Why offer an Onion Address rather than just encourage browsing-over-Tor?

Post by [deleted] » Thu, Mar 10, 2022, 12:40 PM UTC

thealig wrote: post #12

stingraycharles wrote: post #7

Earlier quoted context omitted.

It’s not even about three letter agencies; many exit nodes are being scanned for passwords, if you happen to go through http instead of https. Here’s research conducted years ago about this matter: https://www.vice.com/en/article/mgbdwv/badonion-honeypot-mal... Effectively they set up a honeypot and used clear text passwords to log in, and plenty of exit nodes picked up on this and those credentials were later used t…

the article talks about the research stumbling upon exit nodes performing MITM and other sniffing but does not refer to the exact details. is there a paper for this? only found this paper going over systematic process of exposing bad relays - http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf

Post by _wldu » Thu, Mar 10, 2022, 1:08 PM UTC

ycuser2 wrote: post #49

bauruine wrote: post #11

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServic…

I'm using Tor to access my local network services through hidden services. Since I don't need to hide my IP address I'm going to follow your advice gratefully. Didn't know that's possible.

Post by stingraycharles » Thu, Mar 10, 2022, 1:12 PM UTC

zekica wrote: post #47

stingraycharles wrote: post #42

Earlier quoted context omitted.

For my understanding, usually establishing a connection with a hidden service involves two separate Tor circuits: one circuit for the visitor, but another full circuit for the hidden service. This “Non Anonymous Mode” effectively omits the second circuit, and allows relays to connect directly to the hidden service’s IP address, thus significantly improving latency and reducing the strain on the Tor network?

That is correct, but note that not all tor nodes are exit nodes, so latency will be increased but troughput may even be better.

Post by michaelt » Thu, Mar 10, 2022, 1:15 PM UTC

bauruine wrote: post #18

RL_Quine wrote: post #3

Earlier quoted context omitted.

The behaviour of not always using the same exit means that you, over time, will almost assuredly use a malicious exit should more than zero exist. It's reckless to suggest that anybody should be using this system, your situation is almost always going to be worse than not.

The only attacks an exit alone can do is sniff all traffic and modify the traffic. There are constant checks done by the Torproject to detect bad exits that modify traffic but sniffing is not detectable of course. But both of those attacks are mitigated by https which most sites support nowadays. Firefox and therefore the Tor Browser also has an option to disable http. [0] And using an .onion service removes this att…

Post by vageli » Thu, Mar 10, 2022, 1:36 PM UTC

michaelt wrote: post #67

bauruine wrote: post #18

Earlier quoted context omitted.

The only attacks an exit alone can do is sniff all traffic and modify the traffic. There are constant checks done by the Torproject to detect bad exits that modify traffic but sniffing is not detectable of course. But both of those attacks are mitigated by https which most sites support nowadays. Firefox and therefore the Tor Browser also has an option to disable http. [0] And using an .onion service removes this att…

> But both of those attacks are mitigated by https which most sites support nowadays. Unfortunately, not as much as you might hope. For good reasons, the Tor browser doesn't store your browsing history - so there's no 'recently visited sites', no address bar autocomplete, no cached redirects, no cached HSTS, and no colour-changed 'visited' links. So if you're visiting a site that isn't HSTS-preloaded - for example bi…