9 ms·

Tor's Fall Harvest: The Next Generation of Onion Services

218 points by jerheinze 9y ago

the_stc 9y ago
Being undiscoverable is a big help. For our ancillary services, we're taken to using Tor2Web to auth mode HS servers because some random domain is less likely to look interesting for people to poke at. Publishing a .onion, especially with some general-purpose software hosted on it screams that there is something of interest there.
- superkuh 9y ago
  Gotta be the change you want to see. None of my hidden service .onion sites are anything "of interest". They're just electronics and radio hobby stuff like the web has always had. Put everything on Tor as a hidden service and eventually the stigma will go away.
  - ewzimm 9y ago
    This is on the front page now right next to a story about how hostile and ad-ridden most commercial websites have become. Thank you for helping keep the original spirit of the web alive on onion space.
  - celticninja 9y ago
    Do you have a guide to doing that? I would love to host some stuff on Tor just because.
    - jstanley 9y ago
      Here you go: https://www.torproject.org/docs/tor-hidden-service.html.en https://www.torproject.org/docs/tor-hidden-service.html.en It's dead easy. Setup a web server basically like normal, but make sure it's listening only on loopback if that's important to you. Then install tor, and add a couple of lines to the torrc and restart tor. HiddenServiceDir /usr/local/etc/tor/hidden_service/ HiddenServicePort 80 127.0.0.1:8080 The keypair will be generated and you'll find the onion address in /usr/local/etc/tor/hidden_service/hostname, and it'll forward all traffic to 127.0.0.1:8080. You can run as many hidden services as you like on the same tor instance, with different onion addresses, and forwarding to different places.
      - dmix 9y ago
        How have you found long term maintenance of running these services? ie, running into random breakage and spending time debugging the system vs an nginx box or something... Is it set-it-and-forget-it type of system? I've always wanted to set up onion addresses but I'm always wary to open up a new bag of worms for my personal projects. The fact it sounds so easy is encouraging.
        jstanley 9y ago
        Yes, it's set-and-forget. It still runs nginx, it's basically the same as running a clearnet site. I've not experienced any random breakages.
deleted 9y ago
[deleted]
deepnotderp 9y ago
How about a working implementation of the HORNET paper?
schoen 9y ago
I decided this was just the right occasion to propose DV certificate issuance for these names: https://cabforum.org/pipermail/public/2017-November/012451.html https://cabforum.org/pipermail/public/2017-November/012451.h...
- asn_tor 9y ago
  Thanks Seth! That's great stuff :)
wybiral 9y ago
I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to trust that I'm not relying on a site run by some kid in her parents basement. And I know that legitimate sites can get certs for onions these days (like facebook)... But doesn't that defeat the original purpose of running a hidden service if the purpose is to hide the owner?
- the_stc 9y ago
  My company (details in profile) relies on Tor. We help people, but governments would like to shut us down. We actually will expose everything via a non .onion, then proxy it to our HS (SSL term done on the hidden service). We'll expose via .onion as well and get a cert. We are hoping with HS v3 the rules will relax. For now, Digicert told us they were not going to issue any more. Maybe if we push.
  - deleted 9y ago
    [deleted]
- anamexis 9y ago
  There is another purpose, because when you access a hidden service, you are not using an (unknown, untrustable) exit node – instead, your data remains entirely encrypted until it reaches the owner of the address.
  - wybiral 9y ago
    That's a valid point. Thanks for bringing that up. So now I have a private channel to that address and I don't have to worry about the exit nodes (unlike when I use Tor for clearnet sites). But now how do I know that I can trust the owner of that onion?
    - 9y ago
MBCook 9y ago
Does it fix the LONG standing issue that Dr. Krawetz keeps discussing on his blog that makes it trivial to DOS an onion site? Description in the section about ‘Eddie’. https://www.hackerfactor.com/blog/index.php?/archives/762-Attacked-Over-Tor.html https://www.hackerfactor.com/blog/index.php?/archives/762-At...
- nikcub 9y ago
