Why offer an Onion Address rather than just encourage browsing-over-Tor? • Hacker News Board

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#131

Post by mst » Fri, Mar 11, 2022, 12:29 PM UTC

tempestn wrote: post #117

mst wrote: post #84

Earlier quoted context omitted.

Back when I was staff on (pre-madness) freenode providing an onion address was pretty much the only way we could afford to support tor at all given the moderation resources available. Smaller networks often (usually regretfully) end up blocking tor entirely if they don't have the capacity to set up such infrastructure.

So you'd offer an onion address, but then block Tor traffic that didn't use it?

That's how we did it and so far as I'm aware is the most common answer to "How do we keep Tor while keeping the abuse mitigation efforts required within the resources available?" for services in general.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#132

Post by Asan1 » Fri, Mar 11, 2022, 3:30 PM UTC

hpcoke wrote: post #125

Asan1 wrote: post #27

[dead]

> https://hstspreload.org/ offers the same benefits. You are guaranteed to be connected to what you expect - or not at all. TLS/HSTS is still subject to CA attacks, e.g. diginotar. CA/X.509 is a complex stack too. > TLS mitigates attacks that can be executed by malicious exit nodes (or WiFi networks, or ISPs), that is the whole purpose of TLS. A malicious exit node could refuse to serve some websites. This seems a mi…

>TLS/HSTS is still subject to CA attacks, e.g. diginotar.

Largely solved by Certificate Transparency. If you compromise a CA, you can issue certificates. However, you can't issue new certificates without broadcasting that fact to the whole world as browsers will not accept certificates without SCTs.

>Reducing load on exit nodes is a technical benefit that's in that blog post.

This hasn't been a real benefit for years. Exit nodes are running at something like 10% capacity.

>Another benefit to using Tor onion services for large sites is that the Tor circuit ID can be used as an additional key in an IP rate limit cache. This helps block Tor bots (on the basis that establishing a Tor circuit is expensive).

This is just another problem with hidden services. Opening circuits costs malicious clients far less cpu time than it costs the server.

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#133

Post by Shish2k » Fri, Mar 11, 2022, 6:43 PM UTC

idontwantthis wrote: post #57

foxfluff wrote: post #48

Earlier quoted context omitted.

Exit node is where the tor-encrypted path ends and traffic goes to the clearnet.

What’s the point of any of it then to a paranoid user?

The reason to use the torplaintext bridge is to route around censorship, eg the great firewall of china, or various western ISPs blackholing the pirate bay, and also to prevent the server from learning much about the client’s identity

If you don’t want any MITM possibilities, that’s what the onion services are for (both client and server are speaking over tor connections)

Re: Why offer an Onion Address rather than just encourage browsing-over-Tor?

#134

Post by hpcoke » Sat, Mar 12, 2022, 7:54 PM UTC

Asan1 wrote: post #132

hpcoke wrote: post #125

Earlier quoted context omitted.

> https://hstspreload.org/ offers the same benefits. You are guaranteed to be connected to what you expect - or not at all. TLS/HSTS is still subject to CA attacks, e.g. diginotar. CA/X.509 is a complex stack too. > TLS mitigates attacks that can be executed by malicious exit nodes (or WiFi networks, or ISPs), that is the whole purpose of TLS. A malicious exit node could refuse to serve some websites. This seems a mi…

>TLS/HSTS is still subject to CA attacks, e.g. diginotar. Largely solved by Certificate Transparency. If you compromise a CA, you can issue certificates. However, you can't issue new certificates without broadcasting that fact to the whole world as browsers will not accept certificates without SCTs. >Reducing load on exit nodes is a technical benefit that's in that blog post. This hasn't been a real benefit for years…

> This hasn't been a real benefit for years. Exit nodes are running at something like 10% capacity.

https://metrics.torproject.org/bandwidth-flags.html corroborates what you say about utilitisation.

Exit nodes are legally difficult to host in many countries, which reduces diversity, which is a risk.

Onion services avoid the need the exit nodes, and thus the diversity risk.

> This is just another problem with hidden services. Opening circuits costs malicious clients far less cpu time than it costs the server.

I had a look for this but couldn't find it.