Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular dark-web hosting provider hacked, 6,500 sites down

zdnet.com

Post reply on HN
Print view View original

111–120 of 160 posts

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#111

Post by kodablah »

syn0byte wrote: post #59
saurik wrote: post #41

I am confused: is this seriously saying that over 30% of "hidden" services were being hosted on the server of one guy named Daniel?... that in a world where the entire point is that you don't know where anything is hosted and you are using tons of indirection through Tor to ensure there is no obvious place to hook all of the traffic or even see packets for timing attacks, it turns out there was a one in three chance…

No. That would be like someone taking GeoCities down in 1998 and claiming you took down 30% of "The Internet. You would have gotten a bunch of stuff, but obviously not 30% At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki. It's not that you don't know where its hosted , it's that you don't know who is using it or where they are. That includes publishers wi…

> At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki

30% is wrong, but there are other ways these metrics [0] are extrapolated [1]. You can see a dip in that first chart, didn't check dates to see if related.

0 - https://metrics.torproject.org/hidserv-dir-onions-seen.html 1 - https://blog.torproject.org/some-statistics-about-onions

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#112

Post by mirimir »

kodablah wrote: post #109
mirimir wrote: post #93

Earlier quoted context omitted.

OK, I'm being picky, I know. But the .onion hostname has no relation to DNS. It's just the hash of the site's private key, truncated to 16 characters.

To be more picky, it's the SHA-1 hash of the public key, truncated to 10 bytes, then base 32'd which makes 16 chars. That's only for v2, v3 is a bit different.

Damn, thanks :)

I'd forgotten that :(

And yes, v3 is a huge space. That is, several orders of magnitude larger than the IPv6 space. Which is itself humongous.

Edit: Oops. Got that very wrong. Onion v3 is orders of magnitude greater than IPv6 /64. But orders of magnitude less than IPv6 overall. It's like this, I think.

onion v2: ~1.84×10^19 [16^16]

IPv6 /64: ~1.84×10^19 (which is why OnionCat works)

onion v3: ~9.35×10^27 [56^16]

all IPv6: ~3.40×10^38

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#113

Post by yjftsjthsd-h »

busterarm wrote: post #85
dejaime wrote: post #51

This looks like a good old "Kill the problem and frame him later" type of a take down. The owners (or some users) angered the wrong people, and now they are even the biggest pedos of the whole wide world...

They probably were the biggest pedos in the world. That's the only sane reason to host a platform like this, if you have any sense of self-preservation. Moreover, its predecessors, Freedom Hosting and Freedom Hosting II, were both the biggest purveyors of CP when they were taken down. If it walks like a duck...

Only the guilty have something to hide? Really?

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#114

Post by superkuh »

sneak wrote: post #62
superkuh wrote: post #4

Man, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.

It’s not super simple to safely and securely host a hidden service. Not at all.

It's about as simple to host a website on tor as it is on the clear web. As a benefit you actually own your domain name instead of lease it on the whim of some third party subject to external countries laws and political/social pressures.

Plus it has built in side-effect anti-DOS properties so no need to centralize through companies like cloudflare.

There's huge benefits to hosting on tor even if it's just a regular website. None of my websites hosted on tor are illegal in my country.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#115

Post by kodablah »

mirimir wrote: post #112
kodablah wrote: post #109

Earlier quoted context omitted.

To be more picky, it's the SHA-1 hash of the public key, truncated to 10 bytes, then base 32'd which makes 16 chars. That's only for v2, v3 is a bit different.

Damn, thanks :) I'd forgotten that :( And yes, v3 is a huge space. That is, several orders of magnitude larger than the IPv6 space. Which is itself humongous. Edit: Oops. Got that very wrong. Onion v3 is orders of magnitude greater than IPv6 /64. But orders of magnitude less than IPv6 overall. It's like this, I think. onion v2: ~1.84×10^19 [16^16] IPv6 /64: ~1.84×10^19 (which is why OnionCat works) onion v3: ~9.35×10…