  He didn't discover an issue - he just FUD'd long enough until a few people believed he did. That he believes there is something "suspicious" about Tor nodes because their IP doesn't match to any country or AS name in the free distribution of the GeoIP database built into Tor is just smh bad Why he also believes bots accessing his HS has anything to do with Tor Exit nodes is also beyond me .. but he provides no evidence for any of that either
  - nikcub 9y ago
    To add: at the time that original story was posted I left this comment[0] explaining what I believe he was seeing He was asked to ping tor-security or file an issue and never did, afaik - nor was it ever really seriously discussed [0] https://news.ycombinator.com/item?id=14281434 https://news.ycombinator.com/item?id=14281434
- asn_tor 9y ago
  No the new design does nothing against such DoS attacks. Please see tor tickets #16052 and #16059 for some plausible ways forward. We would need more help from the community to design and develop solutions to handle the DoS threat. I've tried to communicate with the hackerfactor person about this and figure out ways forward, but I received unproductive responses which did not make me want to proceed in discussion. We need the community to help us understand how they best want to manage the DoS risks and build sustainable proposals to fight them.
tacotornado 9y ago
Great story. I love the future.
pault 9y ago
The issue I've always had with onion addresses is that you can't remember them, which means you need to keep a list of bookmarks saved locally somewhere, which–if you're using tor to avoid prosecution–is pretty incriminating. What's the solution?
- na85 9y ago
  Keep one bookmark to a community directory? The plausible deniability is that you just visit for the catpicures1685isbis.onion, and not for cocainehookerz3288uiop.onion
  - wybiral 9y ago
    But now you have to trust that community directory not to give you the wrong onions...
    - PhearTheCeal 9y ago
      Which is why information like that should be stored in the blockchain where it can't be modified.
      - zaroth 9y ago
        I assume this is already done, and if not why not? The practical implementation would be the bookmarking service would authenticate their links against this blockchain, and the user would either have an agent on their system to validate the claims, or another 3rd party who they trusted to validate the claims?
      - airwavves 9y ago
        This is a remarkably good idea. You can store an onion hash in a blockchain transaction and then use the signature of the key which sent that transaction to verify it.
        StavrosK 9y ago
laneuffer 9y ago
Great story!
zaroth 9y ago
Here's a question I have on this -- I've been eagerly awaiting the new functionality to have onion addresses where using them doesn't reveal their existence. So the address itself becomes a form of shared key. But this opens another possibility of one-time addresses, and address scalability. My question is, does network cost increase with number of addresses? If peers on the network are using one-time addresses to form circuits, will that scale fine? Basically I am envisioning two people communicating via dedicated addresses for their own use only. So a single key becomes a network channel to send data to a specific peer. That "peer" could actually be many different devices, but all ultimately connect to the same distributed application with a shared state. So basically onion addresses are usernames which also let you pipe data to that user, right? How is this not the coolest thing ever?
- asn_tor 9y ago
  Each onion service does increase network load but not anything super intense. The use case you suggested should be possible. Also check out ricochet which works with legacy onions for chat.
amingilani 9y ago
I used to use Tor to bypass censorship on pr0n in my country and ended up trying to run a hidden service for fun. My biggest peeve with was the domain name. I mean, sure I understand why it isn't human readable but then there are so many ways to counter that. We've got the blockchain and we have the IPFS way to handle these things too. I'm hoping at some point blockchain DNS systems are adopted by mainstream (or niche in case of Tor) vendors. It would make it so much much easier to name onions.
- amelius 9y ago
  How fast/convenient is Tor for downloading large files, like video (e.g. via Bittorrent)? PS: It seems that Bittorrent over Tor is a bad idea, [1]. [1] https://blog.torproject.org/bittorrent-over-tor-isnt-good-idea https://blog.torproject.org/bittorrent-over-tor-isnt-good-id...
  - amingilani 9y ago
    It's a really bad idea. I used to stream, though. Which was fine.
