The better article (real technical details) is https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/p...
Appearently the PoW function they chose is equi-X.
Proof-of-Work Defense for Onion Services
31–40 of 159 posts
Re: Proof-of-Work Defense for Onion Services
#32How will the service operator know when their site is under "stress". Will this effectively prevent someone from having a "high traffic" hidden service free from Tor-imposed puzzles. If the hidden service operator is aware that the site is receiving high traffic, could the operator run several sites as mirrors, so that users had options if, e.g., one site was not responding fast enough. Is there guidance published an…
> When the subsystem is enabled, suggested effort is continuously adjusted and
the computational puzzle can be bypassed entirely when the effort reaches
zero.
Re: Proof-of-Work Defense for Onion Services
#33How will the service operator know when their site is under "stress". Will this effectively prevent someone from having a "high traffic" hidden service free from Tor-imposed puzzles. If the hidden service operator is aware that the site is receiving high traffic, could the operator run several sites as mirrors, so that users had options if, e.g., one site was not responding fast enough. Is there guidance published an…
>If the hidden service operator is aware that the site is receiving high traffic, could the operator run several sites operating as mirrors, so that users had options if, e.g., one site was not responding fast enough. Is there guidance published anywhere on what is the the "normal" traffic for a service.
I think this[1] would help.
Re: Proof-of-Work Defense for Onion Services
#34I have an idea to minimize traffic on the tor network or make it faster. It should be possible to use the network as a cdn. If I want to make a file available, it should be possible for me to send pieces of the file to nodes who gave me permission to do so. When the file is requested, I then could point to these nodes. Of course, some care should be taken not to turn the tor network into a "anonymous torrent replacem…
That's kind of more the freenet model (content based), where tor is traditionally anonoymous TCP real time networking.
I dont really see how it minimizes traffic on the network though. You still have to talk to the CDN nodes.
Re: Proof-of-Work Defense for Onion Services
#35I wonder if it would be possible to securely offload some of the aes processing to the proof of work cpus. Or make ddos requestors perform a fourth layer of encryption/routing, possibly of data, possibly noise.
Re: Proof-of-Work Defense for Onion Services
#36Really interesting! Digging into the proposal [1]: > make it harder for attackers to overload the service with introduction request > We hope that this proposal can help us defend against the script-kiddie attacker and small botnets. Sets expectations: does not counter large botnets. > We hope that this proposal will allow the motivated user to always connect A user who really wants to connect can get through durring…
So now you have the drawbacks of both as well, in that the guy who has the most compute to use as a toaster can DoS everyone else.
Plus, PoW is nothing but wasted, needless computation. Computing is not free. Every watt spent doing anything PoW is just that much more intensification of our current climate crisis.
As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect, fuck anyone who proposes PoW is a good idea for anything.
It isn't interesting. It's the most egregious example of conspicuous consumption on the planet.
Re: Proof-of-Work Defense for Onion Services
#37The article says that there is only a factor of 6 in solution time between a high end server and low end phone. How is that possible? The server likely has much more than 6x the ram and cpu count (and faster cpus) than the phone. Also, since it is DDOSing, the server’s work is embarrassingly parallel, but the client work isn’t necessarily parallelized at all. Even if it is only a factor of 6 (or one) they are talking…
A good explanation of the algorithm is here: https://github.com/tevador/equix/blob/master/devlog.md
> they are talking about 1 minute solve times once a DDOS is detected.
The point of this is to prevent an existing easy DoS attack (introduction flooding) into a partial outage/slow down. It's an incremental improvement on a hard problem.
Re: Proof-of-Work Defense for Onion Services
#38The article says that there is only a factor of 6 in solution time between a high end server and low end phone. How is that possible? The server likely has much more than 6x the ram and cpu count (and faster cpus) than the phone. Also, since it is DDOSing, the server’s work is embarrassingly parallel, but the client work isn’t necessarily parallelized at all. Even if it is only a factor of 6 (or one) they are talking…
> The article says that there is only a factor of 6 in solution time between a high end server and low end phone. How is that possible? The server likely has much more than 6x the ram and cpu count (and faster cpus) than the phone.
The limiting factor if equihash is allegedly memory bandwidth, which maybe doesn't vary that much between srrvers and phones.
Re: Proof-of-Work Defense for Onion Services
#39The article says that there is only a factor of 6 in solution time between a high end server and low end phone. How is that possible? The server likely has much more than 6x the ram and cpu count (and faster cpus) than the phone. Also, since it is DDOSing, the server’s work is embarrassingly parallel, but the client work isn’t necessarily parallelized at all. Even if it is only a factor of 6 (or one) they are talking…
I suspect they're off by at least an order of magnitude in that estimate, if not two (or more if GPU acceleration is possible).
Re: Proof-of-Work Defense for Onion Services
#40Really interesting! Digging into the proposal [1]: > make it harder for attackers to overload the service with introduction request > We hope that this proposal can help us defend against the script-kiddie attacker and small botnets. Sets expectations: does not counter large botnets. > We hope that this proposal will allow the motivated user to always connect A user who really wants to connect can get through durring…
So now you have the drawbacks of both as well, in that the guy who has the most compute to use as a toaster can DoS everyone else. Plus, PoW is nothing but wasted, needless computation . Computing is not free . Every watt spent doing anything PoW is just that much more intensification of our current climate crisis. As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect,…
Maybe we can ask the DoSers to stop, nicely? Everything else being equal, I bet the Tor/Onion-folk are pretty smart people, and this is what they felt was necessary to keep the service running.