12 ms·

MoreOnionsPorfavor: Onionize your website and take back the internet

248 points by worldofmatthew 6y ago

woofie11 6y ago
I want a short HOWTO linked from this article.
- MattGaiser 6y ago
  I would love to do this for my personal site. Not sure if I am willing to spend 4 hours on figuring it out though.
  - clashmeifyoucan 6y ago
    I did it for my personal site, and it wasn't too hard, I personally didn't have as much experience with nginx and stuff back then but if I were to set one up now I feel I'd be done in under 30m complete with a vanity url.
- clashmeifyoucan 6y ago
  from the article: https://community.torproject.org/onion-services/setup/ https://community.torproject.org/onion-services/setup/
- 0xggus 6y ago
  Just follow the guide below and ping us on IRC (irc.oftc.net #tor) if you have issues: https://community.torproject.org/onion-services/advanced/onion-location/ https://community.torproject.org/onion-services/advanced/oni... IRC help: https://support.torproject.org/get-in-touch/irc-help/ https://support.torproject.org/get-in-touch/irc-help/
daenz 6y ago
I'm pro decentralizing the internet, but these movements really need some marketing chops. ".onion" TLD? (Yes I know it has been around for awhile) Think of how a normal person will view a ".onion" domain name. It's nonsensical to the uninitiated.
- eindiran 6y ago
  Increasingly there are full word TLDs (see here: [0]), so I don't think people will find it that weird, especially since most people don't really spend a lot of time looking at the address bar. The .onion TLD is named for onion routing[1] and has been around for quite a while as you pointed out. If it caught on, I imagine most people would accept the name without much thought. I think the bigger barrier to .onion catching on is getting people to install Tor at all. [0] https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains https://en.wikipedia.org/wiki/List_of_Internet_top-level_dom... [1] https://en.wikipedia.org/wiki/Onion_routing https://en.wikipedia.org/wiki/Onion_routing
- solstice 6y ago
  What about http, ://, www and other TLDs like .co.nz or .ac.uk? All of these were pretty meaningless to initiates of the internet. In this new age of ".pizza" and suchlike, ".onion" doesn't seem much different or weird tbh. (To be clear: I don't think these new tlds are especially good either, but it's the world we live in now.)
  - macintux 6y ago
    To me, .onion reminds me too much of The Onion.
    - CarbyAu 6y ago
      Exactly what I thought the title of the article meant. I thought it was going to be some random "AI" project that could rewrite your prose in The Onion humour ala: https://www.theonion.com/fuck-everything-were-doing-five-blades-1819584036 https://www.theonion.com/fuck-everything-were-doing-five-bla...
    - gigama 6y ago
      The Onion really needs an .onion site.
      - johntash 6y ago
vitejose 6y ago
I operate a few websites that host static content only. Is there any benefit to setting up onion services for these sites? Or are onion services more valuable for providing interactivity/logins?
- danielheath 6y ago
  If the data might be subject to censorship or spying, yes - using an onion service protects users from having info like “you read about STI treatment” sold to their insurers.
- vitejose 6y ago
  This is basically what I was wondering: https://news.ycombinator.com/item?id=23776045 https://news.ycombinator.com/item?id=23776045
surround 6y ago
What’s the advantage of accessing an onion service (as opposed to accessing a normal https website over tor)?
- ve55 6y ago
  The website cannot identify who they are, what ISP they use, or where they live. Similarly, middleboxes such as their ISP cannot find out what websites they are browsing, which is still easily possible even with TLS via many methods (DNS, SNI, IP correlation, many others)
  - surround 6y ago
    What I mean is, how is a .onion website over tor better than an https website over tor? I edited my comment to clarify.
    - threentaway 6y ago
      The traffic never leaves the Tor network. This has a few advantages: * You don't need a TLS certificate from a public certificate authority, as it is already encrypted end to end * The exit node cannot attempt to snoop on your traffic (via TLS SNI) or inject content/ads/exploits into your unencrypted traffic * It reduces load on the exit nodes so they can work on serving traffic to sites that don't have an .onion endpoint
      - surround 6y ago
        If certificate authorities are a concern, then why do some onion services use https?
        danielheath 6y ago
        If I had to guess, it’d be because TOR users are not a solid block with identical opinions.
        6y ago
mark_l_watson 6y ago