For anyone curious, v3 is the 32-byte ed25519 pub key, then the first two bytes of the SHA3-256 hash of the key (w/ prepended fixed string and one byte appended), then one more const byte, and then all of those 35 bytes are base 32'd to make 56 chars. Some Go code to illustrate: https://github.com/cretz/bine/blob/f33268f0843a1b2b131a4cacf.... One benefit being that the entire pub key is right there in the hostname.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#116

Post by thomasdd »

dejaime wrote: post #49
saurik wrote: post #41

I am confused: is this seriously saying that over 30% of "hidden" services were being hosted on the server of one guy named Daniel?... that in a world where the entire point is that you don't know where anything is hosted and you are using tons of indirection through Tor to ensure there is no obvious place to hook all of the traffic or even see packets for timing attacks, it turns out there was a one in three chance…

That 30% is clearly a gross estimation, and certainly a wrong one with no data to back it up. Still, even though it is definitely counter productive to host on a widely known host, it still does not expose any users, and that is the main point, not really protecting the host.

Here is the Data: https://www.reddit.com/r/onions/comments/9yfwfb/my_personal_...

About 7000 .onion sites worked before, about 3100 after...

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#117

Post by thomasdd »

kodablah wrote: post #111
syn0byte wrote: post #59

Earlier quoted context omitted.

No. That would be like someone taking GeoCities down in 1998 and claiming you took down 30% of "The Internet. You would have gotten a bunch of stuff, but obviously not 30% At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki. It's not that you don't know where its hosted , it's that you don't know who is using it or where they are. That includes publishers wi…

> At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki 30% is wrong, but there are other ways these metrics [0] are extrapolated [1]. You can see a dip in that first chart, didn't check dates to see if related. 0 - https://metrics.torproject.org/hidserv-dir-onions-seen.html 1 - https://blog.torproject.org/some-statistics-about-onions

Don't confuse, and don't mix .onion domains or hidden services with web-sites running on a hidden service. If a hidden service exist, it don't have to be a website!

Here is your Data about .onion websites: https://www.reddit.com/r/onions/comments/9yfwfb/my_personal_...

About 7000 .onion sites worked before, about 3100 after...

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#118

Post by saurik »

syn0byte wrote: post #59
saurik wrote: post #41

I am confused: is this seriously saying that over 30% of "hidden" services were being hosted on the server of one guy named Daniel?... that in a world where the entire point is that you don't know where anything is hosted and you are using tons of indirection through Tor to ensure there is no obvious place to hook all of the traffic or even see packets for timing attacks, it turns out there was a one in three chance…

No. That would be like someone taking GeoCities down in 1998 and claiming you took down 30% of "The Internet. You would have gotten a bunch of stuff, but obviously not 30% At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki. It's not that you don't know where its hosted , it's that you don't know who is using it or where they are. That includes publishers wi…

Your second paragraph is not, in my understanding, the goal of a hidden service: that is merely the goal of Tor itself and would apply to a non-hidden service being accessed via Tor. The goal of the hidden services feature is to allow hosts to have the same level of anonymity as users, making it nearly impossible to shut them down or know where to tap their traffic (for timing attacks).

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#119

Post by jorblumesea »

busterarm wrote: post #85
dejaime wrote: post #51

This looks like a good old "Kill the problem and frame him later" type of a take down. The owners (or some users) angered the wrong people, and now they are even the biggest pedos of the whole wide world...

They probably were the biggest pedos in the world. That's the only sane reason to host a platform like this, if you have any sense of self-preservation. Moreover, its predecessors, Freedom Hosting and Freedom Hosting II, were both the biggest purveyors of CP when they were taken down. If it walks like a duck...

Yeah, and the biggest users of cryptography are criminals. Only the guilty lock their car doors, right?

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#120

Post by dejaime »

thomasdd wrote: post #116
dejaime wrote: post #49

Earlier quoted context omitted.

That 30% is clearly a gross estimation, and certainly a wrong one with no data to back it up. Still, even though it is definitely counter productive to host on a widely known host, it still does not expose any users, and that is the main point, not really protecting the host.

Here is the Data: https://www.reddit.com/r/onions/comments/9yfwfb/my_personal_... About 7000 .onion sites worked before, about 3100 after...

Exactly, all they have is some questionable data about onion links. Onion links is one way of using deep web, one of many.
Post reply on HN