  - devrandomguy 9y ago
    In Qatar, which has a national firewall, I was able to use Tor to browse torrent sites, and then use a regular bittorrent client to fetch the contents of the magnet links (encrypted connections only). That worked great for the few years that I was there. The Qatari internet was a fair bit faster than what I am used to from Canada, about 30 - 50 MB/s at max torrent.
    - Teapot 9y ago
      Worth trying Tribler. Seems it's Torrent traffic inside its own Tor network. https://en.wikipedia.org/wiki/Tribler https://en.wikipedia.org/wiki/Tribler
hannaysteve 9y ago
The article is really interesting and valid.
nikcub 9y ago
If you are looking for a practical use of hidden services: we use them as ingress for Docker and K8 management. You start a container that runs just tor with a config and can read the routing endpoints from your config, or link to localhost:2375 HiddenServicePort <onion port> <host>:<port> You setup HiddenServiceAuthorizeClient with stealth auth type and a list of authorized clients. You can lock your firewall rules down as the hidden service only requires outbound to HTTPS. On the client end you setup regular Tor with HidServAuth <onion address> <auth-cookie> With stealth auth other tor users won't see the serivce and port published without the auth cookie You can then use socat to bind the remote hidden service and port to a local host and port: socat tcp-l:127.0.0.1:2023,fork socks4a:onionaddr.onion:localhost:23,proxyport=9050 You then have the remote ssh server available locally with no public interfaces, no public ports, and an additional layer of confidentiality and authentication
- SoreGums 9y ago
  Awesome, this is what I had in mind for using a stealth way to manage infrastructure. Thanks for sharing a blueprint as I'd only theorycrafted it and now I have a path to experiment with.
- ynezz 9y ago
  > additional layer of confidentiality and authentication and additional layers of attack surfaces
  - belorn 9y ago
    From a IT Security Assessment, what would those be and their associated risk and impact factors? One would naturally be the onion address. If they could break the 1024 bit RSA key, they could hijack the name. Risk of this happening: very low. Impact: massive especially outside the realm of tor. Any additional risks you were thinking about? Backdoors in tor project? Hardware malware specifically designed for tor (rather than than being general)?
    - Ajedi32 9y ago
jstanley 9y ago
> And finally from the casuals user's PoV, the only thing that changes is that new onions are bigger, tastier and they now look like this: 7fa6xlti5joarlmkuhjaifa47ukgcwz6tfndgax45ocyn4rixm632jid.onion. For more information on the nitty-gritty details, please check out our technical specification. It's a shame they don't have a description for technical users. I'm more interested than "bigger, tastier, and looks like this", but less interested than 13000 words of specification.
- dmix 9y ago
  The problem with a lot of these open source projects is that you're usually so exhausted trying to get the release out you don't have much energy in explaining them! (As these types of things require developer involvement) But agreed. This is basically offering a paragraph long abstract or read the massive white paper, without much in between.
- asn_tor 9y ago
  Hey there, Tor developer here. You are right there is no middle ground there. I'm kind of on the run right now, so I can't write a big explanation here. However check this section of the proposal that presents some high-level improvements: https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt#n126 https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.... peace
- dublinben 9y ago
  TL;DR of that change is that they've moved from a truncated SHA1 hash to SHA3/ed25519/curve25519. For more detail, here's their own summary from the technical specification: Here is a list of improvements of this proposal over the legacy hidden services: a) Better crypto (replaced SHA1/DH/RSA1024 with SHA3/ed25519/curve25519) b) Improved directory protocol leaking less to directory servers. c) Improved directory protocol with smaller surface for targeted attacks. d) Better onion address security against impersonation. e) More extensible introduction/rendezvous protocol. f) Offline keys for onion services g) Advanced client authorization
flyGuyOnTheSly 9y ago
>Get in touch if you'd like to sponsor us to work on onion services to make them faster, slower, or stabler. That's a strange comment. Why would they accept money to make the TOR system slower?