I am tempted to onionize my site for political (if that is the correct word) reasons. I am almost done reading The Surveillance Economy and it feels like almost an obligation to push back. (Using ProtonMail, use a large leased server in Germany at Hetzner for my routine work and writing, and using private browsing tabs when I must use Twitter or Reddit.) It looks like Onion domain hosting services are $5-$8/month, but going through their checklist and making one of my VPSs approved would be educational.
- zelly 6y ago
  > It looks like Onion domain hosting services are $5-$8/month You don't need a special host. You just need to run Tor and connect to the network.
  - Nextgrid 6y ago
    Running an Tor Hidden Service doesn't require a specific host. As far as I know the traffic it generates will not be malicious. You only need to worry about malicious traffic and Tor-friendly ISPs if you plan to run an exit node (and at this point you need to consider the legal implications as well). Furthermore if you are not hosting any illegal/objectionable content and don't need to hide from law enforcement or state-sponsored attackers, a lot of the security concerns around anonymizing the server no longer apply either.
- jsf01 6y ago
  Using a centralized service which, ultimately, you have to take at their word seems to me like it should not be necessary in this age of trustless networks and innovation in decentralized technology. Speaking in particular about ProtonMail here. Are there any email services that are provably private?
  - lend000 6y ago
    Frankly this is one of the few non-financial areas where blockchain-like technologies make sense: anonymously creating and routing connections. Right now, you can encrypt the contents of your email, but there is no hiding who is the recipient and who is the sender, certainly not from the mail service on either end. Until you solve that problem (for example, by posting encrypted versions on a public blockchain), you never get a truly end-to-end secure communication channel.
neilv 6y ago
I tried this feature of Tor Browser, using the first example I saw in TFA (www.propublica.org)... and was surprised to see that the .onion equivalent of the www.propublica.com home page... tried to make requests to third-party non-.onion cross-site surveillance trackers. google.com/recaptcha connect.facebook.net static.chartbeat.com ak.sail-horizon.com pi.pardot.com htlbid.com A separate concern, besides this choice of example, is why ProPublica is normally helping to leak the identities and intimate browsing behavior of people who visit their site, to some of the most powerful and invasive corporations, given this mission: > ProPublica is an independent, nonprofit newsroom that produces investigative journalism with moral force. We dig deep into important issues, shining a light on abuses of power and betrayals of public trust — and we stick with those issues as long as it takes to hold power to account.
- corty 6y ago
  To be safe one should disable JavaScript and most if not all third-party requests on .onion sites. Thats why TorBrowser always includes NoScript. Unfortunately in an unsafe default configuration that allows too much. So overall, I guess this move isn't intended to protect the masses but provide more cover traffic mainly.
- gowld 6y ago
  Because not everyone solves every problem in the world simultaneously.
isaack 6y ago
CloudFlare had a much more elegant solution: the Alt-Svc HTTP header [1]. It is entirely transparent to the user. Security is guaranteed because it uses the original SSL/TLS certificate for exchange (that is, on top of the usual safety guarantees provided by a Tor hidden service). Sadly they stopped doing that a while ago [2]. If anyone has insider knowledge about the reason behind, I would be really interested to hear about it. [1]: https://blog.cloudflare.com/cloudflare-onion-service/ https://blog.cloudflare.com/cloudflare-onion-service/ [2]: https://community.cloudflare.com/t/tor-alt-svc-header-not-being-sent/113222 https://community.cloudflare.com/t/tor-alt-svc-header-not-be...
- cypherpunks3 6y ago
  Cloudflare is still using the Alt-Svc HTTP header. Use Ctrl+Shift+J to see the 'Browser Console' which contains logs in the form "Alternate Service Mapping found: https://blog.cloudflare.com:-1 https://blog.cloudflare.com:-1 to https://cflaresuje2rb7w2u3w43pn4luxdi6o7oatv6r2zrfb5xvsugj35d2qd.onion:443" https://cflaresuje2rb7w2u3w43pn4luxdi6o7oatv6r2zrfb5xvsugj35.... Cloudflare only sends the header to clients it detects as Tor Browser. If you have tweaked your config or are running an older version, it may not detect correctly. Even if it had previously worked. This technique is not "better than" the "Onion-Location" approach. They complement well. Use the 'Alt-Svc' header for all users with Tor Browser's user agent and send "Onion-Location" to all users. If a user decides to opt for the .onion address, they can. But they don't have to.
