4 ms·

Question: why are torrent sites not generally run as a Tor hidden-site backend (that can therefore be accessed through any existing Tor public-web gateway, rath

by derefr 3y ago

Question: why are torrent sites not generally run as a Tor hidden-site backend (that can therefore be accessed through any existing Tor public-web gateway, rather than needing to set up its own proxies) plus an IPFS-hosted SPA frontend (that can therefore rely on any IPFS web gateway, and can then point as many arbitrary human-readable DNSLink names at that IPFS CID as it wishes)? Is it just because the web piracy community predates these technologies?

CodesInChaos 3y ago
I'm pretty sure sure pirate-bay is an onion site exposed via a cloudflare gateway. You can use the onion service directly (and presumably through whichever gateway you want).
- plagiarist 3y ago
  Cloudflare can work over TOR? I'm only familiar with the services they offer opening a tunnel across regular internet.
  - stavros 3y ago
    Yes it can, they have support for terminating TOR so you don't go over the public internet.
charcircuit 3y ago
To be more accessible and because they don't have to.
stevefan1999 3y ago
Because it was veeeeeeeeery slow to me. As someone in East Asia, you are lucky if you can load a hidden service under 10 seconds. First we should briefly talk about how hidden services work. You have a very long address encoding the portions of a HS public key, which is stored in a special directory (HSDir), and due to the P2P nature of Tor, that basically becomes a DHT/Torrent Tracker which draws parallel to a DNS service. Then you initiate a rendezvous request in HSDir to request a contact with the hidden service. The hidden service noticed the HSDir updated, then arranges a Tor circuit (of arbitrary length) and then write back to HSDir to tell the requesters to contact via that new circuit which this information will ultimately be signed with the hidden service's private key as a proof of identity so MITM is impossible (like bootleg TLS, or a mock PKI actually) As you noticed there would be at least three user circuits involved: the hidden service to Tor itself, the Tor end user, and the hidden service relay circuits (I would like to call that a transit tunnel, the middleman). The more the circuits and relays in between, the more likely your data will fly around the world, and too many circuits is the intrinsic reason why hidden services are very slow. Recall that each circuit is a linked list and to decrypt the data cells you have to wait for the "pipe" to flow back and forth serially. A to B to C, and C to B to A on back. Due to this recursive relation, no relay preemption is allowed. Keep in mind the real torspec is very complicated (that took me a few days) and I tried to make a gist for you, and in reality this may not be accurate up to date. Adding insults to injury, the vast majority of Tor relays are dominantly located in US and EU, and there are barely any Asian Tor operators like me, let alone exit node operators. This caused a serious "geofragmentation"/"geopartition" where one group of people have degraded services over the others. Fortunately, if your sites are mostly static or deterministic without any serverside dynamic and fancy UI (cough cough PHP and Ruby), given enough patient I would still got what I want. Just that it would have took it for me to be longer than others. That is why I think SPA and PWA, both client-side oriented application on such a low rate network like Tor hidden service, and abstracting server interaction as low overhead APIs such as gRPC and ttrpc, would be very useful as I was experimenting it before, but most people uses Tor Browser, they would likely be disabling JS with NoScript for...security reasons. They are really afraid there will be 0days in the JS engine that would pop them a dropper. There are couple of heap spraying 0days in V8 but so far Greasemonkey is fine...
- ShowalkKama 3y ago
  >Then you initiate a rendezvous request in HSDir to request a contact with the hidden service. >The hidden service noticed the HSDir updated, then arranges a Tor circuit (of arbitrary length) and then write back to HSDir to tell the requesters to contact via that new circuit which this information will ultimately be signed with the hidden service's private key as a proof of identity so MITM is impossible (like bootleg TLS, or a mock PKI actually) this sounds wrong. As far as I know the HS picks some nodes as introduction points and builds long losting circuits to them abd publishes them in ita descriptor. when a client wants to connect it fetches the list of IPs, it picks a random node as rendezvous and, via the IP, tells the HS about it which connects to it to allow communication (basically you -> rendezvous <- HS (+ a bunch of other nodes that blindly carry traffic for anonimization as is customs with tor))
  - stevefan1999 3y ago
    ah, looks like we got a Tor expert here. I realize I flipped the rendezvous relationship. Well, I got into Tor 5 years ago as a freshmen trying to replicate Tor in Rust, and I got to say my details are murky now.
    - pluto_modadic 3y ago
      https://community.torproject.org/onion-services/overview/ https://community.torproject.org/onion-services/overview/ onion service picks nodes which will act as introduction points, signs them and uploads the descriptor to the DHT client finds that record on the DHT, picks a random node (from all of Tor) and gives it a secret, then encrypts a message to the hidden service (via one of those introduction points) with the key hidden service makes its own circuit to the random node the person picked, tells the node the passphrase, and then the client & service do some E2EE communication (though, at the rendezvous point it's just the single handshake / one layer of encryption... so being a rendezvous node is a big job, just like HSdirs or guards)
- rightbyte 3y ago
  10s? Sounds like the v56 days. If the site is designed for it, with alot of info on each page, it should work fine but I guess most are not?
fsflover 3y ago
It is not sufficient to serve the torrent files (or magnet links) anonymously: you will leak your IP unless you also download the actual files through darknet. However, Tor project does not recommend to use Tor for that: https://support.torproject.org/#misc_misc-4 https://support.torproject.org/#misc_misc-4. The actual solution is torrenting through I2P: https://geti2p.net https://geti2p.net. They support it out of the box and there are a few good trackers.

