Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ricochet: Peer-to-peer instant messaging system built on Tor hidden services (2017)

github.com

Post reply on HN
Print view View original

21–30 of 36 posts

Re: Ricochet: Peer-to-peer instant messaging system built on Tor hidden services (2017)

#24

Post by kobieps »

marc_abonce wrote: post #17
fsflover wrote: post #15

Earlier quoted context omitted.

How does running a Tor relay compromise your privacy?

I assume that they mean that the identity of the people running the Tor relays can be known. For example, if you run a relay from your own physical server, then your ISP knows who pays for that static IP. If you run it from a VPS or cloud, the company knows who's paying for that server. But if you live in a liberal democracy, none of that should be an issue as far as I know, specially if you're running a non-exit nod…

Not all cloud / VPS providers require KYC

Re: Ricochet: Peer-to-peer instant messaging system built on Tor hidden services (2017)

#26

Post by _blk »

karel-3d wrote: post #5

> From 2019 to 2021, Ricochet was used by the admins (as well as an undercover investigator) of the child porn onion site Boystown. To identify the perpetrators, German police used a correlation analysis attack. By sending Ricochet messages to perpetrators and monitoring several hundred Tor nodes for simultaneous traffic of the correct size, authorities were able to identify intermediate Tor nodes and then also the p…

Great example of why Tor should not be forbidden: helps anonymity a lot, yet with enough "proof of work," law enforcement can still track down severe crimes. Kudos to law enforcement on this one.

Re: Ricochet: Peer-to-peer instant messaging system built on Tor hidden services (2017)

#27

Post by immibis »

k__ wrote: post #18

Half-OT: How well do Onion services work with regular HTTP and DNS? Can I use Onion IDs use just like a regular domain?

Yes but only if you connect through the SOCKS or HTTP proxy service provided by the Tor daemon.

There's no DNS when using a proxy. The proxy does DNS.

Re: Ricochet: Peer-to-peer instant messaging system built on Tor hidden services (2017)

#28

Post by k__ »

immibis wrote: post #27
k__ wrote: post #18

Half-OT: How well do Onion services work with regular HTTP and DNS? Can I use Onion IDs use just like a regular domain?

Yes but only if you connect through the SOCKS or HTTP proxy service provided by the Tor daemon. There's no DNS when using a proxy. The proxy does DNS.

Do you happen to know how browsers like Brave do it?

Re: Ricochet: Peer-to-peer instant messaging system built on Tor hidden services (2017)

#29

Post by jqpabc123 »

kobieps wrote: post #24
marc_abonce wrote: post #17

Earlier quoted context omitted.

I assume that they mean that the identity of the people running the Tor relays can be known. For example, if you run a relay from your own physical server, then your ISP knows who pays for that static IP. If you run it from a VPS or cloud, the company knows who's paying for that server. But if you live in a liberal democracy, none of that should be an issue as far as I know, specially if you're running a non-exit nod…

Not all cloud / VPS providers require KYC

Most cloud/VPS providers require some form of payment. If you know of one that doesn't for any significant workload, please let me know :).

The payment providers require KYC. Bitcoin operates using a public ledger that raises privacy concerns as well.

Liberal democracy does not insulate one from responsibility for or accusations of nefarious activity.

Therefore, since it is reasonable to say that a tor node cannot be easily operated anonymously; doing so exposes the operator to some level of personal legal scrutiny that can be inconvenient and time consuming to address at best.

Authorities have been known to seize relays and exit nodes and repurpose them to their own use.

Re: Ricochet: Peer-to-peer instant messaging system built on Tor hidden services (2017)

#30

Post by morganava »

k__ wrote: post #28
immibis wrote: post #27

Earlier quoted context omitted.

Yes but only if you connect through the SOCKS or HTTP proxy service provided by the Tor daemon. There's no DNS when using a proxy. The proxy does DNS.

Do you happen to know how browsers like Brave do it?

So Tor Browser (fork of Firefox ESR with various custom patches and tor bundled in) sends all DNS requests over tor (presumably Brave does the same thing if they're doing their jobs right) via tor's SOCKS5 interface.

This means if you make a request for a clearnet service (e.g. example.com), that request goes to the daemon, which forwards it through the tor network to the exit node. That node sends a DNS request to whatever DNS server it is configured to use.

In the case of an onion-service (e.g. riseup.net's onion-service vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion) the tor daemon itself notices 'oh hey it's a .onion tld' and will try to resolve using its internal onion-service related machinery. This type of request will never go to a DNS server.

However, it can get weird if you're configuring a piece of software that somehow is not 'tor-aware' to use tor as a SOCKS5 proxy, and then request an onion-service. In the case of curl for instance it will(would?) reject the request since .onion is not a valid general TLD (per RFC 7686) to avoid leaking the .onion name to DNS servers (see https://daniel.haxx.se/blog/2024/05/17/curl-tor-dot-onion-an... for more info).

Another failure mode is software somehow doing its DNS requests internally rather than relying on the SOCKS endpoint it's configured with:

> let ip_address = DNSResolver.resolve("www.example.com");

> let socket = TCP.connect(ip_address);

In this example, the domain name would be resolved with the user's own locally configured DNS, and then connect to the website over tor which would allow correlation of the anonymous connection with you under the right circumstances.

Yet another failure mode is if the application's protocol somehow includes local network info (e.g. your IP) embedded in its protocol's packets. If you were to naively tunnel this traffic over tor, you wouldn't actually have anonymity since the app itself would be snitching on you.

---

So in general, one should not naively tunnel arbitrary traffic over tor if your goal is anonymity. There's a reason (well, lots of reasons) why Tor Browser requires regular maintenance beyond 'lol just configure Firefox to use tor, job done'. There is a surprising amount of subtlety and complications around browsing the web over tor so if that's your goal, please just use Tor Browser.

Also in general, if you need your anonymity please do prefer software which has bundled+configured tor in it correctly, rather than just rolling your own (unless you actually know what you're doing, understand your threat model, how all these pieces interact, etc).

Post reply on HN