218 points by jerheinze 9y ago

Being undiscoverable is a big help. For our ancillary services, we're taken to using Tor2Web to auth mode HS servers because some random domain is less likely to look interesting for people to poke at. Publishing a .onion, especially with some general-purpose software hosted on it screams that there is something of interest there.

superkuh 9y ago
Gotta be the change you want to see. None of my hidden service .onion sites are anything "of interest". They're just electronics and radio hobby stuff like the web has always had. Put everything on Tor as a hidden service and eventually the stigma will go away.
- ewzimm 9y ago
  This is on the front page now right next to a story about how hostile and ad-ridden most commercial websites have become. Thank you for helping keep the original spirit of the web alive on onion space.
- celticninja 9y ago
  Do you have a guide to doing that? I would love to host some stuff on Tor just because.
  - jstanley 9y ago
    Here you go: https://www.torproject.org/docs/tor-hidden-service.html.en https://www.torproject.org/docs/tor-hidden-service.html.en It's dead easy. Setup a web server basically like normal, but make sure it's listening only on loopback if that's important to you. Then install tor, and add a couple of lines to the torrc and restart tor. HiddenServiceDir /usr/local/etc/tor/hidden_service/ HiddenServicePort 80 127.0.0.1:8080 The keypair will be generated and you'll find the onion address in /usr/local/etc/tor/hidden_service/hostname, and it'll forward all traffic to 127.0.0.1:8080. You can run as many hidden services as you like on the same tor instance, with different onion addresses, and forwarding to different places.
    - dmix 9y ago
      How have you found long term maintenance of running these services? ie, running into random breakage and spending time debugging the system vs an nginx box or something... Is it set-it-and-forget-it type of system? I've always wanted to set up onion addresses but I'm always wary to open up a new bag of worms for my personal projects. The fact it sounds so easy is encouraging.
      - jstanley 9y ago
        Yes, it's set-and-forget. It still runs nginx, it's basically the same as running a clearnet site. I've not experienced any random breakages.

deleted 9y ago

[deleted]

deepnotderp 9y ago

How about a working implementation of the HORNET paper?

schoen 9y ago

I decided this was just the right occasion to propose DV certificate issuance for these names: https://cabforum.org/pipermail/public/2017-November/012451.html https://cabforum.org/pipermail/public/2017-November/012451.h...

asn_tor 9y ago
Thanks Seth! That's great stuff :)

wybiral 9y ago

I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to trust that I'm not relying on a site run by some kid in her parents basement. And I know that legitimate sites can get certs for onions these days (like facebook)... But doesn't that defeat the original purpose of running a hidden service if the purpose is to hide the owner?

the_stc 9y ago
My company (details in profile) relies on Tor. We help people, but governments would like to shut us down. We actually will expose everything via a non .onion, then proxy it to our HS (SSL term done on the hidden service). We'll expose via .onion as well and get a cert. We are hoping with HS v3 the rules will relax. For now, Digicert told us they were not going to issue any more. Maybe if we push.
- deleted 9y ago
  [deleted]
anamexis 9y ago
There is another purpose, because when you access a hidden service, you are not using an (unknown, untrustable) exit node – instead, your data remains entirely encrypted until it reaches the owner of the address.
- wybiral 9y ago
  That's a valid point. Thanks for bringing that up. So now I have a private channel to that address and I don't have to worry about the exit nodes (unlike when I use Tor for clearnet sites). But now how do I know that I can trust the owner of that onion?
  - 9y ago

MBCook 9y ago

Does it fix the LONG standing issue that Dr. Krawetz keeps discussing on his blog that makes it trivial to DOS an onion site? Description in the section about ‘Eddie’. https://www.hackerfactor.com/blog/index.php?/archives/762-Attacked-Over-Tor.html https://www.hackerfactor.com/blog/index.php?/archives/762-At...

