4 ms·

I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be a

I have mixed feelings about Tor. As a proxy to hide your IP address it makes perfect sense to me. But what's the end result of hidden services? I want to be anonymous sometimes but I can't think of a time when I want the host of a service I use to be anonymous. In most situations their identity is actually important to me. I want to know the source of news, to trust that I'm sending a message to the right person, to trust that I'm not relying on a site run by some kid in her parents basement. And I know that legitimate sites can get certs for onions these days (like facebook)... But doesn't that defeat the original purpose of running a hidden service if the purpose is to hide the owner?

the_stc 9y ago
My company (details in profile) relies on Tor. We help people, but governments would like to shut us down. We actually will expose everything via a non .onion, then proxy it to our HS (SSL term done on the hidden service). We'll expose via .onion as well and get a cert. We are hoping with HS v3 the rules will relax. For now, Digicert told us they were not going to issue any more. Maybe if we push.
- deleted 9y ago
  [deleted]
anamexis 9y ago
There is another purpose, because when you access a hidden service, you are not using an (unknown, untrustable) exit node – instead, your data remains entirely encrypted until it reaches the owner of the address.
- wybiral 9y ago
  That's a valid point. Thanks for bringing that up. So now I have a private channel to that address and I don't have to worry about the exit nodes (unlike when I use Tor for clearnet sites). But now how do I know that I can trust the owner of that onion?
  - zAy0LfpBZLC8mAC 9y ago
    How do you know that you can trust the owner of any domain? How can you trust anyone? That's a deep philosophical question but doesn't really have anything to do with the technology you are using?
    - wybiral 9y ago
      Reputation is a typical force in society. Businesses might want to do malicious things but the fear of destroying their identity helps to keep them in line. Personally I trust something more when someone puts their reputation on the line for it.
      - zAy0LfpBZLC8mAC 9y ago
        Well, yeah, sure ... so how would that be any different with tor hidden services?
      - nikcub 9y ago
        Reputation is also a force in onion land. There are hidden services that are trusted and those that aren't. You see it with the drug marketplaces - users self-organize a distributed reputation system that tells other users which sites can be trusted with bitcoin and drug transactions and which cannot. It's a remarkably well functioning and resilient system - and its hosted across reddit, forums, blogs, etc.
  - hedora 9y ago
    Maybe you know the owner personally, and obtained the onion address in person.
azernik 9y ago
Tor hides the identity of the service provider to third-party eavesdroppers. You might know someone and have gotten the onion address of a file upload server from them, but not want the government or your ISP to know who you're talking to. It also hides the a service provider's physical location (well, their IP address and hence location in the network graph) from even a user that knows their identity. You might know that I am an investigative journalist you're trying to send information to - or, given the origin or Tor, maybe you're a spy and you know I'm your handler - but I don't want to give away my location. There are also a lot of use cases where the user doesn't care that much about knowing who the service provider is, and the service provider cares a lot about hiding their identity (enough so that they would not provide the service if they could not be anonymous). For the example of, say, political commentary - often what you care about there is less the real-world identity of a person, and more their persistent identity and reputation. On the other side of the equation, though, in some environments people might not feel safe expressing their opinions at all if those opinions could be traced back to them.
- zAy0LfpBZLC8mAC 9y ago
  To add to that, one useful application for hidden services is to enable SSH login on machines that are behind some impenetrable NATs/firewalls that you can't open up for inbound connections. Have a machine behind mobile, NAT only internet? Set up a tor hidden service and log in without any problems!
  - unsignedint 9y ago
    I use this in conjunction with Auth to use as low speed VPN to access home resources, and also for IRC gateway. No port fowarding configured!
  - wybiral 9y ago
    I see this as a valid point. You don't need Tor for that, any local app could proxy a connection that way. But, yes, it is a useful side effect of Tor.
    - 9y ago
wyager 9y ago
You can have cryptographically anchored pseudonymous trust, which is what Tor does. In many ways it’s stronger than the kinds of trust you run into normally.
- wybiral 9y ago
  You still have to get a correct onion address from a reputable source otherwise how do you know that you're going to the right onion and not a malicious mirror or something? So somehow there is a chain of trust, not too unlike the traditional PKI model.
  - zAy0LfpBZLC8mAC 9y ago
    What would be the "correct onion address" for 3fyb44wdhnd2ghhl.onion?
    - hedora 9y ago
      That is the “correct onion address” for that hashcode, but you have to obtain the hashcode somehow.
      - wybiral 9y ago
        And you might be obtaining a fake link from one of my phishing schemes that mimic the services you thought you were visiting...
        c22 9y ago
        No one is arguing that onion links are impervious to being lied about. But domain names don't have that property either. In fact, it's somewhat easier to compromise many domain names.
      - zAy0LfpBZLC8mAC 9y ago
        Well, yes, obviously, in order to know something you have to know it!? What I don't understand is what any of that has to do with any sort of "correctness"?! How do you find out the correct name of James Miller? How do you find out the correct domain of google.com? That just seems like a set of nonsensical questions to me.
forgotmypw 9y ago
>But what's the end result of hidden services? It's not just hidden, it's also decentralized. You can: * Register and publish a site in seconds ... * ... without a central registar (just generate a key) ... * ... from just about any Internet connection. * Get a secure transport without the clusterfuck of backdoors that is HTTPS. * All for a concentrated audience that likes a different, simpler, smaller, homier Web.
herbst 9y ago
Whistleblower drops for example. In case of Facebook the point is that some countries forbid access to Facebook and those can easily just use Tor now.
belorn 9y ago
With the new protocol you could use it to protect IOT services, which identity you would naturally know but no one else would. A security camera for example. An other use case would be access to a server IPMI/Online KVM switch, which has a tendency to not get updated regularly. In general any situation where you in the past had to go through a third-party hub could be replaced with a hidden service for a end-to-end solution, as long latency isn't a major requirement.

