Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why offer an Onion Address rather than just encourage browsing-over-Tor?

alecmuffett.com

Post reply on HN
Print view View original

121–130 of 134 posts

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#121

Post by sweetbitter »

heavyset_go wrote: post #118
I_Byte wrote: post #107

Earlier quoted context omitted.

This is incorrect. A Tor hidden service is fundamentally different from port forwarding. If you don't have the hidden services onion address (v3 address) then you physically cannot make a connection to the hidden service. This is because the onion address is the hidden services public key. You can scan the entire internet for open ports, you can't scan the Tor network for hidden services to connect to unless you alre…

When you create an onion address, does that address get leaked at any point? As in, are there nodes or servers in the Tor network that know that xxxx.onion is a valid address at the time of creation or afterwards?

You can set up a token that is required to actually make the connection[0].

[0] - http://xmrhfasfg5suueegrnc4gsgyi2tyclcy5oz7f5drnrodmdtob6t2i...

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#122

Post by londgine »

Jerrrry wrote: post #86
kevingadd wrote: post #38

Earlier quoted context omitted.

They could probably compel you to continue, or forcibly take over the node. Once you're in NSL "we can do anything we want and you can't tell anyone about it" land, being prevented from shutting down your own business or service isn't terribly far-fetched.

The government cannot anyone to work without pay. This seems obvious but it is a constitutional right that has been cited as a reason to not comply with extra-judicial pressure to assist the government with an investigation. This is why some projects do not accept donations and have a canary. Had the authors of Truecrypt been paid, they could had been compelled to modify their source code to the government's will. By…

> the government cannot force anything to work without pay

but they can force people to work with pay https://www.wbay.com/2022/01/20/thedacare-seeks-court-order-...

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#123

Post by I_Byte »

heavyset_go wrote: post #118
I_Byte wrote: post #107

Earlier quoted context omitted.

This is incorrect. A Tor hidden service is fundamentally different from port forwarding. If you don't have the hidden services onion address (v3 address) then you physically cannot make a connection to the hidden service. This is because the onion address is the hidden services public key. You can scan the entire internet for open ports, you can't scan the Tor network for hidden services to connect to unless you alre…

When you create an onion address, does that address get leaked at any point? As in, are there nodes or servers in the Tor network that know that xxxx.onion is a valid address at the time of creation or afterwards?

With the old v2 hidden services (16 character long onion addresses) it was possible to recover the onion addresses of any service running on the Tor network while the v2 hidden service was running.

However, that issue was only present in v2 hidden services. v2 has been depreciated in favor of the new v3 hidden service protocol (56 character long onion addresses) which is not vulnerable to this issue. This new protocol contains a full ed2559 elliptic curve public key in the onion address. The key in the onion address is used to derive what are called "blind keys". These "blinded keys" are then announced to the Tor network in such a way that nobody can recover the original public key without prior knowledge of the it, leaving them unable to establish a connection with the hidden service.

I have only briefly elaborated on how v3 hidden services work. If you are interested in a more in depth and technical explanation I encourage you to read:

[0] - https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.... [1] - https://gitlab.torproject.org/legacy/trac/-/wikis/doc/NextGe...

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#124

Post by hpcoke »

kingcharles wrote: post #113
p4bl0 wrote: post #72

It is possible to advertise your .onion address and offer automatic redirect to it for Tor Browser users using the "Onion-Location" HTTP header. Example with my personal home page: $ curl -I https://pablo.rauzy.name/ HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Thu, 10 Mar 2022 14:04:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2843 Last-Modified: Sun, 23 Jan 2022 22:21:41 GMT Connection: keep-alive On…

Is there some sort of attack possible here where you could hand out unique onion addresses to each visitor, so when they connect with Tor you could fingerprint their Tor connection and match it to their cleartext connection? *takes off his black hat*

No, since the redirect only works in the Tor Browser, in which case the cleartext connection is still a Tor connection.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#125

Post by hpcoke »

Asan1 wrote: post #27

[dead]

> https://hstspreload.org/ offers the same benefits. You are guaranteed to be connected to what you expect - or not at all.

TLS/HSTS is still subject to CA attacks, e.g. diginotar.

CA/X.509 is a complex stack too.

> TLS mitigates attacks that can be executed by malicious exit nodes (or WiFi networks, or ISPs), that is the whole purpose of TLS.

A malicious exit node could refuse to serve some websites. This seems a minor risk though.

Reducing load on exit nodes is a technical benefit that's in that blog post.

Another benefit to using Tor onion services for large sites is that the Tor circuit ID can be used as an additional key in an IP rate limit cache. This helps block Tor bots (on the basis that establishing a Tor circuit is expensive).

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#126

Post by crtasm »

idontwantthis wrote: post #57
foxfluff wrote: post #48

Earlier quoted context omitted.

Exit node is where the tor-encrypted path ends and traffic goes to the clearnet.

What’s the point of any of it then to a paranoid user?

the exit node has no knowledge of your IP address and your traffic should still be protected by HTTPS.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#127

Post by crtasm »

rosndo wrote: post #73
kevincox wrote: post #60

Earlier quoted context omitted.

But then you are relying on the CA system which is a huge risk. A significant benifit of onion addresses is that The key is distributed with the address. So as long as you get the address over a secure channel you are safe. With https you need to get the address over a secure channel and hope that no CAs are compromised. The secure channel might be easier (because you can quickly memozrize twitter.com) but to avoid t…

Thanks to certificate transparency the CA system is really not a huge risk.

Are all the CAs in your browser (and those of your site's users) trust list doing proper public logging now?

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#128

Post by rosndo »

crtasm wrote: post #127
rosndo wrote: post #73

Earlier quoted context omitted.

Thanks to certificate transparency the CA system is really not a huge risk.

Are all the CAs in your browser (and those of your site's users) trust list doing proper public logging now?

It’s been mandatory since 2018. Browsers will reject certificates which have not been publicly logged.

Perhaps next you’ll wonder if it’s as simple as compromising a CA and a CT log? Nope, as browsers require cryptographic attestations from multiple CT logs. If you’re using Chrome, one of those logs has to be the one operated by Google.

Also such collusion will soon be defeated by SCT auditing https://www.hardenize.com/blog/certificate-transparency-sct-...

https://docs.google.com/document/d/16G-Q7iN3kB46GSW5b-sfH5MO...

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#129

Post by p4bl0 »

kingcharles wrote: post #113
p4bl0 wrote: post #72

It is possible to advertise your .onion address and offer automatic redirect to it for Tor Browser users using the "Onion-Location" HTTP header. Example with my personal home page: $ curl -I https://pablo.rauzy.name/ HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Thu, 10 Mar 2022 14:04:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2843 Last-Modified: Sun, 23 Jan 2022 22:21:41 GMT Connection: keep-alive On…

Is there some sort of attack possible here where you could hand out unique onion addresses to each visitor, so when they connect with Tor you could fingerprint their Tor connection and match it to their cleartext connection? *takes off his black hat*

Doing so you would only identify Tor exit nodes.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#130

Post by krageon »

FeepingCreature wrote: post #51
krageon wrote: post #15

Earlier quoted context omitted.

> Aren't there warrant canaries set up to prevent this? No, because the police will tell you to not tell anyone about the court order. If you do so (for example using a warrant canary), you will be in big trouble. Those canaries were always a convenient fiction, almost to the point of it being entirely in question whether or not this fiction was created in good faith.

You can always be in trouble by the police for any reason or no reason at all. The question is law. The notion of a warrant canary is that the police cannot compel you to state that you are not under a court order. They can annoy you to lie, and they can always break the law, but they cannot legally force you to. To claim that regardless of this, the police can compel you to lie, is tantamount to saying that the rule…

> To claim that regardless of this, the police can compel you to lie, is tantamount to saying that the rule of law has failed.

Your life quality will take a sharp negative dive if you don't conform to the spirit of what they ask you. Whether or not such things are legal really is immaterial: You will be in trouble anyway. As such, I dislike advice that leans on what the law says.

Post reply on HN