4 ms·

> I think most people here fail to realize how correct your comment is. I think you are assuming a lot about what people here thinks. The author of the commen

by p4bl0 9y ago

> I think most people here fail to realize how correct your comment is. I think you are assuming a lot about what people here thinks. The author of the comment you are referring to thought that the GA scripts were set up by the search engine, which is not the case. The gateway actually includes GA scripts, and if people want real privacy they don't use a gateway they can't trust (or they would be accessing it over Tor anyway, thus hiding who they really are for the gateway and for GA). > The only security you get from visiting a TOR hidden service is from knowing exactly what is its URL. Well, no, that's not the only security you get. There is also encryption and hidden IP address for example. Depending on your threat model it could be totally okay not to know who you are visiting. "Random" example: if you are using a search engine to discover new hidden services, you can't know their names in advance anyway… > The TLS connection you have with the TOR service It doesn't really work like that (and it's written "Tor" not "TOR" btw). > Probably this is the real purpose of the advertised search engine. Now you are accusing this service of trying to MITM its users based on nothing. Especially since you didn't seem to bother verifying if the GA scripts were actually set up by the search engine (which they aren't).

baby 9y ago
> I think you are assuming a lot about what people here thinks. Or you are > Well, no > It doesn't really work like that Don't be pedantic. You got my point. > Now you are accusing this service of trying to MITM its users based on nothing I said probably.
- snakeanus 9y ago
  It's not about being pedantic, it's about not being plainly incorrect.
  - baby 9y ago
    Everybody knows the security of TOR doesn't only come from the URL you type on your keyboard. This is called exaggeration not being incorrect.
    - deleted 9y ago
      [deleted]
    - snakeanus 9y ago
      The claim that Tor hidden services use TLS in order to encrypt their communication seems incorrect to me.
      - baby 9y ago
        I actually imagined they always would since you would use the url to verify the pubkey. Why would they build hidden services without it?
        p4bl0 9y ago
        Public-key cryptography is used by Tor hidden services but it's not based on TLS/SSL certificates. There are a lot of detailed explanations of how this works on the web, but if you just want a quick overview I recently wrote about in the introduction of an article for 2600 (summer 2017 issue https://store.2600.com/collections/2010-2015/products/summer-2017 https://store.2600.com/collections/2010-2015/products/summer...). You can find a copy of my article here: https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidden-service.txt https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidd...
      - baby 9y ago
        I actually imagined they always would since you would use the url to verify the pubkey. Why would they build hidden services without it?
jancsika 9y ago
> Depending on your threat model it could be totally okay not to know who you are visiting. "Random" example: if you are using a search engine to discover new hidden services, you can't know their names in advance anyway… That's all technically true, but I doubt even HN readers really understand what that means. So let's compare... If you open up a Google Chromebook and discover new sites by going to the default page which is a search engine also owned by Google, who a) because of the sorry state of CAs has implemented its own open source tool to watch the set of known certificates for any funny business that would signal a break somewhere in all that overly-complicated brittle technology, and b) is Google's bread and butter such that if they started mapping site titles/descriptions (which you've probably heard of out of band) to different URLs would lose their stranglehold on the industry, not to mention such an attempt would be reported widely in the news media... you can't know their names in advance anyway. vs. an expanded version of the original: If you are discovering new services via a new search engine released from an entity you've never heard of that maps page titles/descriptions of hidden services you've never heard of to human unreadable strings on an anonymity overlay for which phishing scams, covert site takeovers, and drive-by malware attacks don't make the front page of most news media... you can't know their names in advance anyway. Edit: remove redundant adjective, clean up confusing sentence
- Ajedi32 9y ago
  True, but keep in mind that just because these hidden services' true identities aren't known, doesn't mean they can't have a reputation. If this search engine becomes popular among Tor users for example, and you follow a few news sites which focus on stories related to the dark web, you'll end up in basically the same situation as you are now with Google. (With the search engine losing the trust of its users if it starts behaving maliciously.) Same goes for other hidden services.

by p4bl0 9y ago

baby 9y ago

> I think you are assuming a lot about what people here thinks. Or you are > Well, no > It doesn't really work like that Don't be pedantic. You got my point. > Now you are accusing this service of trying to MITM its users based on nothing I said probably.

snakeanus 9y ago
It's not about being pedantic, it's about not being plainly incorrect.
- baby 9y ago
  Everybody knows the security of TOR doesn't only come from the URL you type on your keyboard. This is called exaggeration not being incorrect.
  - deleted 9y ago
    [deleted]
  - snakeanus 9y ago
    The claim that Tor hidden services use TLS in order to encrypt their communication seems incorrect to me.
    - baby 9y ago
      I actually imagined they always would since you would use the url to verify the pubkey. Why would they build hidden services without it?
      - p4bl0 9y ago
        Public-key cryptography is used by Tor hidden services but it's not based on TLS/SSL certificates. There are a lot of detailed explanations of how this works on the web, but if you just want a quick overview I recently wrote about in the introduction of an article for 2600 (summer 2017 issue https://store.2600.com/collections/2010-2015/products/summer-2017 https://store.2600.com/collections/2010-2015/products/summer...). You can find a copy of my article here: https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidden-service.txt https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidd...
    - baby 9y ago
      I actually imagined they always would since you would use the url to verify the pubkey. Why would they build hidden services without it?

jancsika 9y ago

> Depending on your threat model it could be totally okay not to know who you are visiting. "Random" example: if you are using a search engine to discover new hidden services, you can't know their names in advance anyway… That's all technically true, but I doubt even HN readers really understand what that means. So let's compare... If you open up a Google Chromebook and discover new sites by going to the default page which is a search engine also owned by Google, who a) because of the sorry state of CAs has implemented its own open source tool to watch the set of known certificates for any funny business that would signal a break somewhere in all that overly-complicated brittle technology, and b) is Google's bread and butter such that if they started mapping site titles/descriptions (which you've probably heard of out of band) to different URLs would lose their stranglehold on the industry, not to mention such an attempt would be reported widely in the news media... you can't know their names in advance anyway. vs. an expanded version of the original: If you are discovering new services via a new search engine released from an entity you've never heard of that maps page titles/descriptions of hidden services you've never heard of to human unreadable strings on an anonymity overlay for which phishing scams, covert site takeovers, and drive-by malware attacks don't make the front page of most news media... you can't know their names in advance anyway. Edit: remove redundant adjective, clean up confusing sentence

Ajedi32 9y ago
True, but keep in mind that just because these hidden services' true identities aren't known, doesn't mean they can't have a reputation. If this search engine becomes popular among Tor users for example, and you follow a few news sites which focus on stories related to the dark web, you'll end up in basically the same situation as you are now with Google. (With the search engine losing the trust of its users if it starts behaving maliciously.) Same goes for other hidden services.