the_stc 9y ago

My company (details in profile) relies on Tor. We help people, but governments would like to shut us down. We actually will expose everything via a non .onion, then proxy it to our HS (SSL term done on the hidden service). We'll expose via .onion as well and get a cert. We are hoping with HS v3 the rules will relax. For now, Digicert told us they were not going to issue any more. Maybe if we push.

deleted 9y ago
[deleted]

anamexis 9y ago

There is another purpose, because when you access a hidden service, you are not using an (unknown, untrustable) exit node – instead, your data remains entirely encrypted until it reaches the owner of the address.

wybiral 9y ago
That's a valid point. Thanks for bringing that up. So now I have a private channel to that address and I don't have to worry about the exit nodes (unlike when I use Tor for clearnet sites). But now how do I know that I can trust the owner of that onion?
- zAy0LfpBZLC8mAC 9y ago
  How do you know that you can trust the owner of any domain? How can you trust anyone? That's a deep philosophical question but doesn't really have anything to do with the technology you are using?
  - wybiral 9y ago
    Reputation is a typical force in society. Businesses might want to do malicious things but the fear of destroying their identity helps to keep them in line. Personally I trust something more when someone puts their reputation on the line for it.
    - zAy0LfpBZLC8mAC 9y ago
      Well, yeah, sure ... so how would that be any different with tor hidden services?
    - nikcub 9y ago
      Reputation is also a force in onion land. There are hidden services that are trusted and those that aren't. You see it with the drug marketplaces - users self-organize a distributed reputation system that tells other users which sites can be trusted with bitcoin and drug transactions and which cannot. It's a remarkably well functioning and resilient system - and its hosted across reddit, forums, blogs, etc.
- hedora 9y ago
  Maybe you know the owner personally, and obtained the onion address in person.

azernik 9y ago

Tor hides the identity of the service provider to third-party eavesdroppers. You might know someone and have gotten the onion address of a file upload server from them, but not want the government or your ISP to know who you're talking to. It also hides the a service provider's physical location (well, their IP address and hence location in the network graph) from even a user that knows their identity. You might know that I am an investigative journalist you're trying to send information to - or, given the origin or Tor, maybe you're a spy and you know I'm your handler - but I don't want to give away my location. There are also a lot of use cases where the user doesn't care that much about knowing who the service provider is, and the service provider cares a lot about hiding their identity (enough so that they would not provide the service if they could not be anonymous). For the example of, say, political commentary - often what you care about there is less the real-world identity of a person, and more their persistent identity and reputation. On the other side of the equation, though, in some environments people might not feel safe expressing their opinions at all if those opinions could be traced back to them.

zAy0LfpBZLC8mAC 9y ago
To add to that, one useful application for hidden services is to enable SSH login on machines that are behind some impenetrable NATs/firewalls that you can't open up for inbound connections. Have a machine behind mobile, NAT only internet? Set up a tor hidden service and log in without any problems!
- unsignedint 9y ago
  I use this in conjunction with Auth to use as low speed VPN to access home resources, and also for IRC gateway. No port fowarding configured!
- wybiral 9y ago
  I see this as a valid point. You don't need Tor for that, any local app could proxy a connection that way. But, yes, it is a useful side effect of Tor.
  - 9y ago

wyager 9y ago

You can have cryptographically anchored pseudonymous trust, which is what Tor does. In many ways it’s stronger than the kinds of trust you run into normally.

wybiral 9y ago
You still have to get a correct onion address from a reputable source otherwise how do you know that you're going to the right onion and not a malicious mirror or something? So somehow there is a chain of trust, not too unlike the traditional PKI model.
- zAy0LfpBZLC8mAC 9y ago
  What would be the "correct onion address" for 3fyb44wdhnd2ghhl.onion?
  - hedora 9y ago
    That is the “correct onion address” for that hashcode, but you have to obtain the hashcode somehow.
    - wybiral 9y ago
      And you might be obtaining a fake link from one of my phishing schemes that mimic the services you thought you were visiting...
      - c22 9y ago
        No one is arguing that onion links are impervious to being lied about. But domain names don't have that property either. In fact, it's somewhat easier to compromise many domain names.
    - zAy0LfpBZLC8mAC 9y ago
      Well, yes, obviously, in order to know something you have to know it!? What I don't understand is what any of that has to do with any sort of "correctness"?! How do you find out the correct name of James Miller? How do you find out the correct domain of google.com? That just seems like a set of nonsensical questions to me.

forgotmypw 9y ago

>But what's the end result of hidden services? It's not just hidden, it's also decentralized. You can: * Register and publish a site in seconds ... * ... without a central registar (just generate a key) ... * ... from just about any Internet connection. * Get a secure transport without the clusterfuck of backdoors that is HTTPS. * All for a concentrated audience that likes a different, simpler, smaller, homier Web.

herbst 9y ago

Whistleblower drops for example. In case of Facebook the point is that some countries forbid access to Facebook and those can easily just use Tor now.

belorn 9y ago

With the new protocol you could use it to protect IOT services, which identity you would naturally know but no one else would. A security camera for example. An other use case would be access to a server IPMI/Online KVM switch, which has a tendency to not get updated regularly. In general any situation where you in the past had to go through a third-party hub could be replaced with a hidden service for a end-to-end solution, as long latency isn't a major requirement.