Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it?
I mean, suppose all of the existing nodes weren't malicious. Could a government agency plausibly run 1000 exit nodes in a way that doesn't give away they are government-run? This would make the majority of exit nodes malicious.
Here’s research conducted years ago about this matter: https://www.vice.com/en/article/mgbdwv/badonion-honeypot-mal...
Effectively they set up a honeypot and used clear text passwords to log in, and plenty of exit nodes picked up on this and those credentials were later used to (attempt to) log in into the honeypot.
only found this paper going over systematic process of exposing bad relays - http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf
So if you're talking about "everyone in a giant group of people" and doing it routinely, existence of those secret subpoenas seem like they'd get leaked eventually. Especially if it's hard to tell which of the 300 people leaked it.
[0]: Search for HiddenServiceSingleHopMode on https://2019.www.torproject.org/docs/tor-manual.html.en or just use the following config options
SOCKSPort 0
HiddenServiceNonAnonymousMode 1
HiddenServiceSingleHopMode 1
This “Non Anonymous Mode” effectively omits the second circuit, and allows relays to connect directly to the hidden service’s IP address, thus significantly improving latency and reducing the strain on the Tor network?
Any timing correlation attack carried on against entry and exit nodes is independent from the number of hops.
The Road network and internet have an awful lot in common!
What? Writing raw onion addresses is like writing raw IPv6 addresses. Nobody can remember then and check them.
What is easier
or
> ej3kv4ebuugcmuwxctx5ic7zxh73rnxt42soi3tdneu2c2em55thufqd.onion
0: https://community.torproject.org/onion-services/advanced/oni...
Exactly the same guarantees are also achieved by putting your clearnet address on HSTS Preload lists, or by writing https:// in front of the url on the users side.
With https you need to get the address over a secure channel and hope that no CAs are compromised. The secure channel might be easier (because you can quickly memozrize twitter.com) but to avoid the second you need some complicated and not officially supported certificate pinning.
And you cannot really check if it's the correct one.
At least on regular net, you have a chance to spot nytime5 is fake.
It is not possible to squat onion domains for typo errors like you can clearnet addresses.
Similar to bitcoin, one character swapped breaks the hash-checksum, making the address 99.99999999% likely to be invalid.
$ curl -I https://pablo.rauzy.name/
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 10 Mar 2022 14:04:44 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2843
Last-Modified: Sun, 23 Jan 2022 22:21:41 GMT
Connection: keep-alive
Onion-Location: http://c2fk5i7jqn7am7nfo7eb7hwrkclyj3jj4qcwgdh6ievp7v5ie4gd3mid.onion/
If it is the case then you combine the ease of access of typing a normal domain name and the Onion security through an HSTS equivalent mechanism.
Users are bad at security. If they fail to set up tor, .onion links don't work, so it acts as a barrier against users shooting themselves in the foot.
This is counterbalanced by higher phishing risks.
I would argue that this is the much bigger footgun for users. Just look at how much money darknet users are losing to the big industry of .onion phishing pages.
There are no other practical attacks that malicious exit nodes could execute against sites using TLS and HSTS preload lists. If you’re a website administrator, fixing those things should be your priority before implementing onion addresses.
Onion addresses also come with slight drawbacks. They’re difficult for users and more vulnerable to phishing. Hidden services are also extremely vulnerable to CPU-based DoS attacks.
We all should know how infrequent this TLS Client mode get evoked, right, right? Yeah, righto.
I think there are probably some uses of the Tor network that aren't fully realised yet - file sharing (something similar to I2P) which avoids the exit node using onion addressing and chat applications (like Briar which uses onion addresses, or Secure Scuttlebutt).
As for web traffic, it is nice to offer an onion address. I wonder if websites could offer an "upgrade" to onion addresses, similar to how IPFS does?
[0]: https://community.torproject.org/onion-services/advanced/oni...
Exit capacity as a significant bottleneck has not been a realistic issue for many years.
No, the article is asking how you could, as a website owner, make things easier on Tor users and yourself! It starts with the assumption that you care, and want to help users who require better privacy.
It answers, though not in detail, the many HN readers who invariably post replies concerning Tor that "All my abuse comes through Tor".
Creating an .onion address mitigates that significantly.
No, it's not clear. Also "abusive traffic" is vague. Are you mainly concerned with shitposters, trolls, DOS attacks?
> What am I missing?
Maybe you're not missing it, but essentially it's a behavioural/social rather than technical challenge. Most abusers, ones that technical changes can address, operate at scale over HTTP/S and use Tor simply as a free VPN via regular exit nodes to hide their IP. The author calls this the "Wheat/chaff problem". Viewed this way, it's easiest for a site owner to just block all of Tor and kill all legitimate users too.
Most of those bulk abusers cannot be bothered to deal with marginal cases like using an overlay network with .onion addresses whereas those who _need_ Tor are highly motivated.
Other kinds of abusers, like persistent troll posters, are better dealt with by other means even if you're using HTTP/S.
From Wikipedia:
> Addresses in the onion TLD are […] automatically generated based on a public key when an onion service is configured.
> 256-bit ed25519 public key along with a version number and a checksum of the key and version number
That's all you need to know.
Actually this is not true. Tor runs as SOCKS5 proxy, and you can use any browser or application with it.