5 ms·

Tor in 20202: We've succesfully killed off 90% of all actually used (as opposed to botnet) tor onion services and we're happy about it. We're protecting our end

Tor in 20202: We've succesfully killed off 90% of all actually used (as opposed to botnet) tor onion services and we're happy about it. We're protecting our end users from themselves by forcing the removal of Tor v2 protocol from the codebase. We don't care because onion services were never really something we cared about, just an add-on to trick people into thinking Tor was a real network worth building a community in. It isn't. Tor is only for people who want a pseudoanonymous clear web proxy. Forget .onion domains. https://www.darkowl.com/blog-content/tor-v2-depreciation-shifts-darknet-landscape https://www.darkowl.com/blog-content/tor-v2-depreciation-shi... https://blog.torproject.org/v2-deprecation-timeline/ https://blog.torproject.org/v2-deprecation-timeline/ https://metrics.torproject.org/hidserv-dir-onions-seen.html https://metrics.torproject.org/hidserv-dir-onions-seen.html

est31 5y ago
> https://metrics.torproject.org/hidserv-dir-onions-seen.html https://metrics.torproject.org/hidserv-dir-onions-seen.html Your link shows that there were about 170k v2 onion addresses in September 2020, while there were about 550k v3 onion addresses at that same date. The trends were only pointing up for v3 addresses while pointing down for v2 ones.
- superkuh 5y ago
  I can't blame you for just skimming, but you've come away with a mistaken interpretation. Yes, there are a ton of v3 onions created quite suddenly but they don't stick around for long and aren't associated with human people. The Tor project technical blog on v3 onion services suggests most of the v3 services are "barely used" and setup to merely act as slave services for a malicious botnet. https://blog.torproject.org/v3-onion-services-usage https://blog.torproject.org/v3-onion-services-usage . Human people actually run websites (and other services) from v2 addresses and there are far more of them even now than actual human used v3 addresses if you can extrapolate anything from onion descriptor information in the hidden service directory.
ziddoap 5y ago
>We're protecting our end users from themselves by forcing the removal of Tor v2 protocol from the codebase. All of your links describe why V3 is more secure and superior to V2. Are you whining about the increased security, or am I misunderstanding your post? If I'm not misunderstanding, why was the over one year of warnings and multiple years of discussions not enough time to prepare?
- superkuh 5y ago
  Removing the v2 code from clients and falsely stating v2 onions aren't valid URLs is lying to users to protect them from a potential future threat. But that protection comes at the cost: the destruction of the entire 15 year history of communities and interlinking and search indices for onionland. To protect the community they have destroyed it. A v3 community might come in the future, and I hope it will, but right now v3 .onions are pretty much just bots and a few big names that have created new v3 services. The rest is botnet v3 .onions. What I want, what everyone in the tor project comment thread on the depreciation post wants, is for v2+v3. Not just v2. Even now most tor relays support v2 and will until the tor project puts out a version consensus flag that blocks older tor. But they can't do that any time soon because most tor infrastructure still supports v2.
  - ziddoap 5y ago
    I'm still not understanding why the 15 year history of communities was not able or willing to act on the 13 months of warning, and months of discussion before that. There was more than ample time to prepare. Surely you don't expect a project like Tor to simply ignore security forever going forward because "people still use it"? Should Tor just stay V2, security be damned? I don't think Tor's main goal is to ensure your community stays friends; the goals are a bit loftier. I wonder if you hold the same views on any other security-related thing like cryptography or password storage. We'd still be at 8 character, lower-case only, truncated passwords "because people built infrastructure for it".
    - npteljes 5y ago
      I just don't get GP's point. If the workings of the system compromise its entire premise, of course they upgrade the system so that it matches the original intentions. It's like they shouldn't have deprecated old SSL and TLS versions, because some web services still only use those. I can't imagine an active community having trouble with this.
forgotmypw17 5y ago
Basically, this. Until Tor provides human-readable and -memorable addresses again, I'm considering it a deprecated project. I asked them about it at a talk when V3 was first being introduced, and they said they're working on a solution. Since then... ::crickets::
- beardog 5y ago
  .onion was never very human friendly, i won't deny that v3 is worse in that regard but it wasn't feasible for everyone to generate gems like facebookcorewwwi. Most v2s having only a few vanity bytes at most were arguably unsafe since that allowed phishers to more easily trick users, i know the same applies to v3 This is a very non trivial problem https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle
- rank0 5y ago
  How could you accomplish this without some sort of registration?
  - forgotmypw17 5y ago
    The way it was already accomplished previously: short addresses, which, although not easy, are possible to remember. 16 characters is doable, especially if it starts with 5-8 letters of word(s). 56 characters is not realistic.
    - rank0 5y ago
      I guess to each their own, but I just save onion links to my own vault. I’m not gonna memorize 16-char urls for every service I use.
  - beardog 5y ago
    Zookos triangle is hard to solve but arguably has been by projects like namecoin and similar ETH-sphere projects geti2p.net also has community registrars for .i2p domains and includes a built in hosts file of many of the sites, this involves a level of trust in the registries. https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle

est31 5y ago

> https://metrics.torproject.org/hidserv-dir-onions-seen.html https://metrics.torproject.org/hidserv-dir-onions-seen.html Your link shows that there were about 170k v2 onion addresses in September 2020, while there were about 550k v3 onion addresses at that same date. The trends were only pointing up for v3 addresses while pointing down for v2 ones.

superkuh 5y ago
I can't blame you for just skimming, but you've come away with a mistaken interpretation. Yes, there are a ton of v3 onions created quite suddenly but they don't stick around for long and aren't associated with human people. The Tor project technical blog on v3 onion services suggests most of the v3 services are "barely used" and setup to merely act as slave services for a malicious botnet. https://blog.torproject.org/v3-onion-services-usage https://blog.torproject.org/v3-onion-services-usage . Human people actually run websites (and other services) from v2 addresses and there are far more of them even now than actual human used v3 addresses if you can extrapolate anything from onion descriptor information in the hidden service directory.

ziddoap 5y ago

>We're protecting our end users from themselves by forcing the removal of Tor v2 protocol from the codebase. All of your links describe why V3 is more secure and superior to V2. Are you whining about the increased security, or am I misunderstanding your post? If I'm not misunderstanding, why was the over one year of warnings and multiple years of discussions not enough time to prepare?

superkuh 5y ago
Removing the v2 code from clients and falsely stating v2 onions aren't valid URLs is lying to users to protect them from a potential future threat. But that protection comes at the cost: the destruction of the entire 15 year history of communities and interlinking and search indices for onionland. To protect the community they have destroyed it. A v3 community might come in the future, and I hope it will, but right now v3 .onions are pretty much just bots and a few big names that have created new v3 services. The rest is botnet v3 .onions. What I want, what everyone in the tor project comment thread on the depreciation post wants, is for v2+v3. Not just v2. Even now most tor relays support v2 and will until the tor project puts out a version consensus flag that blocks older tor. But they can't do that any time soon because most tor infrastructure still supports v2.
- ziddoap 5y ago
  I'm still not understanding why the 15 year history of communities was not able or willing to act on the 13 months of warning, and months of discussion before that. There was more than ample time to prepare. Surely you don't expect a project like Tor to simply ignore security forever going forward because "people still use it"? Should Tor just stay V2, security be damned? I don't think Tor's main goal is to ensure your community stays friends; the goals are a bit loftier. I wonder if you hold the same views on any other security-related thing like cryptography or password storage. We'd still be at 8 character, lower-case only, truncated passwords "because people built infrastructure for it".
  - npteljes 5y ago
    I just don't get GP's point. If the workings of the system compromise its entire premise, of course they upgrade the system so that it matches the original intentions. It's like they shouldn't have deprecated old SSL and TLS versions, because some web services still only use those. I can't imagine an active community having trouble with this.

forgotmypw17 5y ago

Basically, this. Until Tor provides human-readable and -memorable addresses again, I'm considering it a deprecated project. I asked them about it at a talk when V3 was first being introduced, and they said they're working on a solution. Since then... ::crickets::

beardog 5y ago
.onion was never very human friendly, i won't deny that v3 is worse in that regard but it wasn't feasible for everyone to generate gems like facebookcorewwwi. Most v2s having only a few vanity bytes at most were arguably unsafe since that allowed phishers to more easily trick users, i know the same applies to v3 This is a very non trivial problem https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle
rank0 5y ago
How could you accomplish this without some sort of registration?
- forgotmypw17 5y ago
  The way it was already accomplished previously: short addresses, which, although not easy, are possible to remember. 16 characters is doable, especially if it starts with 5-8 letters of word(s). 56 characters is not realistic.
  - rank0 5y ago
    I guess to each their own, but I just save onion links to my own vault. I’m not gonna memorize 16-char urls for every service I use.
- beardog 5y ago
  Zookos triangle is hard to solve but arguably has been by projects like namecoin and similar ETH-sphere projects geti2p.net also has community registrars for .i2p domains and includes a built in hosts file of many of the sites, this involves a level of trust in the registries. https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle