13 ms·

Proof-of-Work Defense for Onion Services

375 points by simonpure 3y ago

pawelduda 3y ago
What's preventing abusers from getting new identities when the PoW kicks in and continuing the DDoS? Edit: looks like PoW is set per "service" that's under attack rather than client?
- deleted 3y ago
  [deleted]
- bombcar 3y ago
  It’s per service and it goes from being able to overwhelm an onion to having to exert more computing usage than the server does serving you. It helps.
- LordDragonfang 3y ago
  Correct. PoW is also per request, so identity (new or old) is irrelevant.
- kragen 3y ago
  right, it's not per client; if it was per client you could just ban the abusive clients instead of asking them for pow. anonymity (or freely available new identities) mean that attackers can use a sybil attack to deny service via capacity overload
hbfdhfdhadfhnfa 3y ago
I though that its the last hop that operators control and they can intercept the traffic thats the problem. but this only saves them money and costs the users more when energy is expensive
- cypherpunks01 3y ago
  With regular Tor > Web traffic, yes the exit relay (last hop) is able to tell the destination and can gather other metadata or intercept/modify unencrypted traffic. With Onion Services however, there is no exit relay. Services are encrypted end to end between the client and the hidden service.
- dylkil 3y ago
  It limits denial of services attacks on onion services
quickthrower2 3y ago
Hold on you just made DoS more expensive, but a hell of alot more effective. If I need a RTX4090 to access your site now, the attacker has succeeded.
- codetrotter 3y ago
  There are PoW algorithms specifically developed to resist GPU and ASIC. Typically they do this by being memory intensive instead of (or in addition to) being compute intensive.
  - hsbauauvhabzb 3y ago
    The article itself lacks details on what proof of work actually is - based on your answer I’m assuming compute rather than captcha. Is there any example algorithms that are easy to understand? I’m curious to see an algo that’s expensive for the client but cheap for the server to verify, I assume it involves reversing an equation or similar?
    - whimsicalism 3y ago
      Pretty much any NP problem that we can't currently solve in polynomial time, ie. prime factorization - can be a PoW. I'm not sure which are specialized for GPU-resistance, probably not prime factorization given it can be parallelized
    - checkdrain 3y ago
      Equihash (Birthday Problem): Memory Hardness https://en.m.wikipedia.org/wiki/Equihash https://en.m.wikipedia.org/wiki/Equihash RandomX (Execution of a random program): Memory Hardness (Inc. cache sizes), Speculative Execution/Branching, ILP, some sort of chaining https://github.com/tevador/RandomX/blob/master/doc/design.md https://github.com/tevador/RandomX/blob/master/doc/design.md Edit: these are examples of CPU-bound PoW. But the general idea with PoW is that you have some hash-like function H() with no known inverse function such that the only feasible way to determine the output is just running the function. The client runs H(x) with a different input x every time. If the output is a high enough number, the server lets the client though. The server runs H() to verify, and this is easy to parallelize. But in order to get through the server, the client must run H() many times on average. Also server provides a salt to prevent the client from reusing their old hashes. And the server usually indicates how high the output of H() must be (this is called the difficulty).
extraduder_ire 3y ago
I'm surprised something like this wasn't done sooner, and also haven't read the proposal [0] in enough detail to tell if this will lead to more data affecting the anonymity of users. Should be fine though, since it's tied user-to-service and not stored anywhere. I'm wondering how much this will decrease load on the service being proxied vs the nodes themselves though, I assume it'll have more benefit to services since access is spread out between multiple nodes. [0]: https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/proposals/327-pow-over-intro.txt https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/p...
- KirillPanov 3y ago
  > I'm surprised something like this wasn't done sooner, It should have been, but was delayed by people shrieking about oceans boiling.
  - evgen 3y ago
    FWIW, we talked about using things like hashcash to prevent abuse and similar attacks for anonymous remailers back in the early 90s. Talking about it is one thing, actually making the commitment to do it is something else entirely. Given interest in cryptocurrencies there has also been a lot more effort devoted to considering the cost/feature tradeoffs of various PoW mechanisms (and a broader familiarity with the general concept among the target population), so it is possible that we are seeing a happy side-effect of years of cryptocurrency hype.
  - flangola7 3y ago
    >shrieking No one is doing any such thing.
    - alphaddx 3y ago
      Someone is shrieking about it in the thread above. >salawat >PoW is nothing but wasted, needless computation. Computing is not free. Every watt spent doing anything PoW is just that much more intensification of our current climate crisis. >As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect, fuck anyone who proposes PoW is a good idea for anything. >It isn't interesting. It's the most egregious example of conspicuous consumption on the planet.
Animats 3y ago
This has been suggested before, for email spam. Cloudflare could do this, too. Every time you access a busy site, seconds to minutes of useless crunching. The overall effect would be to drain batteries worldwide.
- sneak 3y ago
  The suggestion for PoW for email bonds was called Hashcash, by Adam Back, and involved partial hash collisions. http://www.hashcash.org/ http://www.hashcash.org/ It served as the inspiration for Bitcoin's PoW mining, interestingly enough.
  - drfuchs 3y ago
    The original invention of PoW, as well as the idea of using it for email, was years earlier; see Naor and Dwork's "Pricing via Processing, Or, Combatting Junk Mail" in CRYPTO'92.
- dnstalk 3y ago
  Just like ads! They wear your battery but without your consent
