Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why offer an Onion Address rather than just encourage browsing-over-Tor?

alecmuffett.com

Post reply on HN
Print view View original

51–60 of 134 posts

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#51

Post by FeepingCreature »

krageon wrote: post #15
TuringTest wrote: post #5

Earlier quoted context omitted.

Aren't there warrant canaries set up to prevent this? Every website that can be compelled to behave that way should have one.

> Aren't there warrant canaries set up to prevent this? No, because the police will tell you to not tell anyone about the court order. If you do so (for example using a warrant canary), you will be in big trouble. Those canaries were always a convenient fiction, almost to the point of it being entirely in question whether or not this fiction was created in good faith.

You can always be in trouble by the police for any reason or no reason at all. The question is law. The notion of a warrant canary is that the police cannot compel you to state that you are not under a court order. They can annoy you to lie, and they can always break the law, but they cannot legally force you to. To claim that regardless of this, the police can compel you to lie, is tantamount to saying that the rule of law has failed.

( https://www.eff.org/deeplinks/2014/04/warrant-canary-faq )

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#52

Post by steerablesafe »

ycuser2 wrote: post #49
bauruine wrote: post #11

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServic…

I'm using Tor to access my local network services through hidden services. Since I don't need to hide my IP address I'm going to follow your advice gratefully. Didn't know that's possible.

Any reason you don't use some kind of VPN solution for that instead?

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#53

Post by Stevvo »

nextaccountic wrote: post #2

> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes we…

There were slides in the Snowden leaks where it laid out the NSA's strategy for dealing with TOR and compromising exit nodes was a big part of it. They have had the last 10 years to work on it; one might expect they had results.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#54

Post by ycuser2 »

steerablesafe wrote: post #52
ycuser2 wrote: post #49

Earlier quoted context omitted.

I'm using Tor to access my local network services through hidden services. Since I don't need to hide my IP address I'm going to follow your advice gratefully. Didn't know that's possible.

Any reason you don't use some kind of VPN solution for that instead?

Hidden services are very easy to configure (the basic config, if you want to be as anonym as possible you have to do more). Install tor, add a few lines to config, done. And: You don't have to change your firewall settings at all. Nothing is exposed to the clearnet.

You can also make your service be accessible only to certain clients which have a certificate. I consider this very secure.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#56

Post by danuker »

bauruine wrote: post #11

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServic…

You are not just reducing load, you are also reducing anonymity for other participants. The extra hops make it harder to analyze the data overall.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#57

Post by idontwantthis »

foxfluff wrote: post #48
idontwantthis wrote: post #41

Earlier quoted context omitted.

What does compromising the exit do? I thought the layering means you would need to compromise the entire path to do anything.

Exit node is where the tor-encrypted path ends and traffic goes to the clearnet.

What’s the point of any of it then to a paranoid user?

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#58

Post by steerablesafe »

ycuser2 wrote: post #54
steerablesafe wrote: post #52

Earlier quoted context omitted.

Any reason you don't use some kind of VPN solution for that instead?

Hidden services are very easy to configure (the basic config, if you want to be as anonym as possible you have to do more). Install tor, add a few lines to config, done. And: You don't have to change your firewall settings at all. Nothing is exposed to the clearnet. You can also make your service be accessible only to certain clients which have a certificate. I consider this very secure.

I guess I can understand that from an ease of configuration standpoint. Having said that I had no trouble with setting up zerotier VPN, which is also very easy to configure.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#59

Post by egberts1 »

bawolff wrote: post #22
egberts1 wrote: post #13

Earlier quoted context omitted.

But, but … BUT TLS man-in-the-middle at exit node isn’t fully mitigated … UNLESS TLS Client mode is used as well. We all should know how infrequent this TLS Client mode get evoked, right, right? Yeah, righto.

Wat? That's not true (i assume by client mode you mean client certificates aka mutual-tls)

ThAt … mutual part, yes, of Client-side TLS.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#60

Post by kevincox »

rosndo wrote: post #19
shp0ngle wrote: post #14

> The first benefits are authenticity and availability: if you are running Tor Browser and if you click/type in exactly the proper Onion address, you are guaranteed to be connected to what you expect — or not at all. What? Writing raw onion addresses is like writing raw IPv6 addresses. Nobody can remember then and check them. What is easier > https://nytimes.com or > ej3kv4ebuugcmuwxctx5ic7zxh73rnxt42soi3tdneu2c2em55…

> you are guaranteed to be connected to what you expect — or not at all. Exactly the same guarantees are also achieved by putting your clearnet address on HSTS Preload lists, or by writing https:// in front of the url on the users side.

But then you are relying on the CA system which is a huge risk. A significant benifit of onion addresses is that The key is distributed with the address. So as long as you get the address over a secure channel you are safe.

With https you need to get the address over a secure channel and hope that no CAs are compromised. The secure channel might be easier (because you can quickly memozrize twitter.com) but to avoid the second you need some complicated and not officially supported certificate pinning.

Post reply on HN