9 ms·

TOR hidden services is an Internet realm where people go for privacy. A search engine for it with Google Analytics attached looks like a grim irony to me, not t

TOR hidden services is an Internet realm where people go for privacy. A search engine for it with Google Analytics attached looks like a grim irony to me, not to say mockery.

jamarukato 9y ago
I guess the GA script is attached by onion.casa, not by the search engine itself.
- p4bl0 9y ago
  I can confirm that. The GA scripts are installed by the gateway, I don't have them when directly connecting to the .onion.
- ComodoHacker 9y ago
  Even so, this may get people in trouble. I've just tattooed some nonsense over keyboard and got search results related to CP. Thanks God it haven't shown me image previews! They better show a warning about gateways.
baby 9y ago
I think most people here fail to realize how correct your comment is. The only security you get from visiting a TOR hidden service is from knowing exactly what is its URL. You can't trust the URL you see from a web engine. The reason is that the onion address of a TOR hidden service is actually a hash of its public key. The TLS connection you have with the TOR service is only verified by you knowing the exact URL you've typed in your TOR browser. Without this you could be visiting a fake onion address which would be man-in-the-middling you and the real onion address you're trying to visit. Probably this is the real purpose of the advertised search engine.
- p4bl0 9y ago
  > I think most people here fail to realize how correct your comment is. I think you are assuming a lot about what people here thinks. The author of the comment you are referring to thought that the GA scripts were set up by the search engine, which is not the case. The gateway actually includes GA scripts, and if people want real privacy they don't use a gateway they can't trust (or they would be accessing it over Tor anyway, thus hiding who they really are for the gateway and for GA). > The only security you get from visiting a TOR hidden service is from knowing exactly what is its URL. Well, no, that's not the only security you get. There is also encryption and hidden IP address for example. Depending on your threat model it could be totally okay not to know who you are visiting. "Random" example: if you are using a search engine to discover new hidden services, you can't know their names in advance anyway… > The TLS connection you have with the TOR service It doesn't really work like that (and it's written "Tor" not "TOR" btw). > Probably this is the real purpose of the advertised search engine. Now you are accusing this service of trying to MITM its users based on nothing. Especially since you didn't seem to bother verifying if the GA scripts were actually set up by the search engine (which they aren't).
  - baby 9y ago
    > I think you are assuming a lot about what people here thinks. Or you are > Well, no > It doesn't really work like that Don't be pedantic. You got my point. > Now you are accusing this service of trying to MITM its users based on nothing I said probably.
    - snakeanus 9y ago
      It's not about being pedantic, it's about not being plainly incorrect.
      - baby 9y ago
        Everybody knows the security of TOR doesn't only come from the URL you type on your keyboard. This is called exaggeration not being incorrect.
        deleted 9y ago
        [deleted]
        snakeanus 9y ago
        The claim that Tor hidden services use TLS in order to encrypt their communication seems incorrect to me.
        baby 9y ago
        I actually imagined they always would since you would use the url to verify the pubkey. Why would they build hidden services without it?
        p4bl0 9y ago
        Public-key cryptography is used by Tor hidden services but it's not based on TLS/SSL certificates. There are a lot of detailed explanations of how this works on the web, but if you just want a quick overview I recently wrote about in the introduction of an article for 2600 (summer 2017 issue https://store.2600.com/collections/2010-2015/products/summer-2017 https://store.2600.com/collections/2010-2015/products/summer...). You can find a copy of my article here: https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidden-service.txt https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidd...
- collyw 9y ago
  How are you expected to look for stuff on Tor? How do you get the exact URL if not from a search engine? Edit: I see I have been down voted. It was a genuine question.
  - sp332 9y ago
    In normal Tor usage, you just visit ordinary web pages. The Tor network hides the user from the server, but it still requires the server to have a known DNS name and IP address to be reachable. Hidden services (which are not a built-in idea, they are an ugly hack and not super secure) let both sides act like a user and connect through a publicly-known intermediary. https://www.torproject.org/docs/hidden-services.html.en https://www.torproject.org/docs/hidden-services.html.en I think the only problem called out here is having Google Analytics scripts running on the page, which try to fingerprint the user's browser even when you're trying to search anonymously.
    - collyw 9y ago
      OK so if I want to search for a newer equivalent of Silk Road, how do I go about it? Thats stuff isn't going to show up in Google searches is it?
      - baby 9y ago
        It does, you will find a few websites talking about it and you will have to choose to trust the URL they give you. It's kind of like real life though, how did you get the URL of your bank? You either trust Google.com to give you the right one because you trust them as a search engine, or you pay a visit to your bank and ask them.
liotier 9y ago
Hopefully, users who care about Tor's privacy benefits will have ensured that their client environment lacks connectivity to anything but the Tor network.
mynewtb 9y ago
You are ranting about a clear-web gateway, not the search engine in question. Edit: Downvote me as far as you want, what I said is true.
- woodandsteel 9y ago
  You're right, the title is misleading. This is a gateway, not a search engine.
  - woodandsteel 9y ago
    Oops, I was wrong. You type in a word and you get search results. Seems pretty dangerous, though. I mean, people use tor so that their ISP and others can't find out what websites they are visiting, so what is the point of using a proxy to visit a tor search engine, and then have your ISP see which links you click on. In fact, it wouldn't suprise me if the whole thing is a blackmail scheme.
blubb-fish 9y ago
if you expect flawless anonymity from Tor then js should be deactivated in the first place.