- ivirshup 3y ago
  Hey, that's not a fair assessment. It would also dump greenhouse gasses into the atmosphere.
- bombcar 3y ago
  Cloud flare does do this. You get a screen saying checking your connection and it’s running hashes in your browser.
  - kragen 3y ago
    is it really running hashes, or is it probing your browser to see if your video card drivers look like phantomjs
    - 3y ago
hedora 3y ago
The article says that there is only a factor of 6 in solution time between a high end server and low end phone. How is that possible? The server likely has much more than 6x the ram and cpu count (and faster cpus) than the phone. Also, since it is DDOSing, the server’s work is embarrassingly parallel, but the client work isn’t necessarily parallelized at all. Even if it is only a factor of 6 (or one) they are talking about 1 minute solve times once a DDOS is detected. At that point the service is basically down anyway, right?
- 8organicbits 3y ago
  A good explanation of the algorithm is here: https://github.com/tevador/equix/blob/master/devlog.md https://github.com/tevador/equix/blob/master/devlog.md > they are talking about 1 minute solve times once a DDOS is detected. The point of this is to prevent an existing easy DoS attack (introduction flooding) into a partial outage/slow down. It's an incremental improvement on a hard problem.
- bawolff 3y ago
  > The article says that there is only a factor of 6 in solution time between a high end server and low end phone. How is that possible? The server likely has much more than 6x the ram and cpu count (and faster cpus) than the phone. The limiting factor if equihash is allegedly memory bandwidth, which maybe doesn't vary that much between srrvers and phones.
- zacmps 3y ago
  I suspect they're off by at least an order of magnitude in that estimate, if not two (or more if GPU acceleration is possible).
  - kragen 3y ago
    gpus don't have more memory bandwidth, which is why they're using a memory-hard problem
1vuio0pswjnm7 3y ago
How will the service operator know when their site is under "stress". Will this effectively prevent someone from having a "high traffic" hidden service free from Tor-imposed puzzles. If the hidden service operator is aware that the site is receiving high traffic, could the operator run several sites as mirrors, so that users had options if, e.g., one site was not responding fast enough. Is there guidance published anywhere on what is the the "normal" traffic for a hidden service.
- 8organicbits 3y ago
  > When the subsystem is enabled, suggested effort is continuously adjusted and the computational puzzle can be bypassed entirely when the effort reaches zero.
- solarpunk 3y ago
  >If the hidden service operator is aware that the site is receiving high traffic, could the operator run several sites operating as mirrors, so that users had options if, e.g., one site was not responding fast enough. Is there guidance published anywhere on what is the the "normal" traffic for a service. I think this[1] would help. [1]https://onionbalance.readthedocs.io/en/latest/ https://onionbalance.readthedocs.io/en/latest/
- 1vuio0pswjnm7 3y ago
  From the onionbalance site https://www.benthamsgaze.org/wp-content/uploads/2015/11/sucu-torscaling.pdf https://www.benthamsgaze.org/wp-content/uploads/2015/11/sucu...
marcodiego 3y ago
I have an idea to minimize traffic on the tor network or make it faster. It should be possible to use the network as a cdn. If I want to make a file available, it should be possible for me to send pieces of the file to nodes who gave me permission to do so. When the file is requested, I then could point to these nodes. Of course, some care should be taken not to turn the tor network into a "anonymous torrent replacement" to avoid defeating its purpose. The current proposal discussed in the post talks about "prioritize verified network traffic". It would be interesting if sharing "file pieces" could prioritize your traffic since you're actually helping the network. Instead of "proof-of-work" it would be "proof-of-bandwidth-contribution".
- bawolff 3y ago
  That's kind of more the freenet model (content based), where tor is traditionally anonoymous TCP real time networking. I dont really see how it minimizes traffic on the network though. You still have to talk to the CDN nodes.
  - marcodiego 3y ago
    You're right. This doesn't minimizes traffic, it distributes it.
8organicbits 3y ago
Really interesting! Digging into the proposal [1]: > make it harder for attackers to overload the service with introduction request > We hope that this proposal can help us defend against the script-kiddie attacker and small botnets. Sets expectations: does not counter large botnets. > We hope that this proposal will allow the motivated user to always connect A user who really wants to connect can get through durring a DoS attack, but it may still take work. Interesting choice of PoW algorithm: https://github.com/tevador/equix https://github.com/tevador/equix > Hence, instead of forcing clients to go below a static target like in Bitcoin to be successful, we ask clients to "bid" using their PoW effort. Effectively, a client gets higher priority the higher effort they put into their proof-of-work. This is similar to how proof-of-stake works but instead of staking coins, you stake work. [1] https://gitlab.torproject.org/tpo/core/torspec/-/raw/main/proposals/327-pow-over-intro.txt https://gitlab.torproject.org/tpo/core/torspec/-/raw/main/pr...
- salawat 3y ago
  So now you have the drawbacks of both as well, in that the guy who has the most compute to use as a toaster can DoS everyone else. Plus, PoW is nothing but wasted, needless computation. Computing is not free. Every watt spent doing anything PoW is just that much more intensification of our current climate crisis. As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect, fuck anyone who proposes PoW is a good idea for anything. It isn't interesting. It's the most egregious example of conspicuous consumption on the planet.
  - thechao 3y ago
    Maybe we can ask the DoSers to stop, nicely? Everything else being equal, I bet the Tor/Onion-folk are pretty smart people, and this is what they felt was necessary to keep the service running.
    - maest 3y ago
