5 ms·

> ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion How does one store links like this? You'd need a bookmark file, which would sort of give the g

> ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion How does one store links like this? You'd need a bookmark file, which would sort of give the game away, I'd have thought. How do you make sure you notice when you visit a URL with the same readable prefix?

cyphar 7y ago
This is an unfortunate downside of onion URLs and a restriction imposed by Zooko's triangle (the CAP theorem of naming systems)[1]. One possible solution would be to issue a TLS certificates for both the clear-web and .onion domain (for services which are offering .onion services to provide better anonymity for users not their servers). Unfortunately, the CAB forum has decided to not allow this -- only EV certificates can be issued for .onion services so you can't use LetsEncrypt for this. [1]: https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle
- tgragnato 7y ago
  I was looking for the name of the CAP theorem, thanks for posting this! HN discussed (https://news.ycombinator.com/item?id=14038013 https://news.ycombinator.com/item?id=14038013) about the issue and the post (https://blog.torproject.org/cooking-onions-names-your-onions https://blog.torproject.org/cooking-onions-names-your-onions) outlines some of the ways in which you can mitigate right now. Cloudflare is using the 'alt-svc' header (https://blog.cloudflare.com/cloudflare-onion-service/ https://blog.cloudflare.com/cloudflare-onion-service/).. The CIA is not, I'd have loved it. curl -I https://www.cia.gov/index.html https://www.cia.gov/index.html HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: text/html ETag: "<>" Last-Modified: Tue, 28 May 2019 15:05:25 GMT Content-Length: <> ID: <> SESSION: <> Date: Thu, 30 May 2019 12:36<> GMT Connection: keep-alive Set-Cookie: _session_=<>; path=/; domain=cia.gov; secure; HttpOnly ID: <> SESSION: <>
  - kodablah 7y ago
    > Cloudflare is using the 'alt-svc' header [...] The CIA is not, I'd have loved it. It should be noted that alt-svc is an HTTP header returned which means you have first made an HTTP request before the onion request which affects anonymity. It's not a big deal over Tor because that HTTP call is on an exit node, but still should be noted.
abstractbarista 7y ago
That's sort of the point, since it's actually generated from a public key that the operator holds [1]. Once you have confirmed a domain is correct, you should save it yourself, and only access that saved link. Using any forums/wikis/search to find onion links (may) leave you with stolen credentials or a hacked machine. It's cumbersome for sure, but the beauty is it's self-authenticating. Don't forget to turn off JS. :) [1] https://trac.torproject.org/projects/tor/wiki/doc/HiddenServiceNames https://trac.torproject.org/projects/tor/wiki/doc/HiddenServ...
GordonS 7y ago
Password safe seems like a good idea, especially since you'll quote likely want to store credentials for the site anyway.
- peteretep 7y ago
  Yeah, fair enough. I guess I'd feel like that removes any deniability though, where you can remember credentials.
- dredmorbius 7y ago
  Rubber hose.
  - GordonS 7y ago
    Surely that's pretty much valid regardless of how you store them?
    - dredmorbius 7y ago
      Consider the case of carrying electronics (or storage) vs. shipping them, crossing borders, and implications for inspection. If it's not on you, they can't beat it out of you. Of course, they might decide to beat you anyway. Which raises the question of whether it's strong crypto or rule of law that matters more. I'm not sure which way I come dwn on that myself, though could argue for bits of both.
hanniabu 7y ago
Would be cool if there were QR code-like images but with a sliced onion and it uses the pattern of the veins to decrypt it.
smacktoward 7y ago
I guess ciawtfbbq.onion was already taken?
deftnerd 7y ago
This doesn't quite answer your question, but it's similar enough that you might find it interesting. Cloudflare offers their DNS-over-https service at an onion address. In their documentation, they say: " Protip: if you ever forget the dns4torblahblahblah.onion address, you can simply use cURL: curl -sI https://tor.cloudflare-dns.com https://tor.cloudflare-dns.com | grep alt-svc alt-svc: h2="dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:443"; ma=315360000; persist=1 " It's a clever way, and standards-compliant, to distribute alternate onion addresses for existing services. What I don't know is if Tor Browser Bundle has support for this natively, where if you visit tor.cloudflare-dns.com and it'll look for the alt-svc record and redirect you automatically to the onion address. If it does, then you can just bookmark the regular URL knowing that you'll be redirected.
phw 7y ago
We used an online survey to study this, and some other questions: https://nymity.ch/onion-services/ https://nymity.ch/onion-services/ Figure 10 shows that most users (52%) use bookmarks, followed by locally-saved text files (37%), and referral to trusted web pages (35%). Also, lots of people find themselves unable to determine an onion service's legitimacy (Figure 12), which is why phishing attacks are successful. We document one such attack in Section 5.1 of another research paper: https://nymity.ch/sybilhunting/pdf/sybilhunting-sec16.pdf https://nymity.ch/sybilhunting/pdf/sybilhunting-sec16.pdf
pontifier 7y ago
When I first started using tor, I suddenly had a realisation that I didn't know what sites to trust. I found a link to the hidden wiki, but could I really trust what they were telling me? Was the link to a silk road clone a legit site? The site seemed to work, but maybe the link was a man-in-the-middle attack. What can you do when there is no central DNS to trust. I suddenly felt that I couldn't trust anything at all. I started to question those around me and spiraled into existential philosophical crisis of truth testing even my own senses. I eventually found a real solution, but I'm on mobile and don't feel like typing the whole thing out.

