A bit late to the party, but... Is that not leaking information about the server? It broadcasts under how much stress the harddware is. It is probably not enough to find the exact server by itself, but still..
Like the idea otherwise.
Proof-of-Work Defense for Onion Services
151–159 of 159 posts
Re: Proof-of-Work Defense for Onion Services
#152I do wonder if tor would allow servers to have the difficulty to be "tuneable" so that service A with a small server but a solid fan base could have a high difficulty scaling that everyone knows about, and service B has a lower difficulty scaling but more servers behind it.
Re: Proof-of-Work Defense for Onion Services
#153Earlier quoted context omitted.
If you are suggesting solutions based on immutable hardware keys and certified chain of custody from the manufacturer,I have to ask if you understand what TOR is.
In OP's defence, there might be a fully anonymous way to achieve attestation. Related: https://privacypass.github.io/
That method seems closer to PoW (as is being done by TOR) than attestation.
The strongest privacy guarantee I've heard behind attestation is it would require two parties to collaborate to break it. If Google attests to a Cloudflare protected site, they can determine who you are by cooperating.
Re: Proof-of-Work Defense for Onion Services
#154Earlier quoted context omitted.
>shrieking No one is doing any such thing.
Someone is shrieking about it in the thread above. >salawat >PoW is nothing but wasted, needless computation. Computing is not free. Every watt spent doing anything PoW is just that much more intensification of our current climate crisis. >As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect, fuck anyone who proposes PoW is a good idea for anything. >It isn't interesti…
I don't see any shrieking. Are you shrieking as well?
Re: Proof-of-Work Defense for Onion Services
#155I think given the aims and limitations they've set for this it's a reasonable proposal and it will likely meet those objectives. As mentioned it will work for smaller botnets but larger ones will still overwhelm individual clients in terms of resource availability.
Personally I dislike proof of work, it's basically bloat as a defense mechanism in this case and can obsolete older hardware fast while consuming in aggregate probably a lot of power across the devices it affects. At scale it would be quite a large environmental burden.
I also think a lot of attackers will consider it a success to get it to that high difficulty as users who have to wait 1 minute of their device being 100% pegged will probably choose to disengage a lot of the time.
That said it's quite a good way of mitigating DOS attacks while not doing anything to compromise user anonymity, so from that point of view it's a good solution despite the drawbacks. As it exists on tor, I don't have too much of a problem with it but I'd consider it a total disaster if applied to the regular web.
Re: Proof-of-Work Defense for Onion Services
#156Earlier quoted context omitted.
I just wish that the PoW defence actually involved some sort of transfer of value from user to provider. (as opposed to just spending resources on the user side) This version is good, don't get me wrong, but adding value transfer would be better imo.
Value transfer would be worse because it would create bad incentives. Now I'd have a reason to flood garbage fake (/proxy) onion sites to skim the payments. The user would have to go obtain that value too, creating logistical challenges. There might be legal issues for the users too-- e.g. upgrading copyright infringement into criminally prosecutable commercial copyright infringement.
Burning funds, instead of transferring them, would solve two of your three issues.
Obtaining the funds creates extra friction, yes, but it’s possible the benefit outweighs the cost — e.g. because an attacker can no longer utilize the idle CPUs of botnet devices.
Ultimately, any form of anti-DoS protection also punishes legitimate users. The question is (1) how much it punishes attackers relative to this, and (2) whether this punishment for legitimate users deters them, too.
Re: Proof-of-Work Defense for Onion Services
#157Earlier quoted context omitted.
Value transfer would be worse because it would create bad incentives. Now I'd have a reason to flood garbage fake (/proxy) onion sites to skim the payments. The user would have to go obtain that value too, creating logistical challenges. There might be legal issues for the users too-- e.g. upgrading copyright infringement into criminally prosecutable commercial copyright infringement.
Burning funds, instead of transferring them, would solve two of your three issues. Obtaining the funds creates extra friction, yes, but it’s possible the benefit outweighs the cost — e.g. because an attacker can no longer utilize the idle CPUs of botnet devices. Ultimately, any form of anti-DoS protection also punishes legitimate users. The question is (1) how much it punishes attackers relative to this, and (2) whet…
Sure, but that wasn't what the person I was responding to suggested. If they had, I probably wouldn't have commented.
Re: Proof-of-Work Defense for Onion Services
#158Earlier quoted context omitted.
Equihash (Birthday Problem): Memory Hardness https://en.m.wikipedia.org/wiki/Equihash RandomX (Execution of a random program): Memory Hardness (Inc. cache sizes), Speculative Execution/Branching, ILP, some sort of chaining https://github.com/tevador/RandomX/blob/master/doc/design.md Edit: these are examples of CPU-bound PoW. But the general idea with PoW is that you have some hash-like function H() with no known inve…
> But the general idea with PoW is that you have some hash-like function H() No; that's a particular PoW algorithm called Hashcash [1]. There are other, asymmetric ones, where PoW verification is different from a solution attempt, including the Equi-X PoW that ToR is implementing. [1] https://en.wikipedia.org/wiki/Hashcash
Thanks, these are all very interesting. I’ll probably consider giving these a try for some use cases.
Re: Proof-of-Work Defense for Onion Services
#159Earlier quoted context omitted.
>shrieking No one is doing any such thing.
Someone is shrieking about it in the thread above. >salawat >PoW is nothing but wasted, needless computation. Computing is not free. Every watt spent doing anything PoW is just that much more intensification of our current climate crisis. >As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect, fuck anyone who proposes PoW is a good idea for anything. >It isn't interesti…
Where is the shrieking? Nothing in the text you quoted shows this. Are you a bot?