      > Everything else being equal, I bet the Tor/Onion-folk are pretty smart people, and this is what they felt was necessary to keep the service running. That's an appeal to authority and an attempt to shut down inquisitive thought and investigation. Imo, this goes against the spirit of HN.
bawolff 3y ago
The better article (real technical details) is https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/proposals/327-pow-over-intro.txt https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/p... Appearently the PoW function they chose is equi-X.
bunabhucan 3y ago
I wonder if it would be possible to securely offload some of the aes processing to the proof of work cpus. Or make ddos requestors perform a fourth layer of encryption/routing, possibly of data, possibly noise.
favflam 3y ago
Nice. Pretty soon, we won't need CDNs for DDOS protection. We just serve API through Onion services.
zmmmmm 3y ago
As others have commented, it's a shame there isn't a proof of work that doesn't also hurt the planet. It makes me wonder if there would ever be a way to actually do the opposite - your "proof of work" is somehow linked to extracting CO2 from the atmosphere?
- hunter2_ 3y ago
  If you sell carbon credits, the money you make doing so is proof that you did it (well, it's proof that you did something of value, which could also count).
- pcdoodle 3y ago
  We helped secure the bitcoin network and prevented our basement pipes from freezing around 5 years ago (Old building, new heat pumps installed for 1st and 2nd floor. The old basement steam boiler being removed lead to really low basement temps). Resistive heat was the only option down there. After improvements (water heater + circulation fan + insulation), we shipped the miner to a buyer from a hydro facility to burn excess watts for the rest of its life. Don't hate on the BTC crowd, some of us also care about ecological load.
m3kw9 3y ago
So there needs to be a token to be mined as an incentive? Lol
remote_phone 3y ago
I freaking love new ideas like this! This is the beauty of computer science, anything is possible if you’re smart enough and willing to work hard!
Uptrenda 3y ago
I'm wondering if there is a more elegant way to solve sybil attacks here. For example: many CPUs are provisioned with key pairs that are unique to the processor and can be verified with the CA root cert of the issuer (Intel, AMD, etc.) You could tie PoW to successive signing and allow it to be verified in parallel. Then the operation couldn't be parallelized to a botnet as all PoWs would be unique to a CPU. It seems that they're targeting memory as a way to make it more costly for botnets. I think that there are many other ways to help minimize this attack scenario, too. The same logic could also be applied to mobile phones using ESIM. Later authentication with the mobile network uses public key crypto so I feel like you could also do unique proofs there, too. This is just a throw away comment though. I am probably missing obvious problems with this scheme.
- keyle 3y ago
  "Waiting for pair client connection". That'd be something. Interesting thought but I can imagine a range of issues. In the same vein, how about the server would hold a pool of IPs in which the client has to return a proof of port knocking? e.g. here is a token, send that to this IP:port and wait for a unique response I can verify. Call this proof of latency. It would be low CPU, would spread the load across various machines and ports. On the downside, of course, you need multiple IPs and potentially servers. It could be implemented on the same machine but that would shift the cpu load to port connections.
  - dmurray 3y ago
    What does this prove about the client? Just that they have a reasonably fast connection (which in TOR-world can be painful to achieve), not that they aren't part of a botnet. It allows you to scale your workload, but "just pay for more servers and outscale the attacker" isn't generally an acceptable way to deal with DDOS.
- nsvd 3y ago
  Of course, this wouldn't work if you don't trust Intel, AMD, etc's certificate, and I don't see why you would in this application.
- 3y ago
IngvarLynn 3y ago
It's a shame that Torproject has decided to reinvent its own wheel, lagging 10 years behind the crypto crowd, instead of integrating with existing coin(s). The problem is, such integration would require the chosen coin to be anonymous, which is essentially forbidden: https://www.theverge.com/2023/8/23/23843161/tornado-cash-indictment-conspiracy-north-korea-money-laundering https://www.theverge.com/2023/8/23/23843161/tornado-cash-ind...
- pyinstallwoes 3y ago
  What? Adopting a coin is nonsense. Your argument is also invalid based on the amount of coins that exist, each reinventing POW.
- Proven 3y ago
  [dead]
- Zuiii 3y ago
  I agree with you in principle. Wasting energy like what this and hashcash do is unfortunate but that's what happens when you have an irrational hate towards a technology rather than how it is used. That said, modeling it after a general cryptocurrency is probably a bad idea since it rising prices may prevent legitimate clients from being able to connect to onion services due to the challenge being too expensive (either in terms of computation or accusation). I think a much practical approach is to have each visitor contribute to a partial solution that can then be combined to derive funds (much like how mining pools work). That way, clients will be completely isolated from cryptocurrency and sites can actually benefit from the work rather than just throwing it away. It's a win-win situation. I hope the next generation learns from our senseless technology-burnings.
  - IngvarLynn 3y ago
    >modeling it after a general cryptocurrency is probably a bad idea Not modelling after but integrating of an existing one. Because this saves massive amount of engineering effort. >rising prices may prevent legitimate clients from being able to connect to onion services due to the challenge being too expensive Obviously, the price for legitimate clients would be much cheaper, as their requests shall be placed in the middle of priority queue (clients can wait a few seconds) while the attacker have to occupy the very top of this queue all the time. Also note that the bigger the DDoS in this scheme - the bigger profits server could make, which he could spend on expanding capacity. >each visitor contribute to a partial solution that can then be combined to derive funds This scheme predates monero, which was about 10 years ago. >the next generation learns from our senseless technology-burnings. Not if they would reinvent the wheel each time instead of adapting of existing tech to current needs.
parentheses 3y ago
This is a good use of proof of work. Seems useful as it bottlenecks DDOS attacks by burdening them with having to give proof.
rmac 3y ago
wonder why they didn't implement something like privacy pass (private access tokens / private state tokens)
- basedrum 3y ago
  Wrong layer. Privacy pass is for HTTP
willvarfar 3y ago
Computers are still getting faster. With time, the POW threshold will steadily increase. So will this discriminate against those with old sluggish hardware? And is that the kind of hardware that the users in regimes that TOR is supposed to help have?
seanhunter 3y ago
Surely the DDossers will just use some of their botnets for generating the POWs? I don't think I fully understand the scheme. Is the idea that as the attack progressed this would consume more and more of their resources making an attack impractical? Surely in that scenario more and more of the real traffic's resources would be consumed by them having to solve puzzles also, so Tor would in effect be cooperating with the attackers and DDosing all of the valid clients ?
- Vecr 3y ago
  No, I think it makes the the experience strictly better for normal ("real") users. On phones it might burn too much battery, but on desktops or plugged in laptops dedicated users can configure their user agent to send in difficult proof of work submissions, getting closer to the front of the line. The actual problem starts when each individual request coming from the botnet starts submitting more proof of work then the real users can tolerate (due to taking too long), and that's where it's pretty much the same as before the DDoS protection system existed.
  - iFreilicht 3y ago
    Except now the botnets need a lot more computation and thus electrical power to generate the same amount of traffic as before, making DDoS attacks more expensive for the attacker, and less expensive for the service. I think there is a second cost aspect to this as well; right now, hacking low-powered IoT devices and making them part of your botnet is (relatively) easy and valuable, but as their computing power is quite limited, a PoW defense should make them less viable for DDoS attacks, decreasing the amount of free attack power.
- bootsmann 3y ago
  Botnets usually consist of networks of captured low spec IoT devices (mostly routers, sometimes exposed IP cams etc.). They might not have the hardware required to outbid real users in PoW.
- KirillPanov 3y ago
  > Surely the DDossers will just use some of their botnets for generating the POWs? It takes much, much, much more (proven) work to DoS a service than it does to use it normally.
shim__ 3y ago
It's a start but eventually I'd be great to add some sort of payment layer much like bitcoin lightening. If running a node pays much more people would be willing to do so.
- RuggedPineapple 3y ago
  Hah, cryptocurrency still desperately hoping to identify a problem it can solve. No thank you.
- tepmoc 3y ago
  bitcoin [lighting] is privacy nightmare
- nullc 3y ago
  Adding payments would just make sybil attacking tor profitable. And the same parties that install software to collect payments would probably be willing to run versions that double their income by reporting all their traffic to a third party attacker in exchange for payment.
popol12 3y ago
Interesting, but I don’t understand how it is better than regular captchas for this task Maybe captcha serving itself can be DDoSed, because of the image size?
- rlpb 3y ago
  Captchas require human intervention. This method is transparent for the legitimate user.
  - popol12 3y ago
    Sure, but it seems easier to defeat than captchas, especially for a big opponent like a state, which can possibly allocate enough computing power to make the difficulty target too high for regular users Whereas with captchas, the government need to pay real people to fill them, which doesn’t scale Edit: I read the paper (https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/proposals/327-pow-over-intro.txt https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/p...) and I understand what you meant. This is not meant to replace captchas but to automatically discard low profile attacks. Nice.
bornfreddy 3y ago
A bit late to the party, but... Is that not leaking information about the server? It broadcasts under how much stress the harddware is. It is probably not enough to find the exact server by itself, but still.. Like the idea otherwise.
twosdai 3y ago
I do wonder if tor would allow servers to have the difficulty to be "tuneable" so that service A with a small server but a solid fan base could have a high difficulty scaling that everyone knows about, and service B has a lower difficulty scaling but more servers behind it.
captainbland 3y ago
I think given the aims and limitations they've set for this it's a reasonable proposal and it will likely meet those objectives. As mentioned it will work for smaller botnets but larger ones will still overwhelm individual clients in terms of resource availability. Personally I dislike proof of work, it's basically bloat as a defense mechanism in this case and can obsolete older hardware fast while consuming in aggregate probably a lot of power across the devices it affects. At scale it would be quite a large environmental burden. I also think a lot of attackers will consider it a success to get it to that high difficulty as users who have to wait 1 minute of their device being 100% pegged will probably choose to disengage a lot of the time. That said it's quite a good way of mitigating DOS attacks while not doing anything to compromise user anonymity, so from that point of view it's a good solution despite the drawbacks. As it exists on tor, I don't have too much of a problem with it but I'd consider it a total disaster if applied to the regular web.

