4 ms·

This is a great idea, especially for TAILS users. I've long been concerned about updating a TAILS image to get the latest security updates and leaking forensic

This is a great idea, especially for TAILS users. I've long been concerned about updating a TAILS image to get the latest security updates and leaking forensically-useful data. By using hidden services for apt-get updates, everything is over Tor, so this becomes less harmful.

INTPenis 10y ago
But if you're using services through tor, aren't you already anonymous? It's my understanding that a hidden service is meant to hide the service, not the users. Hiding its users is only a byproduct of being part of tor. I never saw a practical point to big projects and organisations like Debian having hidden onion-services. Other than promoting Tor it seems to me that hidden services are meant for other applications.
- c22 10y ago
  Hidden services protect both parties better because there is no longer reliance on exit nodes.
- r3bl 10y ago
  With a hidden service, your traffic never exits out of the the Tor network. There is no possibility of the exit node being compromised or spying on you.
  - INTPenis 10y ago
    I completely missed that vital detail. Thanks for correcting me.
- tedks 10y ago
  By using a Tor-network internal address rather than an DNS/IP address, a Tor hidden service can provide integrity and confidentiality assurance over the Tor network's protocol rather than HTTPS.
  - Daviey 10y ago
    but.. for apt archives, the integrity is provided by gpg.. TLS doesn't really add value for this.. However, it does provide confidentiality, such that an actor MITM'ing can't see what software is being downloaded.
    - xena 10y ago
      There are multiple layers of encryption you get for free by using a tor hidden service.
    - M2Ys4U 10y ago
      Looking at the actual list of packages being requested isn't the only way to see what software is being downloaded. An attacker could also see the size of the packages being transferred. Using the dependency tree would help in determining what packages have been downloaded. Though I admit this is a higher barrier than just reading the list of packages.
    - tedks 10y ago
      Defense in depth.
- Iv 10y ago
  I could imagine a scenario where a specific target was identified by the version of several potentially vulnerable packages they installed. The NSA monitors when this target is online (possible even through Tor) then listens to a specific set of upgrade requests for debian during that time. Probably waiting for an upgrade into a version that they have found a vulnerability in.

INTPenis 10y ago

But if you're using services through tor, aren't you already anonymous? It's my understanding that a hidden service is meant to hide the service, not the users. Hiding its users is only a byproduct of being part of tor. I never saw a practical point to big projects and organisations like Debian having hidden onion-services. Other than promoting Tor it seems to me that hidden services are meant for other applications.

c22 10y ago
Hidden services protect both parties better because there is no longer reliance on exit nodes.
r3bl 10y ago
With a hidden service, your traffic never exits out of the the Tor network. There is no possibility of the exit node being compromised or spying on you.
- INTPenis 10y ago
  I completely missed that vital detail. Thanks for correcting me.
tedks 10y ago
By using a Tor-network internal address rather than an DNS/IP address, a Tor hidden service can provide integrity and confidentiality assurance over the Tor network's protocol rather than HTTPS.
- Daviey 10y ago
  but.. for apt archives, the integrity is provided by gpg.. TLS doesn't really add value for this.. However, it does provide confidentiality, such that an actor MITM'ing can't see what software is being downloaded.
  - xena 10y ago
    There are multiple layers of encryption you get for free by using a tor hidden service.
  - M2Ys4U 10y ago
    Looking at the actual list of packages being requested isn't the only way to see what software is being downloaded. An attacker could also see the size of the packages being transferred. Using the dependency tree would help in determining what packages have been downloaded. Though I admit this is a higher barrier than just reading the list of packages.
  - tedks 10y ago
    Defense in depth.
Iv 10y ago
I could imagine a scenario where a specific target was identified by the version of several potentially vulnerable packages they installed. The NSA monitors when this target is online (possible even through Tor) then listens to a specific set of upgrade requests for debian during that time. Probably waiting for an upgrade into a version that they have found a vulnerability in.