to the hidden service’s IP address, thus significantly improving latency and reducing the strain on the Tor network?

That is correct, but note that not all tor nodes are exit nodes, so latency will be increased but troughput may even be better.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#48

Post by foxfluff »

idontwantthis wrote: post #41
nextaccountic wrote: post #2

> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes we…

What does compromising the exit do? I thought the layering means you would need to compromise the entire path to do anything.

Exit node is where the tor-encrypted path ends and traffic goes to the clearnet.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#49

Post by ycuser2 »

bauruine wrote: post #11

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServic…

I'm using Tor to access my local network services through hidden services. Since I don't need to hide my IP address I'm going to follow your advice gratefully. Didn't know that's possible.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#50

Post by MichaelBurge »

heavyset_go wrote: post #4
nextaccountic wrote: post #2

> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes we…

Even if every exit node in the US is operated by private people or organizations, courts can compel the node owners to work with the government and not talk about it.

Courts can't compel you not to talk. They can merely punish you after-the-fact.

So if you're talking about "everyone in a giant group of people" and doing it routinely, existence of those secret subpoenas seem like they'd get leaked eventually. Especially if it's hard to tell which of the 300 people leaked it.

Post reply on HN