3 ms·

It doesn't mean illegitimate either. For example, sites to reach people in places where there is state sponsored censorship. Sure it's not legitimate as far as

by throwaway2016a 10y ago

It doesn't mean illegitimate either. For example, sites to reach people in places where there is state sponsored censorship. Sure it's not legitimate as far as the country do the censorship is concerned but people/governments outside that country it may be considered defensible. Security researchers (white hat and pen testers) often have onion sites to provide some street cred. If you want to blog but want to stay anonymous for personal reasons. Although with several of those I see no reason not to use a legitimate web host or VPS providers.

dogma1138 10y ago
No but you can bet your money on that at least half of those sites are trading sites of one sort or another trading in illegal goods and services. As for blogs out of 150 researchers/security professionals I know including myself no one is running an onion site for street cred if it's not anonymized there is no point having an onion address is not the same as running a hidden service.
- throwaway2016a 10y ago
  > As for blogs out of 150 researchers/security professionals I know including myself no one is running an onion site for street cred if it's not anonymized there is no point having an onion address is not the same as running a hidden service. I may know one or two but yeah, it's a stretch. I was trying too hard to think of examples.
  - dogma1138 10y ago
    There aren't many "legitimate" sites that operate as pure hidden service out there, out of all the studies I've been involved in I can't actually remember any of note. With most hidden services mapping projects you'll see 50-60% being pure CP and the rest are various forums and trading sites that are about as far from being legitimate as possible while not hosting CP. Buying drugs, zero-days, guns and w/e isn't a legitimate site, neither is any of the "hacking" boards that require you to submit a good data dump and a few defacements before being allowed in. Same goes for exit nodes, I've been running traffic analysis on 2 nodes I have access too for the past 3 years, the vast majority of it isn't really legitimate. People don't access their bank account, facebook, or their email, from my own personal research the vast majority of the traffic an exit node operator is going to see is going to be from automated tools primarily web vulnerability scanners, nearly half the traffic I see comes from SQLmap, Vega and pirated versions of Acunetix also make a large part of the bulk traffic. Even traffic which is end to end encrypted I can more or less estimate that it is some sort of a vulnerability scan or an exploit, while I can't peek into SSL nor do I wish to attempt at time based demasking attacks against the TOR network when I have like 100-1000 sites being accessed randomly within a short time window on my exit node I can pretty much guarantee you that some one is running some sort of a vulnerability scan or an exploit. I know that we would like to think that TOR is being used primarily for good but it doesn't, it doesn't mean that we should ban it for that anymore that we should ban email because 90% of email traffic is spam. But we do need to admit that the percentage of legitimate traffic going over TOR and the percentage of legitimate hidden services at this time is more or less a rounding error.
- deleted 10y ago
  [deleted]

dogma1138 10y ago

No but you can bet your money on that at least half of those sites are trading sites of one sort or another trading in illegal goods and services. As for blogs out of 150 researchers/security professionals I know including myself no one is running an onion site for street cred if it's not anonymized there is no point having an onion address is not the same as running a hidden service.

throwaway2016a 10y ago
> As for blogs out of 150 researchers/security professionals I know including myself no one is running an onion site for street cred if it's not anonymized there is no point having an onion address is not the same as running a hidden service. I may know one or two but yeah, it's a stretch. I was trying too hard to think of examples.
- dogma1138 10y ago
  There aren't many "legitimate" sites that operate as pure hidden service out there, out of all the studies I've been involved in I can't actually remember any of note. With most hidden services mapping projects you'll see 50-60% being pure CP and the rest are various forums and trading sites that are about as far from being legitimate as possible while not hosting CP. Buying drugs, zero-days, guns and w/e isn't a legitimate site, neither is any of the "hacking" boards that require you to submit a good data dump and a few defacements before being allowed in. Same goes for exit nodes, I've been running traffic analysis on 2 nodes I have access too for the past 3 years, the vast majority of it isn't really legitimate. People don't access their bank account, facebook, or their email, from my own personal research the vast majority of the traffic an exit node operator is going to see is going to be from automated tools primarily web vulnerability scanners, nearly half the traffic I see comes from SQLmap, Vega and pirated versions of Acunetix also make a large part of the bulk traffic. Even traffic which is end to end encrypted I can more or less estimate that it is some sort of a vulnerability scan or an exploit, while I can't peek into SSL nor do I wish to attempt at time based demasking attacks against the TOR network when I have like 100-1000 sites being accessed randomly within a short time window on my exit node I can pretty much guarantee you that some one is running some sort of a vulnerability scan or an exploit. I know that we would like to think that TOR is being used primarily for good but it doesn't, it doesn't mean that we should ban it for that anymore that we should ban email because 90% of email traffic is spam. But we do need to admit that the percentage of legitimate traffic going over TOR and the percentage of legitimate hidden services at this time is more or less a rounding error.
deleted 10y ago
[deleted]