cyphar 7y ago

This is an unfortunate downside of onion URLs and a restriction imposed by Zooko's triangle (the CAP theorem of naming systems)[1]. One possible solution would be to issue a TLS certificates for both the clear-web and .onion domain (for services which are offering .onion services to provide better anonymity for users not their servers). Unfortunately, the CAB forum has decided to not allow this -- only EV certificates can be issued for .onion services so you can't use LetsEncrypt for this. [1]: https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle

tgragnato 7y ago
I was looking for the name of the CAP theorem, thanks for posting this! HN discussed (https://news.ycombinator.com/item?id=14038013 https://news.ycombinator.com/item?id=14038013) about the issue and the post (https://blog.torproject.org/cooking-onions-names-your-onions https://blog.torproject.org/cooking-onions-names-your-onions) outlines some of the ways in which you can mitigate right now. Cloudflare is using the 'alt-svc' header (https://blog.cloudflare.com/cloudflare-onion-service/ https://blog.cloudflare.com/cloudflare-onion-service/).. The CIA is not, I'd have loved it. curl -I https://www.cia.gov/index.html https://www.cia.gov/index.html HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: text/html ETag: "<>" Last-Modified: Tue, 28 May 2019 15:05:25 GMT Content-Length: <> ID: <> SESSION: <> Date: Thu, 30 May 2019 12:36<> GMT Connection: keep-alive Set-Cookie: _session_=<>; path=/; domain=cia.gov; secure; HttpOnly ID: <> SESSION: <>
- kodablah 7y ago
  > Cloudflare is using the 'alt-svc' header [...] The CIA is not, I'd have loved it. It should be noted that alt-svc is an HTTP header returned which means you have first made an HTTP request before the onion request which affects anonymity. It's not a big deal over Tor because that HTTP call is on an exit node, but still should be noted.

abstractbarista 7y ago

That's sort of the point, since it's actually generated from a public key that the operator holds [1]. Once you have confirmed a domain is correct, you should save it yourself, and only access that saved link. Using any forums/wikis/search to find onion links (may) leave you with stolen credentials or a hacked machine. It's cumbersome for sure, but the beauty is it's self-authenticating. Don't forget to turn off JS. :) [1] https://trac.torproject.org/projects/tor/wiki/doc/HiddenServiceNames https://trac.torproject.org/projects/tor/wiki/doc/HiddenServ...

GordonS 7y ago

Password safe seems like a good idea, especially since you'll quote likely want to store credentials for the site anyway.

peteretep 7y ago
Yeah, fair enough. I guess I'd feel like that removes any deniability though, where you can remember credentials.
dredmorbius 7y ago
Rubber hose.
- GordonS 7y ago
  Surely that's pretty much valid regardless of how you store them?
  - dredmorbius 7y ago
    Consider the case of carrying electronics (or storage) vs. shipping them, crossing borders, and implications for inspection. If it's not on you, they can't beat it out of you. Of course, they might decide to beat you anyway. Which raises the question of whether it's strong crypto or rule of law that matters more. I'm not sure which way I come dwn on that myself, though could argue for bits of both.

hanniabu 7y ago

Would be cool if there were QR code-like images but with a sliced onion and it uses the pattern of the veins to decrypt it.

smacktoward 7y ago

I guess ciawtfbbq.onion was already taken?

deftnerd 7y ago

This doesn't quite answer your question, but it's similar enough that you might find it interesting. Cloudflare offers their DNS-over-https service at an onion address. In their documentation, they say: " Protip: if you ever forget the dns4torblahblahblah.onion address, you can simply use cURL: curl -sI https://tor.cloudflare-dns.com https://tor.cloudflare-dns.com | grep alt-svc alt-svc: h2="dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:443"; ma=315360000; persist=1 " It's a clever way, and standards-compliant, to distribute alternate onion addresses for existing services. What I don't know is if Tor Browser Bundle has support for this natively, where if you visit tor.cloudflare-dns.com and it'll look for the alt-svc record and redirect you automatically to the onion address. If it does, then you can just bookmark the regular URL knowing that you'll be redirected.

phw 7y ago

We used an online survey to study this, and some other questions: https://nymity.ch/onion-services/ https://nymity.ch/onion-services/ Figure 10 shows that most users (52%) use bookmarks, followed by locally-saved text files (37%), and referral to trusted web pages (35%). Also, lots of people find themselves unable to determine an onion service's legitimacy (Figure 12), which is why phishing attacks are successful. We document one such attack in Section 5.1 of another research paper: https://nymity.ch/sybilhunting/pdf/sybilhunting-sec16.pdf https://nymity.ch/sybilhunting/pdf/sybilhunting-sec16.pdf

pontifier 7y ago

When I first started using tor, I suddenly had a realisation that I didn't know what sites to trust. I found a link to the hidden wiki, but could I really trust what they were telling me? Was the link to a silk road clone a legit site? The site seemed to work, but maybe the link was a man-in-the-middle attack. What can you do when there is no central DNS to trust. I suddenly felt that I couldn't trust anything at all. I started to question those around me and spiraled into existential philosophical crisis of truth testing even my own senses. I eventually found a real solution, but I'm on mobile and don't feel like typing the whole thing out.