Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why offer an Onion Address rather than just encourage browsing-over-Tor?

alecmuffett.com

Post reply on HN
Print view View original

91–100 of 134 posts

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#91

Post by conradev »

ycuser2 wrote: post #54
steerablesafe wrote: post #52

Earlier quoted context omitted.

Any reason you don't use some kind of VPN solution for that instead?

Hidden services are very easy to configure (the basic config, if you want to be as anonym as possible you have to do more). Install tor, add a few lines to config, done. And: You don't have to change your firewall settings at all. Nothing is exposed to the clearnet. You can also make your service be accessible only to certain clients which have a certificate. I consider this very secure.

Only recently has there been an easy to setup and secure alternative with the same properties – Tailscale

It is centralized, yes, but it is way, way faster if you care about latency

https://tailscale.com/

(you can also self-host it with the open source “headscale” project)

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#92

Post by conradev »

stingraycharles wrote: post #7
nextaccountic wrote: post #2

> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes we…

It’s not even about three letter agencies; many exit nodes are being scanned for passwords, if you happen to go through http instead of https. Here’s research conducted years ago about this matter: https://www.vice.com/en/article/mgbdwv/badonion-honeypot-mal... Effectively they set up a honeypot and used clear text passwords to log in, and plenty of exit nodes picked up on this and those credentials were later used t…

I will also point out that even if they are only observing ciphertext, they can still glean a lot:

http://web.cs.wpi.edu/~claypool/papers/yt-crawler/final.pdf

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#93

Post by _wldu »

c0wb0yc0d3r wrote: post #68
_wldu wrote: post #63

Earlier quoted context omitted.

That's sort of like having backdoor access to your internal network (similar to teredo). Others may use it to gain access to that network. If it's your home, that may be OK to you, but if it is an employer, you may want to obtain approval to do that and be sure all of your hidden services use keys or strong passwords for access.

Could you explain this a bit more? How would this be more open than port forwarding? I don't see how someone could leverage this without exploiting whatever app is hosted as the hidden service?

It's a tunnel into your internal network.

If nation states and/or cyber criminals do control most of tor, then you are opening your internal network to those groups.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#94

Post by tialaramex »

michaelt wrote: post #76
vageli wrote: post #69

Earlier quoted context omitted.

> So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// explicitly, as that's your sole protection against getting MITMed. >Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security. https://www.torproject.org/download/

HTTPS Everywhere doesn't have a working rule for bitcoinknots.org And more broadly, neither HSTS preloading or HTTPS Everywhere include a list of every single site on the internet.

Mentioned below that HTTPS-default (which is an option in ordinary Firefox) is intended to become mandatory in Tor-browser.

I use this on my main PC. Once or twice a day I might visit some old or especially cantankerous site that doesn't do HTTPS, I get a full page interstitial explaining the problem, I can decide if I'm OK with that. Otherwise every single link, typed URL, etc. is HTTPS regardless of whether that was what was originally written.

I wouldn't recommend it in its current state for my mother, but it's definitely what someone using Tor would want, and it's only getting more ubiquitous.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#95

Post by bauruine »

danuker wrote: post #56
bauruine wrote: post #11

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServic…

You are not just reducing load, you are also reducing anonymity for other participants. The extra hops make it harder to analyze the data overall.

Could you please post a source for this? The only thing i could find is from the man page "However, the fact that a client is accessing a Single Onion rather than a Hidden Service may be statistically distinguishable." but I'm not sure what exactly the impact is from that.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#96

Post by chatmasta »

ycuser2 wrote: post #81
jstanley wrote: post #71

Earlier quoted context omitted.

Yes, it's exactly like port forwarding.

Are you sure? Don't an attacker need knowledge of the onion address, which is almost unguessable? But with client authentification that wouldn't be a problem anyways because only chosen clients get access.

Onion address is not unguessable, it's stored on a DHT shared by relays with the HSDir flag (which they earn after ~7 days IIRC).

I think this changed slightly with v3 addresses, so my comment might be out of date, but I think the general premise remains the same. (EDIT: Apparently with V3 addresses, there is still a DHT, but client uses key derivation so that the HSDir only stores a daily-rotated identifier known as a "blinded public key." [0])

Although your hidden service address is not hidden, you can require that any client connecting to it present a valid authorization key (I think this is also new in V3?).

Also, it obviously depends which service you're exposing — if you are exposing an SSH server that only allows key-based authentication, then it shouldn't matter if people can simply connect to it — assuming you trust the SSHD software, and your threat model doesn't depend on avoiding detection completely.

[0] https://blog.torproject.org/v3-onion-services-usage/

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#97

Post by throwaway2048 »

_wldu wrote: post #93
c0wb0yc0d3r wrote: post #68

Earlier quoted context omitted.

Could you explain this a bit more? How would this be more open than port forwarding? I don't see how someone could leverage this without exploiting whatever app is hosted as the hidden service?

It's a tunnel into your internal network. If nation states and/or cyber criminals do control most of tor, then you are opening your internal network to those groups.

So is port forwarding or running any other services, tor is special in absolutely no meaningful respect here.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#98

Post by rattlesnakedave »

conradev wrote: post #91
ycuser2 wrote: post #54

Earlier quoted context omitted.

Hidden services are very easy to configure (the basic config, if you want to be as anonym as possible you have to do more). Install tor, add a few lines to config, done. And: You don't have to change your firewall settings at all. Nothing is exposed to the clearnet. You can also make your service be accessible only to certain clients which have a certificate. I consider this very secure.

Only recently has there been an easy to setup and secure alternative with the same properties – Tailscale It is centralized, yes, but it is way, way faster if you care about latency https://tailscale.com/ (you can also self-host it with the open source “headscale” project)

+1 for tailscale, it is an absolute joy to use.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#99

Post by aendruk »

vageli wrote: post #69
michaelt wrote: post #67

Earlier quoted context omitted.

> But both of those attacks are mitigated by https which most sites support nowadays. Unfortunately, not as much as you might hope. For good reasons, the Tor browser doesn't store your browsing history - so there's no 'recently visited sites', no address bar autocomplete, no cached redirects, no cached HSTS, and no colour-changed 'visited' links. So if you're visiting a site that isn't HSTS-preloaded - for example bi…

> So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// explicitly, as that's your sole protection against getting MITMed. >Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security. https://www.torproject.org/download/

I’m surprised to hear it’s not just using the native HTTPS-only mode now.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#100

Post by sp332 »

nsotelo wrote: post #44
shp0ngle wrote: post #14

> The first benefits are authenticity and availability: if you are running Tor Browser and if you click/type in exactly the proper Onion address, you are guaranteed to be connected to what you expect — or not at all. What? Writing raw onion addresses is like writing raw IPv6 addresses. Nobody can remember then and check them. What is easier > https://nytimes.com or > ej3kv4ebuugcmuwxctx5ic7zxh73rnxt42soi3tdneu2c2em55…

You can use the onion location header[0] to redirect the user, as mentioned in another comment thread. 0: https://community.torproject.org/onion-services/advanced/oni...

That has all the problems listed. The header could be modified or the response blocked by anyone who could modify or block the plain HTTP(S) response.
Post reply on HN