Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why offer an Onion Address rather than just encourage browsing-over-Tor?

alecmuffett.com

Post reply on HN
Print view View original

71–80 of 134 posts

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#71

Post by jstanley »

c0wb0yc0d3r wrote: post #68
_wldu wrote: post #63

Earlier quoted context omitted.

That's sort of like having backdoor access to your internal network (similar to teredo). Others may use it to gain access to that network. If it's your home, that may be OK to you, but if it is an employer, you may want to obtain approval to do that and be sure all of your hidden services use keys or strong passwords for access.

Could you explain this a bit more? How would this be more open than port forwarding? I don't see how someone could leverage this without exploiting whatever app is hosted as the hidden service?

Yes, it's exactly like port forwarding.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#72

Post by p4bl0 »

It is possible to advertise your .onion address and offer automatic redirect to it for Tor Browser users using the "Onion-Location" HTTP header. Example with my personal home page:

    $ curl -I https://pablo.rauzy.name/
    HTTP/1.1 200 OK
    Server: nginx/1.14.2
    Date: Thu, 10 Mar 2022 14:04:44 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 2843
    Last-Modified: Sun, 23 Jan 2022 22:21:41 GMT
    Connection: keep-alive
    Onion-Location: http://c2fk5i7jqn7am7nfo7eb7hwrkclyj3jj4qcwgdh6ievp7v5ie4gd3mid.onion/
It would be interesting to try to see if the Tor Browser has a TOFU policy and warn its user if the onion address change after they visited the site once.

If it is the case then you combine the ease of access of typing a normal domain name and the Onion security through an HSTS equivalent mechanism.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#73

Post by rosndo »

kevincox wrote: post #60
rosndo wrote: post #19

Earlier quoted context omitted.

> you are guaranteed to be connected to what you expect — or not at all. Exactly the same guarantees are also achieved by putting your clearnet address on HSTS Preload lists, or by writing https:// in front of the url on the users side.

But then you are relying on the CA system which is a huge risk. A significant benifit of onion addresses is that The key is distributed with the address. So as long as you get the address over a secure channel you are safe. With https you need to get the address over a secure channel and hope that no CAs are compromised. The secure channel might be easier (because you can quickly memozrize twitter.com) but to avoid t…

Thanks to certificate transparency the CA system is really not a huge risk.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#75

Post by ryeights »

vageli wrote: post #69
michaelt wrote: post #67

Earlier quoted context omitted.

> But both of those attacks are mitigated by https which most sites support nowadays. Unfortunately, not as much as you might hope. For good reasons, the Tor browser doesn't store your browsing history - so there's no 'recently visited sites', no address bar autocomplete, no cached redirects, no cached HSTS, and no colour-changed 'visited' links. So if you're visiting a site that isn't HSTS-preloaded - for example bi…

> So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// explicitly, as that's your sole protection against getting MITMed. >Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security. https://www.torproject.org/download/

Caveat: HTTPS Everywhere relies on a manual whitelist of HTTPS-enabled sites. If the website you’re visiting isn’t popular enough to be on their list, you’re out of luck.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#76

Post by michaelt »

vageli wrote: post #69
michaelt wrote: post #67

Earlier quoted context omitted.

> But both of those attacks are mitigated by https which most sites support nowadays. Unfortunately, not as much as you might hope. For good reasons, the Tor browser doesn't store your browsing history - so there's no 'recently visited sites', no address bar autocomplete, no cached redirects, no cached HSTS, and no colour-changed 'visited' links. So if you're visiting a site that isn't HSTS-preloaded - for example bi…

> So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// explicitly, as that's your sole protection against getting MITMed. >Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security. https://www.torproject.org/download/

HTTPS Everywhere doesn't have a working rule for bitcoinknots.org

And more broadly, neither HSTS preloading or HTTPS Everywhere include a list of every single site on the internet.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#77

Post by FeepingCreature »

vageli wrote: post #70
FeepingCreature wrote: post #51

Earlier quoted context omitted.

You can always be in trouble by the police for any reason or no reason at all. The question is law. The notion of a warrant canary is that the police cannot compel you to state that you are not under a court order. They can annoy you to lie, and they can always break the law, but they cannot legally force you to. To claim that regardless of this, the police can compel you to lie, is tantamount to saying that the rule…

Has this ever been tested in court?

Not to my knowledge.

Which can mean "no company has tried" or "no TLA has tried".

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#78

Post by heavyset_go »

ycuser2 wrote: post #54
steerablesafe wrote: post #52

Earlier quoted context omitted.

Any reason you don't use some kind of VPN solution for that instead?

Hidden services are very easy to configure (the basic config, if you want to be as anonym as possible you have to do more). Install tor, add a few lines to config, done. And: You don't have to change your firewall settings at all. Nothing is exposed to the clearnet. You can also make your service be accessible only to certain clients which have a certificate. I consider this very secure.

> You can also make your service be accessible only to certain clients which have a certificate. I consider this very secure.

Are you talking about this? https://community.torproject.org/onion-services/advanced/cli...

Post reply on HN