25 ms·
Why offer an Onion Address rather than just encourage browsing-over-Tor?
- nextaccountic 5y ago> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it? I mean, suppose all of the existing nodes weren't malicious. Could a government agency plausibly run 1000 exit nodes in a way that doesn't give away they are government-run? This would make the majority of exit nodes malicious.
- RL_Quine 5y agoThe behaviour of not always using the same exit means that you, over time, will almost assuredly use a malicious exit should more than zero exist. It's reckless to suggest that anybody should be using this system, your situation is almost always going to be worse than not.
- bauruine 5y agoThe only attacks an exit alone can do is sniff all traffic and modify the traffic. There are constant checks done by the Torproject to detect bad exits that modify traffic but sniffing is not detectable of course. But both of those attacks are mitigated by https which most sites support nowadays. Firefox and therefore the Tor Browser also has an option to disable http. [0] And using an .onion service removes this attack vector also. [0]: https://support.mozilla.org/en-US/kb/https-only-prefs https://support.mozilla.org/en-US/kb/https-only-prefs
- RL_Quine 5y agoIf they're not checking everything, any sort of non-general modification of traffic will obviously go completely unnoticed. The bad exit flag really is only ever going to catch the most obvious, ham fisted bad behaviour.
- bauruine 5y agoYou're correct this isn't really a solution but Tor Browser has already merged https only mode [0] so this should become less of an issue in the near future. [0]: https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests/256 https://gitlab.torproject.org/tpo/applications/tor-browser/-...
- michaelt 5y ago> But both of those attacks are mitigated by https which most sites support nowadays. Unfortunately, not as much as you might hope. For good reasons, the Tor browser doesn't store your browsing history - so there's no 'recently visited sites', no address bar autocomplete, no cached redirects, no cached HSTS, and no colour-changed 'visited' links. So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// https:// explicitly, as that's your sole protection against getting MITMed.
- vageli 5y ago> So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// https:// explicitly, as that's your sole protection against getting MITMed. >Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security. https://www.torproject.org/download/ https://www.torproject.org/download/
- ryeights 5y agoCaveat: HTTPS Everywhere relies on a manual whitelist of HTTPS-enabled sites. If the website you’re visiting isn’t popular enough to be on their list, you’re out of luck.
- michaelt 5y agoHTTPS Everywhere doesn't have a working rule for bitcoinknots.org And more broadly, neither HSTS preloading or HTTPS Everywhere include a list of every single site on the internet.
- tialaramex 5y agoMentioned below that HTTPS-default (which is an option in ordinary Firefox) is intended to become mandatory in Tor-browser. I use this on my main PC. Once or twice a day I might visit some old or especially cantankerous site that doesn't do HTTPS, I get a full page interstitial explaining the problem, I can decide if I'm OK with that. Otherwise every single link, typed URL, etc. is HTTPS regardless of whether that was what was originally written. I wouldn't recommend it in its current state for my mother, but it's definitely what someone using Tor would want, and it's only getting more ubiquitous.
- heavyset_go 5y agoEven if every exit node in the US is operated by private people or organizations, courts can compel the node owners to work with the government and not talk about it.
- TuringTest 5y agoAren't there warrant canaries set up to prevent this? Every website that can be compelled to behave that way should have one.
- rwmj 5y agoHow could a warrant canary work when you don't know which exit node you will connect to?
- krageon 5y ago> Aren't there warrant canaries set up to prevent this? No, because the police will tell you to not tell anyone about the court order. If you do so (for example using a warrant canary), you will be in big trouble. Those canaries were always a convenient fiction, almost to the point of it being entirely in question whether or not this fiction was created in good faith.
- Joakal 5y agoCan those warrant canaries holders who follow police/court orders, be sued for false advertising? Seems like a catch 22 that it's a lose-lose.
- krageon 5y agoIf being sued for false advertising was a real risk, advertising would be a lot more truthful :)
- FeepingCreature 5y agoYou can always be in trouble by the police for any reason or no reason at all. The question is law. The notion of a warrant canary is that the police cannot compel you to state that you are not under a court order. They can annoy you to lie, and they can always break the law, but they cannot legally force you to. To claim that regardless of this, the police can compel you to lie, is tantamount to saying that the rule of law has failed. ( https://www.eff.org/deeplinks/2014/04/warrant-canary-faq https://www.eff.org/deeplinks/2014/04/warrant-canary-faq )
- stingraycharles 5y agoIt’s not even about three letter agencies; many exit nodes are being scanned for passwords, if you happen to go through http instead of https. Here’s research conducted years ago about this matter: https://www.vice.com/en/article/mgbdwv/badonion-honeypot-malicious-tor-exit-nodes https://www.vice.com/en/article/mgbdwv/badonion-honeypot-mal... Effectively they set up a honeypot and used clear text passwords to log in, and plenty of exit nodes picked up on this and those credentials were later used to (attempt to) log in into the honeypot.