- charliebrownau 6y ago
  CloudFlare censors Not a valid solution
- buildbuildbuild 6y ago
  It’s so transparent that Tor Browser users cannot actually tell if Cloudflare’s Alt-Svc “Onion Routing” is actually working. Try to determine how your traffic was routed while browsing a site with Alt-Svc enabled. A user should plainly know if _any_ traffic exited the Tor network and that is not always the case. (See mixed content on most HS mirrors of major sites like NYTimes)
lexicon0 6y ago
I'm in charge of a security for a reasonable sized company. I generally support the Tor project and the goals of having a surveillance free internet. However - if an employee would install tor browser or use tor on a company device, or a device attached to the company network, they would be fired immediately. I would then refer them to law enforcement after conducting a forensic audit. Should you make your site only available via onion routing, or primarily available on onion routing, all workplaces will immediately block access and look at anyone who accesses with great incredulity
- tomrod 6y ago
  Naive question, as I am not a security professional. Why?
  - coolspot 6y ago
    In some businesses it is important that all employee communications are captured and can be inspected in case there is suspicion of IP or customer data theft. For example in a hospital, there is no good reason for employee to use Tor on work computer.
    - Reelin 6y ago
      That's an excellent example but I'd point out that in any such scenario devices ought to be thoroughly locked down and run strictly audited environments. If properly configured you wouldn't be firing an employee for using Tor but instead for maliciously tampering with company hardware.
    - toyg 6y ago
      > in a hospital, there is no good reason for employee to use Tor on work computer. I would argue that hospitals and other public settings are actually more in need of higher privacy in electronic communications. Imagine a physician working on, say, Scarlett Johansson's health issues; he periodically sends this data to the specialist that will run some test, and a creepy sysadmin finds out. Should he be able to MITM those comms, and resell the info to newspapers (or worse)...? Nope; the physician should have perfect privacy from network operators.
atroche 6y ago
Why haven't we seen a pay-for-use version of Tor yet? The network won't scale unless exit and relay nodes are incentivized with value beyond warm-fuzzies.
- yjftsjthsd-h 6y ago
  How would that work without killing the privacy angle?
  - hirako2000 6y ago
    Monero/zcash
Santosh83 6y ago
In this context OnionShare (https://onionshare.org/ https://onionshare.org/) is an excellent program that even non-technical people can use to either share files or even complete static websites over Onion routing. The main advantage is you don't need to grub around with Nginx, Apache and the Tor daemon manually setting everything up.
- cryo 6y ago
  OnionShare rocks: Tor hidden services are excellent for that purpose and provide a decentralized alternative for cloud based apps. What I love about them is also that it works in in tricky NAT situations where WebRTC struggles. My file manager "cryo" also uses Tor hidden services for signaling without a central server to initiate peer-to-peer connections. https://cryonet.io https://cryonet.io
onli 6y ago
So let's say I run a few websites and do support the idea. I read that article and think "I should setup an .onion version of my site and then point to that". The article points to https://community.torproject.org/onion-services/setup/ https://community.torproject.org/onion-services/setup/ - and I'm immediately lost. Setup a local webserver? Why would I need that? The documentation mentions that I have to configure the webserver correctly, but offers no details about that whatsoever. So that's not a good start. https://community.torproject.org/onion-services/advanced/onion-location/ https://community.torproject.org/onion-services/advanced/oni... works better, it shows the configuration, but assumes there is already an .onion address and does not point to documentation how to set it up. Hey, I know documentation is hard. But this could be improved a lot. By now I figured out that I'd have to install Tor on the server (not my machine, as the docs stated), find the torrc (the documentation has to mention where it is), point to the localhost port active of the webserver, the .onion address is autogenerated (so this will be an unreadable mess?) and can be taken from a file the tor software generates. And this: > We're not going to cover how to set up a web server here. If you get stuck or want to do more, find a friend who can help you. We recommend you install a new separate web server for your onion service. Just cut it out. I'm actually lucky enough to have friends that could help me with this, but what if I hadn't? Cover in the documentation what needs to be done, or at the very least don't show an attitude about it.
- deleted 6y ago
  [deleted]
- nyolfen 6y ago
  it's possible they're trying to avoid a monoculture of web servers that serve tor sites in order to avoid many sites becoming insecure in the event of a bug disclosure for a software package they have no control over
- caymanjim 6y ago
  They're not a tech support company or a hosting company. There are literally thousands and thousands of documents on basic web server installation and configuration already written. The information is trivial to find. It falls under "if you have to ask, you're not ready".
shp0ngle 6y ago
I remember, in 2014, Facebook started to be available on Tor, and people speculated that there will be a wave of popular websites being offered on Torspace. Nothing came of this "wave", if I'm not wrong, right. https://en.wikipedia.org/wiki/Facebookcorewwwi.onion https://en.wikipedia.org/wiki/Facebookcorewwwi.onion edit: and it seems down to me right now. edit2: it works... but slower, than just going to regual HTTPS version with Tor. Which makes sense, because it needs to hop more. edit3: .... but it doesn't let me log in, as I am logging from "suspicious location".
- glenneroo 6y ago
  I still use Facebook via Tor quite often, even though it's barely usable - loading anything takes between 3 and infinite seconds (i.e. never loads, requiring multiple refreshes). I use it to let them know that people still use it, with the hopes that they don't even remove it. I don't have this problem with other Tor sites, so it leads me to believe they want to be able to advertise it as "we offer this because we care" while making it nearly unusable to the point that nobody will use it. It's very similar to the secure chat feature, which they continually move deeper and deeper into menus, each move progressively more difficult to find. They just yesterday enabled the new "layout", and I can't even find the secure chat feature anymore, they either buried it so deep or removed it entirely?
glenneroo 6y ago
I'm not sure how relevant this is to running your website on the "darknet", but a potential warning for future Tor service operators: I ran a TOR relay for about a year, eventually even ordering a static IP for 5€/month. One random day, I was unable to log into my online banking, receiving some obscure error code. After digging around and finally contacting the bank, they referred me to some "IP protection service" in the UK, which had put me on a blacklist for unknown reasons (they don't tell you the reason for security reasons, but there was mention of something "proxy"). After submitting multiple requests to remove me from their blacklist (all automated online with no option to talk to a human), I finally caved in and shut down my relay. After doing that, combined with waiting a few days, while also continually resubmitting my removal request, they marked my IP as "clean", allowing me to login to my bank again. The whole process took about 6 weeks, and neither my bank nor the UK service provided any assistance along the way. Fun times. I would love to run a TOR relay again but I'm a bit paranoid now.
- 0xdeadb00f 6y ago
  That's pretty scary
- caymanjim 6y ago
  Why on earth would you run a Tor node on an IP that you use for any personal transactions? This isn't surprising in the least.
  - viraptor 6y ago
    I think you're confusing a relay and an exit node here. Pretty much everyone using Tor runs a node and for virtually everyone it's on IP also used for personal transactions. There are silly services which take every tor node as suspicious. They're wrong, but it doesn't matter if you get banned.
    - glenneroo 6y ago
      I also considered bringing up that point, but then I actually looked it up[0]: > Tor relays are also referred to as "routers" or "nodes." They receive traffic on the Tor network and pass it along. Check out the Tor website for a more detailed explanation of how Tor works. [0]: https://www.eff.org/torchallenge/what-is-tor.html https://www.eff.org/torchallenge/what-is-tor.html
john4534243 6y ago
Majority of the ISP's provide dynamic IP these days and getting static ip costs significantly more money. If you have a low compute device like raspberry pi running 24/7 which controls all the home network, then connecting(ssh) to it over internet requires static ip. The other alternative which does not cost money is setting up tor(which is pretty simple) and ssh socks proxy on the client machines. This use case is pretty common which does not involve privacy but very useful.
brnt 6y ago
I have (a few) static sites on places like Github Pages/netlify. How do I put them under a .onion?