TOR hidden services is an Internet realm where people go for privacy. A search engine for it with Google Analytics attached looks like a grim irony to me, not to say mockery.

jamarukato 9y ago

I guess the GA script is attached by onion.casa, not by the search engine itself.

p4bl0 9y ago
I can confirm that. The GA scripts are installed by the gateway, I don't have them when directly connecting to the .onion.
ComodoHacker 9y ago
Even so, this may get people in trouble. I've just tattooed some nonsense over keyboard and got search results related to CP. Thanks God it haven't shown me image previews! They better show a warning about gateways.

baby 9y ago

I think most people here fail to realize how correct your comment is. The only security you get from visiting a TOR hidden service is from knowing exactly what is its URL. You can't trust the URL you see from a web engine. The reason is that the onion address of a TOR hidden service is actually a hash of its public key. The TLS connection you have with the TOR service is only verified by you knowing the exact URL you've typed in your TOR browser. Without this you could be visiting a fake onion address which would be man-in-the-middling you and the real onion address you're trying to visit. Probably this is the real purpose of the advertised search engine.

p4bl0 9y ago
> I think most people here fail to realize how correct your comment is. I think you are assuming a lot about what people here thinks. The author of the comment you are referring to thought that the GA scripts were set up by the search engine, which is not the case. The gateway actually includes GA scripts, and if people want real privacy they don't use a gateway they can't trust (or they would be accessing it over Tor anyway, thus hiding who they really are for the gateway and for GA). > The only security you get from visiting a TOR hidden service is from knowing exactly what is its URL. Well, no, that's not the only security you get. There is also encryption and hidden IP address for example. Depending on your threat model it could be totally okay not to know who you are visiting. "Random" example: if you are using a search engine to discover new hidden services, you can't know their names in advance anyway… > The TLS connection you have with the TOR service It doesn't really work like that (and it's written "Tor" not "TOR" btw). > Probably this is the real purpose of the advertised search engine. Now you are accusing this service of trying to MITM its users based on nothing. Especially since you didn't seem to bother verifying if the GA scripts were actually set up by the search engine (which they aren't).
- baby 9y ago
  > I think you are assuming a lot about what people here thinks. Or you are > Well, no > It doesn't really work like that Don't be pedantic. You got my point. > Now you are accusing this service of trying to MITM its users based on nothing I said probably.
  - snakeanus 9y ago
    It's not about being pedantic, it's about not being plainly incorrect.
    - baby 9y ago
      Everybody knows the security of TOR doesn't only come from the URL you type on your keyboard. This is called exaggeration not being incorrect.
      - deleted 9y ago
        [deleted]
      - snakeanus 9y ago
        The claim that Tor hidden services use TLS in order to encrypt their communication seems incorrect to me.
        baby 9y ago
        I actually imagined they always would since you would use the url to verify the pubkey. Why would they build hidden services without it?
        p4bl0 9y ago
        Public-key cryptography is used by Tor hidden services but it's not based on TLS/SSL certificates. There are a lot of detailed explanations of how this works on the web, but if you just want a quick overview I recently wrote about in the introduction of an article for 2600 (summer 2017 issue https://store.2600.com/collections/2010-2015/products/summer-2017 https://store.2600.com/collections/2010-2015/products/summer...). You can find a copy of my article here: https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidden-service.txt https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidd...
collyw 9y ago
How are you expected to look for stuff on Tor? How do you get the exact URL if not from a search engine? Edit: I see I have been down voted. It was a genuine question.
- sp332 9y ago
  In normal Tor usage, you just visit ordinary web pages. The Tor network hides the user from the server, but it still requires the server to have a known DNS name and IP address to be reachable. Hidden services (which are not a built-in idea, they are an ugly hack and not super secure) let both sides act like a user and connect through a publicly-known intermediary. https://www.torproject.org/docs/hidden-services.html.en https://www.torproject.org/docs/hidden-services.html.en I think the only problem called out here is having Google Analytics scripts running on the page, which try to fingerprint the user's browser even when you're trying to search anonymously.
  - collyw 9y ago
    OK so if I want to search for a newer equivalent of Silk Road, how do I go about it? Thats stuff isn't going to show up in Google searches is it?
    - baby 9y ago
      It does, you will find a few websites talking about it and you will have to choose to trust the URL they give you. It's kind of like real life though, how did you get the URL of your bank? You either trust Google.com to give you the right one because you trust them as a search engine, or you pay a visit to your bank and ask them.

liotier 9y ago

Hopefully, users who care about Tor's privacy benefits will have ensured that their client environment lacks connectivity to anything but the Tor network.

mynewtb 9y ago

You are ranting about a clear-web gateway, not the search engine in question. Edit: Downvote me as far as you want, what I said is true.

woodandsteel 9y ago
You're right, the title is misleading. This is a gateway, not a search engine.
- woodandsteel 9y ago
  Oops, I was wrong. You type in a word and you get search results. Seems pretty dangerous, though. I mean, people use tor so that their ISP and others can't find out what websites they are visiting, so what is the point of using a proxy to visit a tor search engine, and then have your ISP see which links you click on. In fact, it wouldn't suprise me if the whole thing is a blackmail scheme.

blubb-fish 9y ago

if you expect flawless anonymity from Tor then js should be deactivated in the first place.