nikcub 9y ago
He didn't discover an issue - he just FUD'd long enough until a few people believed he did. That he believes there is something "suspicious" about Tor nodes because their IP doesn't match to any country or AS name in the free distribution of the GeoIP database built into Tor is just smh bad Why he also believes bots accessing his HS has anything to do with Tor Exit nodes is also beyond me .. but he provides no evidence for any of that either
- nikcub 9y ago
  To add: at the time that original story was posted I left this comment[0] explaining what I believe he was seeing He was asked to ping tor-security or file an issue and never did, afaik - nor was it ever really seriously discussed [0] https://news.ycombinator.com/item?id=14281434 https://news.ycombinator.com/item?id=14281434
asn_tor 9y ago
No the new design does nothing against such DoS attacks. Please see tor tickets #16052 and #16059 for some plausible ways forward. We would need more help from the community to design and develop solutions to handle the DoS threat. I've tried to communicate with the hackerfactor person about this and figure out ways forward, but I received unproductive responses which did not make me want to proceed in discussion. We need the community to help us understand how they best want to manage the DoS risks and build sustainable proposals to fight them.

tacotornado 9y ago

Great story. I love the future.

pault 9y ago

The issue I've always had with onion addresses is that you can't remember them, which means you need to keep a list of bookmarks saved locally somewhere, which–if you're using tor to avoid prosecution–is pretty incriminating. What's the solution?

na85 9y ago
Keep one bookmark to a community directory? The plausible deniability is that you just visit for the catpicures1685isbis.onion, and not for cocainehookerz3288uiop.onion
- wybiral 9y ago
  But now you have to trust that community directory not to give you the wrong onions...
  - PhearTheCeal 9y ago
    Which is why information like that should be stored in the blockchain where it can't be modified.
    - zaroth 9y ago
      I assume this is already done, and if not why not? The practical implementation would be the bookmarking service would authenticate their links against this blockchain, and the user would either have an agent on their system to validate the claims, or another 3rd party who they trusted to validate the claims?
    - airwavves 9y ago
      This is a remarkably good idea. You can store an onion hash in a blockchain transaction and then use the signature of the key which sent that transaction to verify it.
      - StavrosK 9y ago

laneuffer 9y ago

Great story!

zaroth 9y ago

Here's a question I have on this -- I've been eagerly awaiting the new functionality to have onion addresses where using them doesn't reveal their existence. So the address itself becomes a form of shared key. But this opens another possibility of one-time addresses, and address scalability. My question is, does network cost increase with number of addresses? If peers on the network are using one-time addresses to form circuits, will that scale fine? Basically I am envisioning two people communicating via dedicated addresses for their own use only. So a single key becomes a network channel to send data to a specific peer. That "peer" could actually be many different devices, but all ultimately connect to the same distributed application with a shared state. So basically onion addresses are usernames which also let you pipe data to that user, right? How is this not the coolest thing ever?

asn_tor 9y ago
Each onion service does increase network load but not anything super intense. The use case you suggested should be possible. Also check out ricochet which works with legacy onions for chat.

amingilani 9y ago

I used to use Tor to bypass censorship on pr0n in my country and ended up trying to run a hidden service for fun. My biggest peeve with was the domain name. I mean, sure I understand why it isn't human readable but then there are so many ways to counter that. We've got the blockchain and we have the IPFS way to handle these things too. I'm hoping at some point blockchain DNS systems are adopted by mainstream (or niche in case of Tor) vendors. It would make it so much much easier to name onions.