375 points by simonpure 3y ago

What's preventing abusers from getting new identities when the PoW kicks in and continuing the DDoS? Edit: looks like PoW is set per "service" that's under attack rather than client?

deleted 3y ago
[deleted]
bombcar 3y ago
It’s per service and it goes from being able to overwhelm an onion to having to exert more computing usage than the server does serving you. It helps.
LordDragonfang 3y ago
Correct. PoW is also per request, so identity (new or old) is irrelevant.
kragen 3y ago
right, it's not per client; if it was per client you could just ban the abusive clients instead of asking them for pow. anonymity (or freely available new identities) mean that attackers can use a sybil attack to deny service via capacity overload

hbfdhfdhadfhnfa 3y ago

I though that its the last hop that operators control and they can intercept the traffic thats the problem. but this only saves them money and costs the users more when energy is expensive

cypherpunks01 3y ago
With regular Tor > Web traffic, yes the exit relay (last hop) is able to tell the destination and can gather other metadata or intercept/modify unencrypted traffic. With Onion Services however, there is no exit relay. Services are encrypted end to end between the client and the hidden service.
dylkil 3y ago
It limits denial of services attacks on onion services

quickthrower2 3y ago

Hold on you just made DoS more expensive, but a hell of alot more effective. If I need a RTX4090 to access your site now, the attacker has succeeded.

codetrotter 3y ago
There are PoW algorithms specifically developed to resist GPU and ASIC. Typically they do this by being memory intensive instead of (or in addition to) being compute intensive.
- hsbauauvhabzb 3y ago
  The article itself lacks details on what proof of work actually is - based on your answer I’m assuming compute rather than captcha. Is there any example algorithms that are easy to understand? I’m curious to see an algo that’s expensive for the client but cheap for the server to verify, I assume it involves reversing an equation or similar?
  - whimsicalism 3y ago
    Pretty much any NP problem that we can't currently solve in polynomial time, ie. prime factorization - can be a PoW. I'm not sure which are specialized for GPU-resistance, probably not prime factorization given it can be parallelized
  - checkdrain 3y ago
    Equihash (Birthday Problem): Memory Hardness https://en.m.wikipedia.org/wiki/Equihash https://en.m.wikipedia.org/wiki/Equihash RandomX (Execution of a random program): Memory Hardness (Inc. cache sizes), Speculative Execution/Branching, ILP, some sort of chaining https://github.com/tevador/RandomX/blob/master/doc/design.md https://github.com/tevador/RandomX/blob/master/doc/design.md Edit: these are examples of CPU-bound PoW. But the general idea with PoW is that you have some hash-like function H() with no known inverse function such that the only feasible way to determine the output is just running the function. The client runs H(x) with a different input x every time. If the output is a high enough number, the server lets the client though. The server runs H() to verify, and this is easy to parallelize. But in order to get through the server, the client must run H() many times on average. Also server provides a salt to prevent the client from reusing their old hashes. And the server usually indicates how high the output of H() must be (this is called the difficulty).

extraduder_ire 3y ago

I'm surprised something like this wasn't done sooner, and also haven't read the proposal [0] in enough detail to tell if this will lead to more data affecting the anonymity of users. Should be fine though, since it's tied user-to-service and not stored anywhere. I'm wondering how much this will decrease load on the service being proxied vs the nodes themselves though, I assume it'll have more benefit to services since access is spread out between multiple nodes. [0]: https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/proposals/327-pow-over-intro.txt https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/p...

KirillPanov 3y ago
> I'm surprised something like this wasn't done sooner, It should have been, but was delayed by people shrieking about oceans boiling.
- evgen 3y ago
  FWIW, we talked about using things like hashcash to prevent abuse and similar attacks for anonymous remailers back in the early 90s. Talking about it is one thing, actually making the commitment to do it is something else entirely. Given interest in cryptocurrencies there has also been a lot more effort devoted to considering the cost/feature tradeoffs of various PoW mechanisms (and a broader familiarity with the general concept among the target population), so it is possible that we are seeing a happy side-effect of years of cryptocurrency hype.
- flangola7 3y ago
  >shrieking No one is doing any such thing.
  - alphaddx 3y ago
    Someone is shrieking about it in the thread above. >salawat >PoW is nothing but wasted, needless computation. Computing is not free. Every watt spent doing anything PoW is just that much more intensification of our current climate crisis. >As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect, fuck anyone who proposes PoW is a good idea for anything. >It isn't interesting. It's the most egregious example of conspicuous consumption on the planet.

