12 ms·

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit. [0]: Search for HiddenServiceSingleHopMode on https://2019.www.torproject.org/docs/tor-manual.html.en https://2019.www.torproject.org/docs/tor-manual.html.en or just use the following config options SOCKSPort 0 HiddenServiceNonAnonymousMode 1 HiddenServiceSingleHopMode 1

stingraycharles 5y ago
For my understanding, usually establishing a connection with a hidden service involves two separate Tor circuits: one circuit for the visitor, but another full circuit for the hidden service. This “Non Anonymous Mode” effectively omits the second circuit, and allows relays to connect directly to the hidden service’s IP address, thus significantly improving latency and reducing the strain on the Tor network?
- bauruine 5y ago
  Yes that's correct.
- zekica 5y ago
  That is correct, but note that not all tor nodes are exit nodes, so latency will be increased but troughput may even be better.
  - stingraycharles 5y ago
    Ah right, so what you’re saying is that hidden services don’t need Exit relays for hidden services at all, and as such do not have the bottleneck issues that usually plague exit nodes.
    - deleted 5y ago
      [deleted]
brnt 5y ago
If I use Onionshare, where do I set this?
ycuser2 5y ago
I'm using Tor to access my local network services through hidden services. Since I don't need to hide my IP address I'm going to follow your advice gratefully. Didn't know that's possible.
- steerablesafe 5y ago
  Any reason you don't use some kind of VPN solution for that instead?
  - ycuser2 5y ago
    Hidden services are very easy to configure (the basic config, if you want to be as anonym as possible you have to do more). Install tor, add a few lines to config, done. And: You don't have to change your firewall settings at all. Nothing is exposed to the clearnet. You can also make your service be accessible only to certain clients which have a certificate. I consider this very secure.
    - steerablesafe 5y ago
      I guess I can understand that from an ease of configuration standpoint. Having said that I had no trouble with setting up zerotier VPN, which is also very easy to configure.
      - Karrot_Kream 5y ago
        I do the same but you still need to be careful when running Zerotier to listen only on IP addresses that the ZT link is assigned. I run a private mailserver and I've made sure that there are no sockets listening on any non-ZT externally routable IP address. (I guess for good measure I could have nftables drop traffic coming in on those ports on my WAN link.) But with Tor you just point it to a service listening on 127.0.0.1 or [::1] and you're in business. For me ZT is fine, but for folks who want to muck around a bit less, I can see the appeal of Tor.
    - heavyset_go 5y ago
danuker 5y ago
You are not just reducing load, you are also reducing anonymity for other participants. The extra hops make it harder to analyze the data overall.
- goodpoint 5y ago
  Citation needed! Any timing correlation attack carried on against entry and exit nodes is independent from the number of hops.
- bauruine 5y ago
  Could you please post a source for this? The only thing i could find is from the man page "However, the fact that a client is accessing a Single Onion rather than a Hidden Service may be statistically distinguishable." but I'm not sure what exactly the impact is from that.
Terry_Roll 5y ago
Tor is not anonymous just like VPN's are not anonymous when you have 5eyes oversight of the network. Its like watching trucks navigating around the road network, you can see the junctions they take and you can see where they start and end, but you cant see the contents of the truck. The Road network and internet have an awful lot in common!

stingraycharles 5y ago

For my understanding, usually establishing a connection with a hidden service involves two separate Tor circuits: one circuit for the visitor, but another full circuit for the hidden service. This “Non Anonymous Mode” effectively omits the second circuit, and allows relays to connect directly to the hidden service’s IP address, thus significantly improving latency and reducing the strain on the Tor network?

bauruine 5y ago
Yes that's correct.
zekica 5y ago
That is correct, but note that not all tor nodes are exit nodes, so latency will be increased but troughput may even be better.
- stingraycharles 5y ago
  Ah right, so what you’re saying is that hidden services don’t need Exit relays for hidden services at all, and as such do not have the bottleneck issues that usually plague exit nodes.
  - deleted 5y ago
    [deleted]

brnt 5y ago

If I use Onionshare, where do I set this?

ycuser2 5y ago

I'm using Tor to access my local network services through hidden services. Since I don't need to hide my IP address I'm going to follow your advice gratefully. Didn't know that's possible.

steerablesafe 5y ago
Any reason you don't use some kind of VPN solution for that instead?
- ycuser2 5y ago
  Hidden services are very easy to configure (the basic config, if you want to be as anonym as possible you have to do more). Install tor, add a few lines to config, done. And: You don't have to change your firewall settings at all. Nothing is exposed to the clearnet. You can also make your service be accessible only to certain clients which have a certificate. I consider this very secure.
  - steerablesafe 5y ago
    I guess I can understand that from an ease of configuration standpoint. Having said that I had no trouble with setting up zerotier VPN, which is also very easy to configure.
    - Karrot_Kream 5y ago
      I do the same but you still need to be careful when running Zerotier to listen only on IP addresses that the ZT link is assigned. I run a private mailserver and I've made sure that there are no sockets listening on any non-ZT externally routable IP address. (I guess for good measure I could have nftables drop traffic coming in on those ports on my WAN link.) But with Tor you just point it to a service listening on 127.0.0.1 or [::1] and you're in business. For me ZT is fine, but for folks who want to muck around a bit less, I can see the appeal of Tor.
  - heavyset_go 5y ago

danuker 5y ago

You are not just reducing load, you are also reducing anonymity for other participants. The extra hops make it harder to analyze the data overall.

goodpoint 5y ago
Citation needed! Any timing correlation attack carried on against entry and exit nodes is independent from the number of hops.
bauruine 5y ago
Could you please post a source for this? The only thing i could find is from the man page "However, the fact that a client is accessing a Single Onion rather than a Hidden Service may be statistically distinguishable." but I'm not sure what exactly the impact is from that.

Terry_Roll 5y ago

Tor is not anonymous just like VPN's are not anonymous when you have 5eyes oversight of the network. Its like watching trucks navigating around the road network, you can see the junctions they take and you can see where they start and end, but you cant see the contents of the truck. The Road network and internet have an awful lot in common!