amelius 9y ago
How fast/convenient is Tor for downloading large files, like video (e.g. via Bittorrent)? PS: It seems that Bittorrent over Tor is a bad idea, [1]. [1] https://blog.torproject.org/bittorrent-over-tor-isnt-good-idea https://blog.torproject.org/bittorrent-over-tor-isnt-good-id...
- amingilani 9y ago
  It's a really bad idea. I used to stream, though. Which was fine.
- devrandomguy 9y ago
  In Qatar, which has a national firewall, I was able to use Tor to browse torrent sites, and then use a regular bittorrent client to fetch the contents of the magnet links (encrypted connections only). That worked great for the few years that I was there. The Qatari internet was a fair bit faster than what I am used to from Canada, about 30 - 50 MB/s at max torrent.
  - Teapot 9y ago
    Worth trying Tribler. Seems it's Torrent traffic inside its own Tor network. https://en.wikipedia.org/wiki/Tribler https://en.wikipedia.org/wiki/Tribler

hannaysteve 9y ago

The article is really interesting and valid.

nikcub 9y ago

If you are looking for a practical use of hidden services: we use them as ingress for Docker and K8 management. You start a container that runs just tor with a config and can read the routing endpoints from your config, or link to localhost:2375 HiddenServicePort <onion port> <host>:<port> You setup HiddenServiceAuthorizeClient with stealth auth type and a list of authorized clients. You can lock your firewall rules down as the hidden service only requires outbound to HTTPS. On the client end you setup regular Tor with HidServAuth <onion address> <auth-cookie> With stealth auth other tor users won't see the serivce and port published without the auth cookie You can then use socat to bind the remote hidden service and port to a local host and port: socat tcp-l:127.0.0.1:2023,fork socks4a:onionaddr.onion:localhost:23,proxyport=9050 You then have the remote ssh server available locally with no public interfaces, no public ports, and an additional layer of confidentiality and authentication

SoreGums 9y ago
Awesome, this is what I had in mind for using a stealth way to manage infrastructure. Thanks for sharing a blueprint as I'd only theorycrafted it and now I have a path to experiment with.
ynezz 9y ago
> additional layer of confidentiality and authentication and additional layers of attack surfaces
- belorn 9y ago
  From a IT Security Assessment, what would those be and their associated risk and impact factors? One would naturally be the onion address. If they could break the 1024 bit RSA key, they could hijack the name. Risk of this happening: very low. Impact: massive especially outside the realm of tor. Any additional risks you were thinking about? Backdoors in tor project? Hardware malware specifically designed for tor (rather than than being general)?
  - Ajedi32 9y ago

jstanley 9y ago

> And finally from the casuals user's PoV, the only thing that changes is that new onions are bigger, tastier and they now look like this: 7fa6xlti5joarlmkuhjaifa47ukgcwz6tfndgax45ocyn4rixm632jid.onion. For more information on the nitty-gritty details, please check out our technical specification. It's a shame they don't have a description for technical users. I'm more interested than "bigger, tastier, and looks like this", but less interested than 13000 words of specification.

dmix 9y ago
The problem with a lot of these open source projects is that you're usually so exhausted trying to get the release out you don't have much energy in explaining them! (As these types of things require developer involvement) But agreed. This is basically offering a paragraph long abstract or read the massive white paper, without much in between.
asn_tor 9y ago
Hey there, Tor developer here. You are right there is no middle ground there. I'm kind of on the run right now, so I can't write a big explanation here. However check this section of the proposal that presents some high-level improvements: https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt#n126 https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.... peace
dublinben 9y ago
TL;DR of that change is that they've moved from a truncated SHA1 hash to SHA3/ed25519/curve25519. For more detail, here's their own summary from the technical specification: Here is a list of improvements of this proposal over the legacy hidden services: a) Better crypto (replaced SHA1/DH/RSA1024 with SHA3/ed25519/curve25519) b) Improved directory protocol leaking less to directory servers. c) Improved directory protocol with smaller surface for targeted attacks. d) Better onion address security against impersonation. e) More extensible introduction/rendezvous protocol. f) Offline keys for onion services g) Advanced client authorization

flyGuyOnTheSly 9y ago

>Get in touch if you'd like to sponsor us to work on onion services to make them faster, slower, or stabler. That's a strange comment. Why would they accept money to make the TOR system slower?