Animats 3y ago

This has been suggested before, for email spam. Cloudflare could do this, too. Every time you access a busy site, seconds to minutes of useless crunching. The overall effect would be to drain batteries worldwide.

sneak 3y ago
The suggestion for PoW for email bonds was called Hashcash, by Adam Back, and involved partial hash collisions. http://www.hashcash.org/ http://www.hashcash.org/ It served as the inspiration for Bitcoin's PoW mining, interestingly enough.
- drfuchs 3y ago
  The original invention of PoW, as well as the idea of using it for email, was years earlier; see Naor and Dwork's "Pricing via Processing, Or, Combatting Junk Mail" in CRYPTO'92.
dnstalk 3y ago
Just like ads! They wear your battery but without your consent
ivirshup 3y ago
Hey, that's not a fair assessment. It would also dump greenhouse gasses into the atmosphere.
bombcar 3y ago
Cloud flare does do this. You get a screen saying checking your connection and it’s running hashes in your browser.
- kragen 3y ago
  is it really running hashes, or is it probing your browser to see if your video card drivers look like phantomjs
  - 3y ago

hedora 3y ago

The article says that there is only a factor of 6 in solution time between a high end server and low end phone. How is that possible? The server likely has much more than 6x the ram and cpu count (and faster cpus) than the phone. Also, since it is DDOSing, the server’s work is embarrassingly parallel, but the client work isn’t necessarily parallelized at all. Even if it is only a factor of 6 (or one) they are talking about 1 minute solve times once a DDOS is detected. At that point the service is basically down anyway, right?

8organicbits 3y ago
A good explanation of the algorithm is here: https://github.com/tevador/equix/blob/master/devlog.md https://github.com/tevador/equix/blob/master/devlog.md > they are talking about 1 minute solve times once a DDOS is detected. The point of this is to prevent an existing easy DoS attack (introduction flooding) into a partial outage/slow down. It's an incremental improvement on a hard problem.
bawolff 3y ago
> The article says that there is only a factor of 6 in solution time between a high end server and low end phone. How is that possible? The server likely has much more than 6x the ram and cpu count (and faster cpus) than the phone. The limiting factor if equihash is allegedly memory bandwidth, which maybe doesn't vary that much between srrvers and phones.
zacmps 3y ago
I suspect they're off by at least an order of magnitude in that estimate, if not two (or more if GPU acceleration is possible).
- kragen 3y ago
  gpus don't have more memory bandwidth, which is why they're using a memory-hard problem

1vuio0pswjnm7 3y ago

How will the service operator know when their site is under "stress". Will this effectively prevent someone from having a "high traffic" hidden service free from Tor-imposed puzzles. If the hidden service operator is aware that the site is receiving high traffic, could the operator run several sites as mirrors, so that users had options if, e.g., one site was not responding fast enough. Is there guidance published anywhere on what is the the "normal" traffic for a hidden service.

8organicbits 3y ago
> When the subsystem is enabled, suggested effort is continuously adjusted and the computational puzzle can be bypassed entirely when the effort reaches zero.
solarpunk 3y ago
>If the hidden service operator is aware that the site is receiving high traffic, could the operator run several sites operating as mirrors, so that users had options if, e.g., one site was not responding fast enough. Is there guidance published anywhere on what is the the "normal" traffic for a service. I think this[1] would help. [1]https://onionbalance.readthedocs.io/en/latest/ https://onionbalance.readthedocs.io/en/latest/
1vuio0pswjnm7 3y ago
From the onionbalance site https://www.benthamsgaze.org/wp-content/uploads/2015/11/sucu-torscaling.pdf https://www.benthamsgaze.org/wp-content/uploads/2015/11/sucu...

marcodiego 3y ago

I have an idea to minimize traffic on the tor network or make it faster. It should be possible to use the network as a cdn. If I want to make a file available, it should be possible for me to send pieces of the file to nodes who gave me permission to do so. When the file is requested, I then could point to these nodes. Of course, some care should be taken not to turn the tor network into a "anonymous torrent replacement" to avoid defeating its purpose. The current proposal discussed in the post talks about "prioritize verified network traffic". It would be interesting if sharing "file pieces" could prioritize your traffic since you're actually helping the network. Instead of "proof-of-work" it would be "proof-of-bandwidth-contribution".

bawolff 3y ago
That's kind of more the freenet model (content based), where tor is traditionally anonoymous TCP real time networking. I dont really see how it minimizes traffic on the network though. You still have to talk to the CDN nodes.
- marcodiego 3y ago
  You're right. This doesn't minimizes traffic, it distributes it.

8organicbits 3y ago

Really interesting! Digging into the proposal [1]: > make it harder for attackers to overload the service with introduction request > We hope that this proposal can help us defend against the script-kiddie attacker and small botnets. Sets expectations: does not counter large botnets. > We hope that this proposal will allow the motivated user to always connect A user who really wants to connect can get through durring a DoS attack, but it may still take work. Interesting choice of PoW algorithm: https://github.com/tevador/equix https://github.com/tevador/equix > Hence, instead of forcing clients to go below a static target like in Bitcoin to be successful, we ask clients to "bid" using their PoW effort. Effectively, a client gets higher priority the higher effort they put into their proof-of-work. This is similar to how proof-of-stake works but instead of staking coins, you stake work. [1] https://gitlab.torproject.org/tpo/core/torspec/-/raw/main/proposals/327-pow-over-intro.txt https://gitlab.torproject.org/tpo/core/torspec/-/raw/main/pr...