I want a short HOWTO linked from this article.

MattGaiser 6y ago
I would love to do this for my personal site. Not sure if I am willing to spend 4 hours on figuring it out though.
- clashmeifyoucan 6y ago
  I did it for my personal site, and it wasn't too hard, I personally didn't have as much experience with nginx and stuff back then but if I were to set one up now I feel I'd be done in under 30m complete with a vanity url.
clashmeifyoucan 6y ago
from the article: https://community.torproject.org/onion-services/setup/ https://community.torproject.org/onion-services/setup/
0xggus 6y ago
Just follow the guide below and ping us on IRC (irc.oftc.net #tor) if you have issues: https://community.torproject.org/onion-services/advanced/onion-location/ https://community.torproject.org/onion-services/advanced/oni... IRC help: https://support.torproject.org/get-in-touch/irc-help/ https://support.torproject.org/get-in-touch/irc-help/

I'm pro decentralizing the internet, but these movements really need some marketing chops. ".onion" TLD? (Yes I know it has been around for awhile) Think of how a normal person will view a ".onion" domain name. It's nonsensical to the uninitiated.

eindiran 6y ago
Increasingly there are full word TLDs (see here: [0]), so I don't think people will find it that weird, especially since most people don't really spend a lot of time looking at the address bar. The .onion TLD is named for onion routing[1] and has been around for quite a while as you pointed out. If it caught on, I imagine most people would accept the name without much thought. I think the bigger barrier to .onion catching on is getting people to install Tor at all. [0] https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains https://en.wikipedia.org/wiki/List_of_Internet_top-level_dom... [1] https://en.wikipedia.org/wiki/Onion_routing https://en.wikipedia.org/wiki/Onion_routing
solstice 6y ago
What about http, ://, www and other TLDs like .co.nz or .ac.uk? All of these were pretty meaningless to initiates of the internet. In this new age of ".pizza" and suchlike, ".onion" doesn't seem much different or weird tbh. (To be clear: I don't think these new tlds are especially good either, but it's the world we live in now.)
- macintux 6y ago
  To me, .onion reminds me too much of The Onion.
  - CarbyAu 6y ago
    Exactly what I thought the title of the article meant. I thought it was going to be some random "AI" project that could rewrite your prose in The Onion humour ala: https://www.theonion.com/fuck-everything-were-doing-five-blades-1819584036 https://www.theonion.com/fuck-everything-were-doing-five-bla...
  - gigama 6y ago
    The Onion really needs an .onion site.
    - johntash 6y ago

vitejose 6y ago

I operate a few websites that host static content only. Is there any benefit to setting up onion services for these sites? Or are onion services more valuable for providing interactivity/logins?

danielheath 6y ago
If the data might be subject to censorship or spying, yes - using an onion service protects users from having info like “you read about STI treatment” sold to their insurers.
vitejose 6y ago
This is basically what I was wondering: https://news.ycombinator.com/item?id=23776045 https://news.ycombinator.com/item?id=23776045

surround 6y ago

What’s the advantage of accessing an onion service (as opposed to accessing a normal https website over tor)?

ve55 6y ago
The website cannot identify who they are, what ISP they use, or where they live. Similarly, middleboxes such as their ISP cannot find out what websites they are browsing, which is still easily possible even with TLS via many methods (DNS, SNI, IP correlation, many others)
- surround 6y ago
  What I mean is, how is a .onion website over tor better than an https website over tor? I edited my comment to clarify.
  - threentaway 6y ago
    The traffic never leaves the Tor network. This has a few advantages: * You don't need a TLS certificate from a public certificate authority, as it is already encrypted end to end * The exit node cannot attempt to snoop on your traffic (via TLS SNI) or inject content/ads/exploits into your unencrypted traffic * It reduces load on the exit nodes so they can work on serving traffic to sites that don't have an .onion endpoint
    - surround 6y ago
      If certificate authorities are a concern, then why do some onion services use https?
      - danielheath 6y ago
        If I had to guess, it’d be because TOR users are not a solid block with identical opinions.
      - 6y ago

mark_l_watson 6y ago

I am tempted to onionize my site for political (if that is the correct word) reasons. I am almost done reading The Surveillance Economy and it feels like almost an obligation to push back. (Using ProtonMail, use a large leased server in Germany at Hetzner for my routine work and writing, and using private browsing tabs when I must use Twitter or Reddit.) It looks like Onion domain hosting services are $5-$8/month, but going through their checklist and making one of my VPSs approved would be educational.

zelly 6y ago
> It looks like Onion domain hosting services are $5-$8/month You don't need a special host. You just need to run Tor and connect to the network.
- Nextgrid 6y ago
  Running an Tor Hidden Service doesn't require a specific host. As far as I know the traffic it generates will not be malicious. You only need to worry about malicious traffic and Tor-friendly ISPs if you plan to run an exit node (and at this point you need to consider the legal implications as well). Furthermore if you are not hosting any illegal/objectionable content and don't need to hide from law enforcement or state-sponsored attackers, a lot of the security concerns around anonymizing the server no longer apply either.
jsf01 6y ago
Using a centralized service which, ultimately, you have to take at their word seems to me like it should not be necessary in this age of trustless networks and innovation in decentralized technology. Speaking in particular about ProtonMail here. Are there any email services that are provably private?
- lend000 6y ago
  Frankly this is one of the few non-financial areas where blockchain-like technologies make sense: anonymously creating and routing connections. Right now, you can encrypt the contents of your email, but there is no hiding who is the recipient and who is the sender, certainly not from the mail service on either end. Until you solve that problem (for example, by posting encrypted versions on a public blockchain), you never get a truly end-to-end secure communication channel.

neilv 6y ago

I tried this feature of Tor Browser, using the first example I saw in TFA (www.propublica.org)... and was surprised to see that the .onion equivalent of the www.propublica.com home page... tried to make requests to third-party non-.onion cross-site surveillance trackers. google.com/recaptcha connect.facebook.net static.chartbeat.com ak.sail-horizon.com pi.pardot.com htlbid.com A separate concern, besides this choice of example, is why ProPublica is normally helping to leak the identities and intimate browsing behavior of people who visit their site, to some of the most powerful and invasive corporations, given this mission: > ProPublica is an independent, nonprofit newsroom that produces investigative journalism with moral force. We dig deep into important issues, shining a light on abuses of power and betrayals of public trust — and we stick with those issues as long as it takes to hold power to account.

corty 6y ago
To be safe one should disable JavaScript and most if not all third-party requests on .onion sites. Thats why TorBrowser always includes NoScript. Unfortunately in an unsafe default configuration that allows too much. So overall, I guess this move isn't intended to protect the masses but provide more cover traffic mainly.
gowld 6y ago
Because not everyone solves every problem in the world simultaneously.

isaack 6y ago

CloudFlare had a much more elegant solution: the Alt-Svc HTTP header [1]. It is entirely transparent to the user. Security is guaranteed because it uses the original SSL/TLS certificate for exchange (that is, on top of the usual safety guarantees provided by a Tor hidden service). Sadly they stopped doing that a while ago [2]. If anyone has insider knowledge about the reason behind, I would be really interested to hear about it. [1]: https://blog.cloudflare.com/cloudflare-onion-service/ https://blog.cloudflare.com/cloudflare-onion-service/ [2]: https://community.cloudflare.com/t/tor-alt-svc-header-not-being-sent/113222 https://community.cloudflare.com/t/tor-alt-svc-header-not-be...

