4 ms·

I don't see why they couldn't migrate to the newer version in what seems a reasonable timeframe. Stated reason for v2 retirement: "Onion service v2 uses RSA102

by labawi 5y ago

I don't see why they couldn't migrate to the newer version in what seems a reasonable timeframe. Stated reason for v2 retirement: "Onion service v2 uses RSA1024 and 80 bit SHA1 (truncated) addresses. It also still uses the TAP [2] handshake .." Seems like a typical security upgrade of something that should have been done a long time ago.

superkuh 5y ago
You use the word migrate but that's not really what is going on. A new onion domain is required. All the links, all the search indices, the reputation and rankings, the things that make up the web on tor will be destroyed. On v3 everything will have to start fresh. And yeah, there are reason for using v3. Many of them. But having v2 alongside v3 has been the working status quo since 2019. It is not like it is suddenly harder now. And just because a v2 site exists doesn't endanger v3 ones.
- labawi 5y ago
  A host on v2 can serve a redirect to v3. Search indexes can be updated, as well as links (there was about 1.5 years?). It is a nuisance, but I don't see what the big issue is. If v2 addresses are not disabled, people will keep using them, yet they are (seemingly quite) insecure. People would get false security/privacy impressions so they need to be disabled. Migrations need definite timelines - look at python v2/3, IPv4/6. RSA1024 really is long past overdue.
  - im3w1l 5y ago
    > there was about 1.5 years You are kind of assuming that every Tor site is someone's primary occupation. But for some people it just be a hobby, and not their primary one either. Imagine someone spending an hour or so per year. They may not even know this is coming.
    - tinus_hn 5y ago
      So they never install security updates, sounds like a good idea to no longer support them. Note it is pretty bad publicity for Tor if they get hacked.
      - im3w1l 5y ago
        Automatic updates are a thing.
        superkuh 5y ago
        The tor browser enforces this but that doesn't happen for the actual tor client (used for hosting onion services) if it comes from your system repositories. But even if you go back to the tor client released in 2013 there are no serious vulnerabilities. Just a mild DoS.
        tinus_hn 5y ago
        This is about servers. The Tor browser and its automatic updates don’t include a webserver for tor sites, do they?
        superkuh 5y ago
        Yes. That's exactly what I said. Except my main point was that even tor clients from 2013 only have a minor DoS vulnerability. It's not so dire if you don't update. I actually put off reading about or implementing a v3 domain because of the new DoS problems it introduced. For most of the v2->v3 transitional period an old out of date tor client running a v2 onion service was no more vulnerable than a brand new up to date v3 tor client with it's new vulnerabilities not worked out yet.
lacker 5y ago
I don't see why they couldn't migrate to the newer version in what seems a reasonable timeframe. I mean, this post is from July 2020. Onion service v3 has been around since 2018. It seems pretty reasonable to give over a year for migration.

by labawi 5y ago

superkuh 5y ago

You use the word migrate but that's not really what is going on. A new onion domain is required. All the links, all the search indices, the reputation and rankings, the things that make up the web on tor will be destroyed. On v3 everything will have to start fresh. And yeah, there are reason for using v3. Many of them. But having v2 alongside v3 has been the working status quo since 2019. It is not like it is suddenly harder now. And just because a v2 site exists doesn't endanger v3 ones.

labawi 5y ago
A host on v2 can serve a redirect to v3. Search indexes can be updated, as well as links (there was about 1.5 years?). It is a nuisance, but I don't see what the big issue is. If v2 addresses are not disabled, people will keep using them, yet they are (seemingly quite) insecure. People would get false security/privacy impressions so they need to be disabled. Migrations need definite timelines - look at python v2/3, IPv4/6. RSA1024 really is long past overdue.
- im3w1l 5y ago
  > there was about 1.5 years You are kind of assuming that every Tor site is someone's primary occupation. But for some people it just be a hobby, and not their primary one either. Imagine someone spending an hour or so per year. They may not even know this is coming.
  - tinus_hn 5y ago
    So they never install security updates, sounds like a good idea to no longer support them. Note it is pretty bad publicity for Tor if they get hacked.
    - im3w1l 5y ago
      Automatic updates are a thing.
      - superkuh 5y ago
        The tor browser enforces this but that doesn't happen for the actual tor client (used for hosting onion services) if it comes from your system repositories. But even if you go back to the tor client released in 2013 there are no serious vulnerabilities. Just a mild DoS.
        tinus_hn 5y ago
        This is about servers. The Tor browser and its automatic updates don’t include a webserver for tor sites, do they?
        superkuh 5y ago
        Yes. That's exactly what I said. Except my main point was that even tor clients from 2013 only have a minor DoS vulnerability. It's not so dire if you don't update. I actually put off reading about or implementing a v3 domain because of the new DoS problems it introduced. For most of the v2->v3 transitional period an old out of date tor client running a v2 onion service was no more vulnerable than a brand new up to date v3 tor client with it's new vulnerabilities not worked out yet.

lacker 5y ago

I don't see why they couldn't migrate to the newer version in what seems a reasonable timeframe. I mean, this post is from July 2020. Onion service v3 has been around since 2018. It seems pretty reasonable to give over a year for migration.