4 ms·

Has anyone tried using TOR as a replacement for Cloudflare DDOS protection? There is a single hop mode on hidden services.

genpfault 3y ago
> There is a single hop mode on hidden services. These[0][1][2]? [0]: https://blog.torproject.org/whats-new-tor-0298/ https://blog.torproject.org/whats-new-tor-0298/ [1]: https://2019.www.torproject.org/docs/tor-manual.html.en#HiddenServiceSingleHopMode https://2019.www.torproject.org/docs/tor-manual.html.en#Hidd... [2]: https://2019.www.torproject.org/docs/tor-manual.html.en#HiddenServiceNonAnonymousMode https://2019.www.torproject.org/docs/tor-manual.html.en#Hidd...
- favflam 3y ago
  Yes, this feature. It seems like a cheap way to put a bunch of servers between yourself and connecting users with built-in rate limiting.
ThreeHopsAhead 3y ago
[dead]
ThrowawayTestr 3y ago
Yes, kiwifarms still exists on the deep web.
LinuxBender 3y ago
I've run it in NonAnonymous mode as an experiment. Not to replace a CDN for DDoS protection but to replace the CDN as a way to anonymize where the server is because people play games to try to cancel hosting accounts when they get mad about topics being discussed. When they can't control the narrative they will start emailing abuse@ making false claims and some hosting providers are lazy. From the DDoS aspect, people could send Tor to 100% CPU but the httpd server wasn't even passing 1% CPU. This was long ago however so this observation is likely outdated. early days of v3 Nobody was able to decloak the server even being in NonAnonymous mode but the bigger issue was the ability to reach the server. At least at the time not many people had a browser that could talk to .onion sites. I don't know how many people use Brave or the Tor Browser these days so maybe now it would be less of an issue now. Maybe I will try it again soon. It's easy to send people to the Tor Onion version of your site using the Onion-Location header [1] to see how many people would be able to reach the .onion side of your site. [1] - https://community.torproject.org/onion-services/advanced/onion-location/ https://community.torproject.org/onion-services/advanced/oni...
- theblazehen 3y ago
  I've done a POC before where the main site was a tor hidden service, and I had cheap VPSs acting as a clearnet reverse proxy to it

genpfault 3y ago

> There is a single hop mode on hidden services. These[0][1][2]? [0]: https://blog.torproject.org/whats-new-tor-0298/ https://blog.torproject.org/whats-new-tor-0298/ [1]: https://2019.www.torproject.org/docs/tor-manual.html.en#HiddenServiceSingleHopMode https://2019.www.torproject.org/docs/tor-manual.html.en#Hidd... [2]: https://2019.www.torproject.org/docs/tor-manual.html.en#HiddenServiceNonAnonymousMode https://2019.www.torproject.org/docs/tor-manual.html.en#Hidd...

favflam 3y ago
Yes, this feature. It seems like a cheap way to put a bunch of servers between yourself and connecting users with built-in rate limiting.

ThreeHopsAhead 3y ago

[dead]

ThrowawayTestr 3y ago

Yes, kiwifarms still exists on the deep web.

LinuxBender 3y ago

I've run it in NonAnonymous mode as an experiment. Not to replace a CDN for DDoS protection but to replace the CDN as a way to anonymize where the server is because people play games to try to cancel hosting accounts when they get mad about topics being discussed. When they can't control the narrative they will start emailing abuse@ making false claims and some hosting providers are lazy. From the DDoS aspect, people could send Tor to 100% CPU but the httpd server wasn't even passing 1% CPU. This was long ago however so this observation is likely outdated. early days of v3 Nobody was able to decloak the server even being in NonAnonymous mode but the bigger issue was the ability to reach the server. At least at the time not many people had a browser that could talk to .onion sites. I don't know how many people use Brave or the Tor Browser these days so maybe now it would be less of an issue now. Maybe I will try it again soon. It's easy to send people to the Tor Onion version of your site using the Onion-Location header [1] to see how many people would be able to reach the .onion side of your site. [1] - https://community.torproject.org/onion-services/advanced/onion-location/ https://community.torproject.org/onion-services/advanced/oni...

theblazehen 3y ago
I've done a POC before where the main site was a tor hidden service, and I had cheap VPSs acting as a clearnet reverse proxy to it