cypherpunks3 6y ago
Cloudflare is still using the Alt-Svc HTTP header. Use Ctrl+Shift+J to see the 'Browser Console' which contains logs in the form "Alternate Service Mapping found: https://blog.cloudflare.com:-1 https://blog.cloudflare.com:-1 to https://cflaresuje2rb7w2u3w43pn4luxdi6o7oatv6r2zrfb5xvsugj35d2qd.onion:443" https://cflaresuje2rb7w2u3w43pn4luxdi6o7oatv6r2zrfb5xvsugj35.... Cloudflare only sends the header to clients it detects as Tor Browser. If you have tweaked your config or are running an older version, it may not detect correctly. Even if it had previously worked. This technique is not "better than" the "Onion-Location" approach. They complement well. Use the 'Alt-Svc' header for all users with Tor Browser's user agent and send "Onion-Location" to all users. If a user decides to opt for the .onion address, they can. But they don't have to.
charliebrownau 6y ago
CloudFlare censors Not a valid solution
buildbuildbuild 6y ago
It’s so transparent that Tor Browser users cannot actually tell if Cloudflare’s Alt-Svc “Onion Routing” is actually working. Try to determine how your traffic was routed while browsing a site with Alt-Svc enabled. A user should plainly know if _any_ traffic exited the Tor network and that is not always the case. (See mixed content on most HS mirrors of major sites like NYTimes)

lexicon0 6y ago

I'm in charge of a security for a reasonable sized company. I generally support the Tor project and the goals of having a surveillance free internet. However - if an employee would install tor browser or use tor on a company device, or a device attached to the company network, they would be fired immediately. I would then refer them to law enforcement after conducting a forensic audit. Should you make your site only available via onion routing, or primarily available on onion routing, all workplaces will immediately block access and look at anyone who accesses with great incredulity

tomrod 6y ago
Naive question, as I am not a security professional. Why?
- coolspot 6y ago
  In some businesses it is important that all employee communications are captured and can be inspected in case there is suspicion of IP or customer data theft. For example in a hospital, there is no good reason for employee to use Tor on work computer.
  - Reelin 6y ago
    That's an excellent example but I'd point out that in any such scenario devices ought to be thoroughly locked down and run strictly audited environments. If properly configured you wouldn't be firing an employee for using Tor but instead for maliciously tampering with company hardware.
  - toyg 6y ago
    > in a hospital, there is no good reason for employee to use Tor on work computer. I would argue that hospitals and other public settings are actually more in need of higher privacy in electronic communications. Imagine a physician working on, say, Scarlett Johansson's health issues; he periodically sends this data to the specialist that will run some test, and a creepy sysadmin finds out. Should he be able to MITM those comms, and resell the info to newspapers (or worse)...? Nope; the physician should have perfect privacy from network operators.

atroche 6y ago

Why haven't we seen a pay-for-use version of Tor yet? The network won't scale unless exit and relay nodes are incentivized with value beyond warm-fuzzies.

yjftsjthsd-h 6y ago
How would that work without killing the privacy angle?
- hirako2000 6y ago
  Monero/zcash

Santosh83 6y ago

In this context OnionShare (https://onionshare.org/ https://onionshare.org/) is an excellent program that even non-technical people can use to either share files or even complete static websites over Onion routing. The main advantage is you don't need to grub around with Nginx, Apache and the Tor daemon manually setting everything up.

cryo 6y ago
OnionShare rocks: Tor hidden services are excellent for that purpose and provide a decentralized alternative for cloud based apps. What I love about them is also that it works in in tricky NAT situations where WebRTC struggles. My file manager "cryo" also uses Tor hidden services for signaling without a central server to initiate peer-to-peer connections. https://cryonet.io https://cryonet.io

onli 6y ago

So let's say I run a few websites and do support the idea. I read that article and think "I should setup an .onion version of my site and then point to that". The article points to https://community.torproject.org/onion-services/setup/ https://community.torproject.org/onion-services/setup/ - and I'm immediately lost. Setup a local webserver? Why would I need that? The documentation mentions that I have to configure the webserver correctly, but offers no details about that whatsoever. So that's not a good start. https://community.torproject.org/onion-services/advanced/onion-location/ https://community.torproject.org/onion-services/advanced/oni... works better, it shows the configuration, but assumes there is already an .onion address and does not point to documentation how to set it up. Hey, I know documentation is hard. But this could be improved a lot. By now I figured out that I'd have to install Tor on the server (not my machine, as the docs stated), find the torrc (the documentation has to mention where it is), point to the localhost port active of the webserver, the .onion address is autogenerated (so this will be an unreadable mess?) and can be taken from a file the tor software generates. And this: > We're not going to cover how to set up a web server here. If you get stuck or want to do more, find a friend who can help you. We recommend you install a new separate web server for your onion service. Just cut it out. I'm actually lucky enough to have friends that could help me with this, but what if I hadn't? Cover in the documentation what needs to be done, or at the very least don't show an attitude about it.