- thealig 5y agothe article talks about the research stumbling upon exit nodes performing MITM and other sniffing but does not refer to the exact details. is there a paper for this? only found this paper going over systematic process of exposing bad relays - http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf
- heavyset_go 5y agoWhat research are you talking about? The article talks about at least two different researchers working on separate projects. Here's the link for first one:https://web.archive.org/web/20150705184539/https://chloe.re/2015/06/20/a-month-with-badonions/ https://web.archive.org/web/20150705184539/https://chloe.re/...
- thealig 5y agowell, was referring to the research indicated by the title of the article- honeypot setup to detect malicious exit relays. yes thats the one. interesting, seems they caught 15 unique relays harvesting logins. There seems to be scope to improve reporting and detection of malicious actors like this. They also have a block list on Tor's gitlab repo but doesn't seem to be up to date.
- deleted 5y ago[deleted]
- 5y ago
- bawolff 5y agoOr just use HSTS. Problem solved.
- idontwantthis 5y agoWhat does compromising the exit do? I thought the layering means you would need to compromise the entire path to do anything.
- foxfluff 5y agoExit node is where the tor-encrypted path ends and traffic goes to the clearnet.
- idontwantthis 5y agoWhat’s the point of any of it then to a paranoid user?
- Shish2k 5y agoThe reason to use the tor<->plaintext bridge is to route around censorship, eg the great firewall of china, or various western ISPs blackholing the pirate bay, and also to prevent the server from learning much about the client’s identity If you don’t want any MITM possibilities, that’s what the onion services are for (both client and server are speaking over tor connections)
- lazide 5y agoGot me - it looks like a decently effective honeypot though for ‘paranoid but hasn’t thought it all the way through’
- crtasm 5y agothe exit node has no knowledge of your IP address and your traffic should still be protected by HTTPS.
- ufmace 5y agoBecause it switches over to the clearnet there, the operator could do stuff like intercept non-https traffic or use a malicious DNS to attempt to MITM https traffic.
- Stevvo 5y agoThere were slides in the Snowden leaks where it laid out the NSA's strategy for dealing with TOR and compromising exit nodes was a big part of it. They have had the last 10 years to work on it; one might expect they had results.
- rosndo 5y agoMost of the technical points listed here are pretty much entirely mitigated by TLS. Exit nodes can of course deny access to specific sites, but hidden services suffer from comparable (or worse) issues. There are no other practical attacks that malicious exit nodes could execute against sites using TLS and HSTS preload lists. If you’re a website administrator, fixing those things should be your priority before implementing onion addresses. Onion addresses also come with slight drawbacks. They’re difficult for users and more vulnerable to phishing. Hidden services are also extremely vulnerable to CPU-based DoS attacks.
- egberts1 5y agoBut, but … BUT TLS man-in-the-middle at exit node isn’t fully mitigated … UNLESS TLS Client mode is used as well. We all should know how infrequent this TLS Client mode get evoked, right, right? Yeah, righto.
- noname120 5y agoThis article beats around the bush but never explains why Onion addresses solve these issues. From Wikipedia: > Addresses in the onion TLD are […] automatically generated based on a public key when an onion service is configured. > 256-bit ed25519 public key along with a version number and a checksum of the key and version number That's all you need to know.
- bauruine 5y agoIf you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServiceSingleHopMode on https://2019.www.torproject.org/docs/tor-manual.html.en https://2019.www.torproject.org/docs/tor-manual.html.en or just use the following config options SOCKSPort 0 HiddenServiceNonAnonymousMode 1 HiddenServiceSingleHopMode 1
- stingraycharles 5y agoFor my understanding, usually establishing a connection with a hidden service involves two separate Tor circuits: one circuit for the visitor, but another full circuit for the hidden service. This “Non Anonymous Mode” effectively omits the second circuit, and allows relays to connect directly to the hidden service’s IP address, thus significantly improving latency and reducing the strain on the Tor network?
- bauruine 5y agoYes that's correct.
- zekica 5y agoThat is correct, but note that not all tor nodes are exit nodes, so latency will be increased but troughput may even be better.
- stingraycharles 5y agoAh right, so what you’re saying is that hidden services don’t need Exit relays for hidden services at all, and as such do not have the bottleneck issues that usually plague exit nodes.
- deleted 5y ago[deleted]
- shp0ngle 5y ago> The first benefits are authenticity and availability: if you are running Tor Browser and if you click/type in exactly the proper Onion address, you are guaranteed to be connected to what you expect — or not at all. What? Writing raw onion addresses is like writing raw IPv6 addresses. Nobody can remember then and check them. What is easier > https://nytimes.com https://nytimes.com or > ej3kv4ebuugcmuwxctx5ic7zxh73rnxt42soi3tdneu2c2em55thufqd.onion
- shaky-carrousel 5y agoNeither. Either can be mistyped. Nobody enters addresses directly anymore. Either you google them or you get them from bookmarks.
- Etheryte 5y agoIt's very easy to think that things we do ourselves are universal because they seem so intuitive and natural for us. I for one type addresses from scratch all the time.
- shp0ngle 5y agoYeah so in case of Tor, people use DDG which is the default. And DDG, being bad and handling SEO spam worse than Google, often returns wrong onion address. (Which happened to me several times.) And you cannot really check if it's the correct one. At least on regular net, you have a chance to spot nytime5 is fake.
- Jerrrry 5y agoOnion addresses that are mistyped are almost certainly an invalid address. It is not possible to squat onion domains for typo errors like you can clearnet addresses. Similar to bitcoin, one character swapped breaks the hash-checksum, making the address 99.99999999% likely to be invalid.
- rosndo 5y ago> you are guaranteed to be connected to what you expect — or not at all. Exactly the same guarantees are also achieved by putting your clearnet address on HSTS Preload lists, or by writing https:// https:// in front of the url on the users side.
- bawolff 5y agoI think the only legit reason (assuming your clearnet site is using HSTS) is that .onion site reduces the risks of users screwing up. And i suppose better performance if you don't have to use exit bandwidth (i would guess, dont actually know) Users are bad at security. If they fail to set up tor, .onion links don't work, so it acts as a barrier against users shooting themselves in the foot. This is counterbalanced by higher phishing risks.
- rosndo 5y ago> This is counterbalanced by higher phishing risks I would argue that this is the much bigger footgun for users. Just look at how much money darknet users are losing to the big industry of .onion phishing pages.
- bawolff 5y agoIts a fair argument. I think incorrect tor setup is a bigger risk for things like securedrop leaker stuff, where it is likely the first and only time the user will use TOR.
- rosndo 5y agoI agree about securedrop, but the blog post seems to discuss “platforms such as Facebook, the BBC or NYT”. Also in the case of securedrop it might make sense to have that separate from the rest of your infrastructure, so the “hidden” part of “hidden services” suddenly becomes useful.
- moltke 5y agoIt's good motivation to start using client certs instead of passwords.
- nonrandomstring 5y agoI think some comments here are misunderstanding the intent of the article. For those saying TLS already solves... it is not advocating Tor as a replacement for transport layer security, indeed most Tor users also use TLS (and site certs) with little overhead. No, the article is asking how you could, as a website owner, make things easier on Tor users and yourself! It starts with the assumption that you care, and want to help users who require better privacy. It answers, though not in detail, the many HN readers who invariably post replies concerning Tor that "All my abuse comes through Tor". Creating an .onion address mitigates that significantly.
- tempestn 5y agoI'm not clear from the article how having an onion address helps website operators who receive abusive traffic through Tor. Perhaps some of that abusive traffic will come in via the onion address instead, but presumably such an operator will want to continue serving their regular site to Tor exit nodes as well, so I don't see how it would actually mitigate anything, nor make the malicious traffic easier to segregate from valid traffic over Tor. What am I missing?
- nonrandomstring 5y ago> I'm not clear from the article how having an onion address helps website operators who receive abusive traffic through Tor. No, it's not clear. Also "abusive traffic" is vague. Are you mainly concerned with shitposters, trolls, DOS attacks? > What am I missing? Maybe you're not missing it, but essentially it's a behavioural/social rather than technical challenge. Most abusers, ones that technical changes can address, operate at scale over HTTP/S and use Tor simply as a free VPN via regular exit nodes to hide their IP. The author calls this the "Wheat/chaff problem". Viewed this way, it's easiest for a site owner to just block all of Tor and kill all legitimate users too. Most of those bulk abusers cannot be bothered to deal with marginal cases like using an overlay network with .onion addresses whereas those who _need_ Tor are highly motivated. Other kinds of abusers, like persistent troll posters, are better dealt with by other means even if you're using HTTP/S.
- linuxandrew 5y agoI think the avoiding exit nodes part is probably the most important to me. Exit nodes have always been problematic - from memory about 20% of relays have an exit flag but most of the traffic is directed to the most performant relays. Tor actively discourages using the network for file sharing because of the exit node bottleneck. I think there are probably some uses of the Tor network that aren't fully realised yet - file sharing (something similar to I2P) which avoids the exit node using onion addressing and chat applications (like Briar which uses onion addresses, or Secure Scuttlebutt). As for web traffic, it is nice to offer an onion address. I wonder if websites could offer an "upgrade" to onion addresses, similar to how IPFS does?
- bauruine 5y agoYes there is the onion-location http header to upgrade from clearnet to .onion [0] [0]: https://community.torproject.org/onion-services/advanced/onion-location/ https://community.torproject.org/onion-services/advanced/oni...
- Asan1 5y agoThe Tor network has 1Tbps+ of real exit capacity available, real usage is a small fraction of that. Exit capacity as a significant bottleneck has not been a realistic issue for many years.
- Asan1 5y ago[dead]
- hpcoke 5y ago> https://hstspreload.org/ https://hstspreload.org/ offers the same benefits. You are guaranteed to be connected to what you expect - or not at all. TLS/HSTS is still subject to CA attacks, e.g. diginotar. CA/X.509 is a complex stack too. > TLS mitigates attacks that can be executed by malicious exit nodes (or WiFi networks, or ISPs), that is the whole purpose of TLS. A malicious exit node could refuse to serve some websites. This seems a minor risk though. Reducing load on exit nodes is a technical benefit that's in that blog post. Another benefit to using Tor onion services for large sites is that the Tor circuit ID can be used as an additional key in an IP rate limit cache. This helps block Tor bots (on the basis that establishing a Tor circuit is expensive).
- Asan1 5y ago>TLS/HSTS is still subject to CA attacks, e.g. diginotar. Largely solved by Certificate Transparency. If you compromise a CA, you can issue certificates. However, you can't issue new certificates without broadcasting that fact to the whole world as browsers will not accept certificates without SCTs. >Reducing load on exit nodes is a technical benefit that's in that blog post. This hasn't been a real benefit for years. Exit nodes are running at something like 10% capacity. >Another benefit to using Tor onion services for large sites is that the Tor circuit ID can be used as an additional key in an IP rate limit cache. This helps block Tor bots (on the basis that establishing a Tor circuit is expensive). This is just another problem with hidden services. Opening circuits costs malicious clients far less cpu time than it costs the server.
- hpcoke 5y ago> This hasn't been a real benefit for years. Exit nodes are running at something like 10% capacity. https://metrics.torproject.org/bandwidth-flags.html https://metrics.torproject.org/bandwidth-flags.html corroborates what you say about utilitisation. Exit nodes are legally difficult to host in many countries, which reduces diversity, which is a risk. Onion services avoid the need the exit nodes, and thus the diversity risk. > This is just another problem with hidden services. Opening circuits costs malicious clients far less cpu time than it costs the server. I had a look for this but couldn't find it.
- JulianMorrison 5y agoHiding the server IP is probably quite important when you want to get around nation states trying to blockade factual information.
- p4bl0 5y agoIt is possible to advertise your .onion address and offer automatic redirect to it for Tor Browser users using the "Onion-Location" HTTP header. Example with my personal home page: $ curl -I https://pablo.rauzy.name/ HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Thu, 10 Mar 2022 14:04:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2843 Last-Modified: Sun, 23 Jan 2022 22:21:41 GMT Connection: keep-alive Onion-Location: http://c2fk5i7jqn7am7nfo7eb7hwrkclyj3jj4qcwgdh6ievp7v5ie4gd3mid.onion/ It would be interesting to try to see if the Tor Browser has a TOFU policy and warn its user if the onion address change after they visited the site once. If it is the case then you combine the ease of access of typing a normal domain name and the Onion security through an HSTS equivalent mechanism.
- kingcharles 5y agoIs there some sort of attack possible here where you could hand out unique onion addresses to each visitor, so when they connect with Tor you could fingerprint their Tor connection and match it to their cleartext connection? *takes off his black hat*
- Sami_Lehtinen 5y ago> “.onion” address demands that the person is using a TorBrowser Actually this is not true. Tor runs as SOCKS5 proxy, and you can use any browser or application with it.
- djdjfhsje33edh 5y agoAnother good reason is that Twitter launching an onion address has given Tor a lot of positive press in the mainstream media for a change.
- Tepix 5y agoOne reason that i haven't mentioned today is forcing users to use tor by only publishing a .onion address.
- moltke 5y agoIt's much harder to deanonymize people who are connecting to hidden services because they don't have to use exit relays which are often illegal to run.
- _8j50 5y agoHeh. An article for a two word answer: Tor exits.