salawat 3y ago
So now you have the drawbacks of both as well, in that the guy who has the most compute to use as a toaster can DoS everyone else. Plus, PoW is nothing but wasted, needless computation. Computing is not free. Every watt spent doing anything PoW is just that much more intensification of our current climate crisis. As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect, fuck anyone who proposes PoW is a good idea for anything. It isn't interesting. It's the most egregious example of conspicuous consumption on the planet.
- thechao 3y ago
  Maybe we can ask the DoSers to stop, nicely? Everything else being equal, I bet the Tor/Onion-folk are pretty smart people, and this is what they felt was necessary to keep the service running.
  - maest 3y ago
    > Everything else being equal, I bet the Tor/Onion-folk are pretty smart people, and this is what they felt was necessary to keep the service running. That's an appeal to authority and an attempt to shut down inquisitive thought and investigation. Imo, this goes against the spirit of HN.

bawolff 3y ago

The better article (real technical details) is https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/proposals/327-pow-over-intro.txt https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/p... Appearently the PoW function they chose is equi-X.

bunabhucan 3y ago

I wonder if it would be possible to securely offload some of the aes processing to the proof of work cpus. Or make ddos requestors perform a fourth layer of encryption/routing, possibly of data, possibly noise.

favflam 3y ago

Nice. Pretty soon, we won't need CDNs for DDOS protection. We just serve API through Onion services.

zmmmmm 3y ago

As others have commented, it's a shame there isn't a proof of work that doesn't also hurt the planet. It makes me wonder if there would ever be a way to actually do the opposite - your "proof of work" is somehow linked to extracting CO2 from the atmosphere?

hunter2_ 3y ago
If you sell carbon credits, the money you make doing so is proof that you did it (well, it's proof that you did something of value, which could also count).
pcdoodle 3y ago
We helped secure the bitcoin network and prevented our basement pipes from freezing around 5 years ago (Old building, new heat pumps installed for 1st and 2nd floor. The old basement steam boiler being removed lead to really low basement temps). Resistive heat was the only option down there. After improvements (water heater + circulation fan + insulation), we shipped the miner to a buyer from a hydro facility to burn excess watts for the rest of its life. Don't hate on the BTC crowd, some of us also care about ecological load.

m3kw9 3y ago

So there needs to be a token to be mined as an incentive? Lol

remote_phone 3y ago

I freaking love new ideas like this! This is the beauty of computer science, anything is possible if you’re smart enough and willing to work hard!

Uptrenda 3y ago

I'm wondering if there is a more elegant way to solve sybil attacks here. For example: many CPUs are provisioned with key pairs that are unique to the processor and can be verified with the CA root cert of the issuer (Intel, AMD, etc.) You could tie PoW to successive signing and allow it to be verified in parallel. Then the operation couldn't be parallelized to a botnet as all PoWs would be unique to a CPU. It seems that they're targeting memory as a way to make it more costly for botnets. I think that there are many other ways to help minimize this attack scenario, too. The same logic could also be applied to mobile phones using ESIM. Later authentication with the mobile network uses public key crypto so I feel like you could also do unique proofs there, too. This is just a throw away comment though. I am probably missing obvious problems with this scheme.

keyle 3y ago
"Waiting for pair client connection". That'd be something. Interesting thought but I can imagine a range of issues. In the same vein, how about the server would hold a pool of IPs in which the client has to return a proof of port knocking? e.g. here is a token, send that to this IP:port and wait for a unique response I can verify. Call this proof of latency. It would be low CPU, would spread the load across various machines and ports. On the downside, of course, you need multiple IPs and potentially servers. It could be implemented on the same machine but that would shift the cpu load to port connections.
- dmurray 3y ago
  What does this prove about the client? Just that they have a reasonably fast connection (which in TOR-world can be painful to achieve), not that they aren't part of a botnet. It allows you to scale your workload, but "just pay for more servers and outscale the attacker" isn't generally an acceptable way to deal with DDOS.
nsvd 3y ago
Of course, this wouldn't work if you don't trust Intel, AMD, etc's certificate, and I don't see why you would in this application.
3y ago

IngvarLynn 3y ago

It's a shame that Torproject has decided to reinvent its own wheel, lagging 10 years behind the crypto crowd, instead of integrating with existing coin(s). The problem is, such integration would require the chosen coin to be anonymous, which is essentially forbidden: https://www.theverge.com/2023/8/23/23843161/tornado-cash-indictment-conspiracy-north-korea-money-laundering https://www.theverge.com/2023/8/23/23843161/tornado-cash-ind...

pyinstallwoes 3y ago
What? Adopting a coin is nonsense. Your argument is also invalid based on the amount of coins that exist, each reinventing POW.
Proven 3y ago
[dead]
Zuiii 3y ago
I agree with you in principle. Wasting energy like what this and hashcash do is unfortunate but that's what happens when you have an irrational hate towards a technology rather than how it is used. That said, modeling it after a general cryptocurrency is probably a bad idea since it rising prices may prevent legitimate clients from being able to connect to onion services due to the challenge being too expensive (either in terms of computation or accusation). I think a much practical approach is to have each visitor contribute to a partial solution that can then be combined to derive funds (much like how mining pools work). That way, clients will be completely isolated from cryptocurrency and sites can actually benefit from the work rather than just throwing it away. It's a win-win situation. I hope the next generation learns from our senseless technology-burnings.
- IngvarLynn 3y ago
  >modeling it after a general cryptocurrency is probably a bad idea Not modelling after but integrating of an existing one. Because this saves massive amount of engineering effort. >rising prices may prevent legitimate clients from being able to connect to onion services due to the challenge being too expensive Obviously, the price for legitimate clients would be much cheaper, as their requests shall be placed in the middle of priority queue (clients can wait a few seconds) while the attacker have to occupy the very top of this queue all the time. Also note that the bigger the DDoS in this scheme - the bigger profits server could make, which he could spend on expanding capacity. >each visitor contribute to a partial solution that can then be combined to derive funds This scheme predates monero, which was about 10 years ago. >the next generation learns from our senseless technology-burnings. Not if they would reinvent the wheel each time instead of adapting of existing tech to current needs.

parentheses 3y ago

This is a good use of proof of work. Seems useful as it bottlenecks DDOS attacks by burdening them with having to give proof.

rmac 3y ago

wonder why they didn't implement something like privacy pass (private access tokens / private state tokens)

basedrum 3y ago
Wrong layer. Privacy pass is for HTTP

willvarfar 3y ago

Computers are still getting faster. With time, the POW threshold will steadily increase. So will this discriminate against those with old sluggish hardware? And is that the kind of hardware that the users in regimes that TOR is supposed to help have?

seanhunter 3y ago

Surely the DDossers will just use some of their botnets for generating the POWs? I don't think I fully understand the scheme. Is the idea that as the attack progressed this would consume more and more of their resources making an attack impractical? Surely in that scenario more and more of the real traffic's resources would be consumed by them having to solve puzzles also, so Tor would in effect be cooperating with the attackers and DDosing all of the valid clients ?

Vecr 3y ago
No, I think it makes the the experience strictly better for normal ("real") users. On phones it might burn too much battery, but on desktops or plugged in laptops dedicated users can configure their user agent to send in difficult proof of work submissions, getting closer to the front of the line. The actual problem starts when each individual request coming from the botnet starts submitting more proof of work then the real users can tolerate (due to taking too long), and that's where it's pretty much the same as before the DDoS protection system existed.
- iFreilicht 3y ago
  Except now the botnets need a lot more computation and thus electrical power to generate the same amount of traffic as before, making DDoS attacks more expensive for the attacker, and less expensive for the service. I think there is a second cost aspect to this as well; right now, hacking low-powered IoT devices and making them part of your botnet is (relatively) easy and valuable, but as their computing power is quite limited, a PoW defense should make them less viable for DDoS attacks, decreasing the amount of free attack power.
bootsmann 3y ago
Botnets usually consist of networks of captured low spec IoT devices (mostly routers, sometimes exposed IP cams etc.). They might not have the hardware required to outbid real users in PoW.
KirillPanov 3y ago
> Surely the DDossers will just use some of their botnets for generating the POWs? It takes much, much, much more (proven) work to DoS a service than it does to use it normally.

shim__ 3y ago

It's a start but eventually I'd be great to add some sort of payment layer much like bitcoin lightening. If running a node pays much more people would be willing to do so.

RuggedPineapple 3y ago
Hah, cryptocurrency still desperately hoping to identify a problem it can solve. No thank you.
tepmoc 3y ago
bitcoin [lighting] is privacy nightmare
nullc 3y ago
Adding payments would just make sybil attacking tor profitable. And the same parties that install software to collect payments would probably be willing to run versions that double their income by reporting all their traffic to a third party attacker in exchange for payment.

popol12 3y ago

Interesting, but I don’t understand how it is better than regular captchas for this task Maybe captcha serving itself can be DDoSed, because of the image size?

rlpb 3y ago
Captchas require human intervention. This method is transparent for the legitimate user.
- popol12 3y ago
  Sure, but it seems easier to defeat than captchas, especially for a big opponent like a state, which can possibly allocate enough computing power to make the difficulty target too high for regular users Whereas with captchas, the government need to pay real people to fill them, which doesn’t scale Edit: I read the paper (https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/proposals/327-pow-over-intro.txt https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/p...) and I understand what you meant. This is not meant to replace captchas but to automatically discard low profile attacks. Nice.

bornfreddy 3y ago

A bit late to the party, but... Is that not leaking information about the server? It broadcasts under how much stress the harddware is. It is probably not enough to find the exact server by itself, but still.. Like the idea otherwise.

twosdai 3y ago

I do wonder if tor would allow servers to have the difficulty to be "tuneable" so that service A with a small server but a solid fan base could have a high difficulty scaling that everyone knows about, and service B has a lower difficulty scaling but more servers behind it.

captainbland 3y ago

I think given the aims and limitations they've set for this it's a reasonable proposal and it will likely meet those objectives. As mentioned it will work for smaller botnets but larger ones will still overwhelm individual clients in terms of resource availability. Personally I dislike proof of work, it's basically bloat as a defense mechanism in this case and can obsolete older hardware fast while consuming in aggregate probably a lot of power across the devices it affects. At scale it would be quite a large environmental burden. I also think a lot of attackers will consider it a success to get it to that high difficulty as users who have to wait 1 minute of their device being 100% pegged will probably choose to disengage a lot of the time. That said it's quite a good way of mitigating DOS attacks while not doing anything to compromise user anonymity, so from that point of view it's a good solution despite the drawbacks. As it exists on tor, I don't have too much of a problem with it but I'd consider it a total disaster if applied to the regular web.