Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why offer an Onion Address rather than just encourage browsing-over-Tor?

alecmuffett.com

Post reply on HN
Print view View original

111–120 of 134 posts

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#111

Post by Karrot_Kream »

steerablesafe wrote: post #58
ycuser2 wrote: post #54

Earlier quoted context omitted.

Hidden services are very easy to configure (the basic config, if you want to be as anonym as possible you have to do more). Install tor, add a few lines to config, done. And: You don't have to change your firewall settings at all. Nothing is exposed to the clearnet. You can also make your service be accessible only to certain clients which have a certificate. I consider this very secure.

I guess I can understand that from an ease of configuration standpoint. Having said that I had no trouble with setting up zerotier VPN, which is also very easy to configure.

I do the same but you still need to be careful when running Zerotier to listen only on IP addresses that the ZT link is assigned. I run a private mailserver and I've made sure that there are no sockets listening on any non-ZT externally routable IP address. (I guess for good measure I could have nftables drop traffic coming in on those ports on my WAN link.) But with Tor you just point it to a service listening on 127.0.0.1 or [::1] and you're in business. For me ZT is fine, but for folks who want to muck around a bit less, I can see the appeal of Tor.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#112

Post by Terry_Roll »

bauruine wrote: post #11

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServic…

Tor is not anonymous just like VPN's are not anonymous when you have 5eyes oversight of the network. Its like watching trucks navigating around the road network, you can see the junctions they take and you can see where they start and end, but you cant see the contents of the truck.

The Road network and internet have an awful lot in common!

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#113

Post by kingcharles »

p4bl0 wrote: post #72

It is possible to advertise your .onion address and offer automatic redirect to it for Tor Browser users using the "Onion-Location" HTTP header. Example with my personal home page: $ curl -I https://pablo.rauzy.name/ HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Thu, 10 Mar 2022 14:04:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2843 Last-Modified: Sun, 23 Jan 2022 22:21:41 GMT Connection: keep-alive On…

Is there some sort of attack possible here where you could hand out unique onion addresses to each visitor, so when they connect with Tor you could fingerprint their Tor connection and match it to their cleartext connection? *takes off his black hat*

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#115

Post by nonamenoslogan »

I_Byte wrote: post #106
_wldu wrote: post #63

Earlier quoted context omitted.

That's sort of like having backdoor access to your internal network (similar to teredo). Others may use it to gain access to that network. If it's your home, that may be OK to you, but if it is an employer, you may want to obtain approval to do that and be sure all of your hidden services use keys or strong passwords for access.

This is completely incorrect. It is physically impossible to make a connection to a hidden service without the hidden services onion address (I am talking about the current v3 onion addresses, the ones that are 56 characters long). This is thanks to the fact that the onion address itself is the hidden services public key. If you keep your onion address private then nobody can connect to your hidden service or even kn…

Security through obfuscation isn't bad, but its certainly not infallible.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#116

Post by heavyset_go »

ycuser2 wrote: post #82
heavyset_go wrote: post #78

Earlier quoted context omitted.

> You can also make your service be accessible only to certain clients which have a certificate. I consider this very secure. Are you talking about this? https://community.torproject.org/onion-services/advanced/cli...

Yes, client authentification it is called.

Thanks for mentioning it, I would have overlooked that feature entirely, otherwise.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#117

Post by tempestn »

mst wrote: post #84
nonrandomstring wrote: post #39

Earlier quoted context omitted.

> I'm not clear from the article how having an onion address helps website operators who receive abusive traffic through Tor. No, it's not clear. Also "abusive traffic" is vague. Are you mainly concerned with shitposters, trolls, DOS attacks? > What am I missing? Maybe you're not missing it, but essentially it's a behavioural/social rather than technical challenge. Most abusers, ones that technical changes can addres…

Back when I was staff on (pre-madness) freenode providing an onion address was pretty much the only way we could afford to support tor at all given the moderation resources available. Smaller networks often (usually regretfully) end up blocking tor entirely if they don't have the capacity to set up such infrastructure.

So you'd offer an onion address, but then block Tor traffic that didn't use it?

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#118

Post by heavyset_go »

I_Byte wrote: post #107
jstanley wrote: post #71

Earlier quoted context omitted.

Yes, it's exactly like port forwarding.

This is incorrect. A Tor hidden service is fundamentally different from port forwarding. If you don't have the hidden services onion address (v3 address) then you physically cannot make a connection to the hidden service. This is because the onion address is the hidden services public key. You can scan the entire internet for open ports, you can't scan the Tor network for hidden services to connect to unless you alre…

When you create an onion address, does that address get leaked at any point? As in, are there nodes or servers in the Tor network that know that xxxx.onion is a valid address at the time of creation or afterwards?

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#119

Post by [deleted] »

stingraycharles wrote: post #65
zekica wrote: post #47

Earlier quoted context omitted.

That is correct, but note that not all tor nodes are exit nodes, so latency will be increased but troughput may even be better.

Ah right, so what you’re saying is that hidden services don’t need Exit relays for hidden services at all, and as such do not have the bottleneck issues that usually plague exit nodes.

[deleted]

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#120

Post by sweetbitter »

_wldu wrote: post #93
c0wb0yc0d3r wrote: post #68

Earlier quoted context omitted.

Could you explain this a bit more? How would this be more open than port forwarding? I don't see how someone could leverage this without exploiting whatever app is hosted as the hidden service?

It's a tunnel into your internal network. If nation states and/or cyber criminals do control most of tor, then you are opening your internal network to those groups.

No, because it is possible establish a token required for access to an onion service on top of the obscurity of having to actually discover the service's public address.

It is also extremely likely that said adversaries control most of Tor, considering that the main mechanisms of tracing Tor circuits do not require control over any nodes of the Tor network whatsoever- snooping on IXPs and as many autonomous systems and underwater wires as possible.

Post reply on HN