by derefr 3y ago

CodesInChaos 3y ago

I'm pretty sure sure pirate-bay is an onion site exposed via a cloudflare gateway. You can use the onion service directly (and presumably through whichever gateway you want).

plagiarist 3y ago
Cloudflare can work over TOR? I'm only familiar with the services they offer opening a tunnel across regular internet.
- stavros 3y ago
  Yes it can, they have support for terminating TOR so you don't go over the public internet.

charcircuit 3y ago

To be more accessible and because they don't have to.

stevefan1999 3y ago

Because it was veeeeeeeeery slow to me. As someone in East Asia, you are lucky if you can load a hidden service under 10 seconds. First we should briefly talk about how hidden services work. You have a very long address encoding the portions of a HS public key, which is stored in a special directory (HSDir), and due to the P2P nature of Tor, that basically becomes a DHT/Torrent Tracker which draws parallel to a DNS service. Then you initiate a rendezvous request in HSDir to request a contact with the hidden service. The hidden service noticed the HSDir updated, then arranges a Tor circuit (of arbitrary length) and then write back to HSDir to tell the requesters to contact via that new circuit which this information will ultimately be signed with the hidden service's private key as a proof of identity so MITM is impossible (like bootleg TLS, or a mock PKI actually) As you noticed there would be at least three user circuits involved: the hidden service to Tor itself, the Tor end user, and the hidden service relay circuits (I would like to call that a transit tunnel, the middleman). The more the circuits and relays in between, the more likely your data will fly around the world, and too many circuits is the intrinsic reason why hidden services are very slow. Recall that each circuit is a linked list and to decrypt the data cells you have to wait for the "pipe" to flow back and forth serially. A to B to C, and C to B to A on back. Due to this recursive relation, no relay preemption is allowed. Keep in mind the real torspec is very complicated (that took me a few days) and I tried to make a gist for you, and in reality this may not be accurate up to date. Adding insults to injury, the vast majority of Tor relays are dominantly located in US and EU, and there are barely any Asian Tor operators like me, let alone exit node operators. This caused a serious "geofragmentation"/"geopartition" where one group of people have degraded services over the others. Fortunately, if your sites are mostly static or deterministic without any serverside dynamic and fancy UI (cough cough PHP and Ruby), given enough patient I would still got what I want. Just that it would have took it for me to be longer than others. That is why I think SPA and PWA, both client-side oriented application on such a low rate network like Tor hidden service, and abstracting server interaction as low overhead APIs such as gRPC and ttrpc, would be very useful as I was experimenting it before, but most people uses Tor Browser, they would likely be disabling JS with NoScript for...security reasons. They are really afraid there will be 0days in the JS engine that would pop them a dropper. There are couple of heap spraying 0days in V8 but so far Greasemonkey is fine...

ShowalkKama 3y ago
>Then you initiate a rendezvous request in HSDir to request a contact with the hidden service. >The hidden service noticed the HSDir updated, then arranges a Tor circuit (of arbitrary length) and then write back to HSDir to tell the requesters to contact via that new circuit which this information will ultimately be signed with the hidden service's private key as a proof of identity so MITM is impossible (like bootleg TLS, or a mock PKI actually) this sounds wrong. As far as I know the HS picks some nodes as introduction points and builds long losting circuits to them abd publishes them in ita descriptor. when a client wants to connect it fetches the list of IPs, it picks a random node as rendezvous and, via the IP, tells the HS about it which connects to it to allow communication (basically you -> rendezvous <- HS (+ a bunch of other nodes that blindly carry traffic for anonimization as is customs with tor))
- stevefan1999 3y ago
  ah, looks like we got a Tor expert here. I realize I flipped the rendezvous relationship. Well, I got into Tor 5 years ago as a freshmen trying to replicate Tor in Rust, and I got to say my details are murky now.
  - pluto_modadic 3y ago
    https://community.torproject.org/onion-services/overview/ https://community.torproject.org/onion-services/overview/ onion service picks nodes which will act as introduction points, signs them and uploads the descriptor to the DHT client finds that record on the DHT, picks a random node (from all of Tor) and gives it a secret, then encrypts a message to the hidden service (via one of those introduction points) with the key hidden service makes its own circuit to the random node the person picked, tells the node the passphrase, and then the client & service do some E2EE communication (though, at the rendezvous point it's just the single handshake / one layer of encryption... so being a rendezvous node is a big job, just like HSdirs or guards)
rightbyte 3y ago
10s? Sounds like the v56 days. If the site is designed for it, with alot of info on each page, it should work fine but I guess most are not?

fsflover 3y ago

It is not sufficient to serve the torrent files (or magnet links) anonymously: you will leak your IP unless you also download the actual files through darknet. However, Tor project does not recommend to use Tor for that: https://support.torproject.org/#misc_misc-4 https://support.torproject.org/#misc_misc-4. The actual solution is torrenting through I2P: https://geti2p.net https://geti2p.net. They support it out of the box and there are a few good trackers.