deleted 6y ago
[deleted]
nyolfen 6y ago
it's possible they're trying to avoid a monoculture of web servers that serve tor sites in order to avoid many sites becoming insecure in the event of a bug disclosure for a software package they have no control over
caymanjim 6y ago
They're not a tech support company or a hosting company. There are literally thousands and thousands of documents on basic web server installation and configuration already written. The information is trivial to find. It falls under "if you have to ask, you're not ready".

shp0ngle 6y ago

I remember, in 2014, Facebook started to be available on Tor, and people speculated that there will be a wave of popular websites being offered on Torspace. Nothing came of this "wave", if I'm not wrong, right. https://en.wikipedia.org/wiki/Facebookcorewwwi.onion https://en.wikipedia.org/wiki/Facebookcorewwwi.onion edit: and it seems down to me right now. edit2: it works... but slower, than just going to regual HTTPS version with Tor. Which makes sense, because it needs to hop more. edit3: .... but it doesn't let me log in, as I am logging from "suspicious location".

glenneroo 6y ago
I still use Facebook via Tor quite often, even though it's barely usable - loading anything takes between 3 and infinite seconds (i.e. never loads, requiring multiple refreshes). I use it to let them know that people still use it, with the hopes that they don't even remove it. I don't have this problem with other Tor sites, so it leads me to believe they want to be able to advertise it as "we offer this because we care" while making it nearly unusable to the point that nobody will use it. It's very similar to the secure chat feature, which they continually move deeper and deeper into menus, each move progressively more difficult to find. They just yesterday enabled the new "layout", and I can't even find the secure chat feature anymore, they either buried it so deep or removed it entirely?

glenneroo 6y ago

I'm not sure how relevant this is to running your website on the "darknet", but a potential warning for future Tor service operators: I ran a TOR relay for about a year, eventually even ordering a static IP for 5€/month. One random day, I was unable to log into my online banking, receiving some obscure error code. After digging around and finally contacting the bank, they referred me to some "IP protection service" in the UK, which had put me on a blacklist for unknown reasons (they don't tell you the reason for security reasons, but there was mention of something "proxy"). After submitting multiple requests to remove me from their blacklist (all automated online with no option to talk to a human), I finally caved in and shut down my relay. After doing that, combined with waiting a few days, while also continually resubmitting my removal request, they marked my IP as "clean", allowing me to login to my bank again. The whole process took about 6 weeks, and neither my bank nor the UK service provided any assistance along the way. Fun times. I would love to run a TOR relay again but I'm a bit paranoid now.

0xdeadb00f 6y ago
That's pretty scary
caymanjim 6y ago
Why on earth would you run a Tor node on an IP that you use for any personal transactions? This isn't surprising in the least.
- viraptor 6y ago
  I think you're confusing a relay and an exit node here. Pretty much everyone using Tor runs a node and for virtually everyone it's on IP also used for personal transactions. There are silly services which take every tor node as suspicious. They're wrong, but it doesn't matter if you get banned.
  - glenneroo 6y ago
    I also considered bringing up that point, but then I actually looked it up[0]: > Tor relays are also referred to as "routers" or "nodes." They receive traffic on the Tor network and pass it along. Check out the Tor website for a more detailed explanation of how Tor works. [0]: https://www.eff.org/torchallenge/what-is-tor.html https://www.eff.org/torchallenge/what-is-tor.html

john4534243 6y ago

Majority of the ISP's provide dynamic IP these days and getting static ip costs significantly more money. If you have a low compute device like raspberry pi running 24/7 which controls all the home network, then connecting(ssh) to it over internet requires static ip. The other alternative which does not cost money is setting up tor(which is pretty simple) and ssh socks proxy on the client machines. This use case is pretty common which does not involve privacy but very useful.

brnt 6y ago

I have (a few) static sites on places like Github Pages/netlify. How do I put them under a .onion?