Proof-of-Work Defense for Onion Services
blog.torproject.org
Proof-of-Work Defense for Onion Services
1–10 of 159 posts
Re: Proof-of-Work Defense for Onion Services
#2What's preventing abusers from getting new identities when the PoW kicks in and continuing the DDoS?
Edit: looks like PoW is set per "service" that's under attack rather than client?
Re: Proof-of-Work Defense for Onion Services
#3I though that its the last hop that operators control and they can intercept the traffic thats the problem. but this only saves them money and costs the users more when energy is expensive
Re: Proof-of-Work Defense for Onion Services
#4What's preventing abusers from getting new identities when the PoW kicks in and continuing the DDoS? Edit: looks like PoW is set per "service" that's under attack rather than client?
[deleted]
Re: Proof-of-Work Defense for Onion Services
#5I though that its the last hop that operators control and they can intercept the traffic thats the problem. but this only saves them money and costs the users more when energy is expensive
With regular Tor > Web traffic, yes the exit relay (last hop) is able to tell the destination and can gather other metadata or intercept/modify unencrypted traffic.
With Onion Services however, there is no exit relay. Services are encrypted end to end between the client and the hidden service.
Re: Proof-of-Work Defense for Onion Services
#6Hold on you just made DoS more expensive, but a hell of alot more effective. If I need a RTX4090 to access your site now, the attacker has succeeded.
Re: Proof-of-Work Defense for Onion Services
#7I though that its the last hop that operators control and they can intercept the traffic thats the problem. but this only saves them money and costs the users more when energy is expensive
It limits denial of services attacks on onion services
Re: Proof-of-Work Defense for Onion Services
#8I'm surprised something like this wasn't done sooner, and also haven't read the proposal [0] in enough detail to tell if this will lead to more data affecting the anonymity of users. Should be fine though, since it's tied user-to-service and not stored anywhere.
I'm wondering how much this will decrease load on the service being proxied vs the nodes themselves though, I assume it'll have more benefit to services since access is spread out between multiple nodes.
[0]: https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/p...
Re: Proof-of-Work Defense for Onion Services
#9Hold on you just made DoS more expensive, but a hell of alot more effective. If I need a RTX4090 to access your site now, the attacker has succeeded.
I think difficulty also kind-of scales per-user, due to the queue mechanism.
Re: Proof-of-Work Defense for Onion Services
#10Hold on you just made DoS more expensive, but a hell of alot more effective. If I need a RTX4090 to access your site now, the attacker has succeeded.
There are PoW algorithms specifically developed to resist GPU and ASIC. Typically they do this by being memory intensive instead of (or in addition to) being compute intensive.