top | item 11761065

The Tor Project: Building the Next Generation of Onion Services

394 points| ashitlerferad | 9 years ago |blog.torproject.org | reply

122 comments

order
[+] gravypod|9 years ago|reply
What I think really needs to happen is for the Tor group to make setting up hidden services much simpler.

Maybe I'm just stupid, but there didn't seem like an easy "type a command and we will set this all up for you" kind of way to do it.

Getting it setup, getting it to run as a daemon, and getting the service to work on multiple ports (allowing you to serve :80 and :22 for web and ssh). It seemed like a nightmare to me.

It's sad because I'm very interested in hosting a tor relay/service to make sure I can get to my important documents, even if I need to travel to another country that blocks services like dropbox and google docs.

[+] atmosx|9 years ago|reply
Hm, the problem with this kind of tools is that if you're not willing to read the documentation to get a good understanding of what you're doing, you might end up thinking you're secure instead of being secure which is the worst case scenario.
[+] petertodd|9 years ago|reply
The Tor control port protocol let's applications setup a hidden service automatically; Bitcoin Core recently released support for this, automatically using hidden services for incoming connection to your Bitcoin Core nodes.
[+] aftbit|9 years ago|reply
The real problem is that you _shouldn't_ be running bare Tor in front of a hidden service, at least not if you really want to be private. You need something like Whonix[1] to protect you from all kinds of server information leaks.

1: https://www.whonix.org/wiki/Hidden_Services

[+] zmanian|9 years ago|reply
At least on Debian based systems, running Tor as a daemon is trvial.

There is even apt tor to fetch updates over Tor.

There hidden service config is pretty simple as well.

We should write more functionality for servers that let them setup hidden services via tor

[+] belorn|9 years ago|reply
It would be useful if someone wrote a wizard that could install a personal disk server without the user needing to know what software is involved or how to install it. A single click where for example owncloud is installed, linked to tor hiden services address and given to the user and/or installing a usb stick with tor-browser and a bookmark to the service. It would be outside the scope of tor project, and more in line of a useful native debian package.
[+] ryanl0l|9 years ago|reply
The Tor hidden service setup process seems extremely simple to me.

First google result I get for "tor hidden service instructions" is https://www.torproject.org/docs/tor-hidden-service.html.en which explains the two config lines you need to add to create a hidden service

Literally all you have to do is add this into your config file.

  HiddenServiceDir /hidden/service/path
  HiddenServicePort $EXTERNALPORT $INTERNALIP:$INTERNALPORT
If you're hosting anything at all this shouldn't be even remotely difficult.
[+] zmanian|9 years ago|reply
I'm very excited about a number of innovations being deployed in next gen onion servers.

The distributed random number generator is very cool.

The blinded ed25519 public keys for the rendezvous servers are also super awesome.

Funding tor not only protects people from surveillance but advances computer science.

[+] jontas|9 years ago|reply
I was curious to see if it is possible to donate funds towards the operation of "safe" (eg, non government controlled) exit/bridge nodes. According to the donation faq for the tor project[1], it appears that funds are not used for infrastructure.

If there were a way to fund exit nodes without running one myself I would definitely be interested in participating. If not, this might be a great idea for a crowdfunding campaign.

[1] The Tor Project spends about $2.5 million annually. About 80% of the Tor Project's spending goes on staffing, mostly software engineers. About 10% goes towards administrative costs such as accounting and legal costs and bank fees. The remaining 10% is spent on travel, meetings and conferences, which are important for Tor because the Tor community is global.

https://www.torproject.org/donate/donor-faq.html.en

[+] xorcist|9 years ago|reply
Donate to torservers.net. They are well known, frequent hacker meetings and partner up with other organizations in this space.
[+] Santosh83|9 years ago|reply
How can/does Tor propose to handle government level subversion (which must surely be happening and continue to happen with ever-increasing depth) where "sponsored" computers begin to form a majority of worldwide exit and relay nodes, with modified Tor running on them that looks actively for attacks, and leaks of information?
[+] openasocket|9 years ago|reply
Current evidence suggests it's doing OK for now. The slides from the Snowden leaks showed the NSA was unable to compromise the core infrastructure by controlling relay and exit nodes, excepting a few cases. However, there are attacks a government-level entity can mount that Tor explicitly does not protect against, such as large scale passive scanning for traffic confirmation. It is not believed to be possible to beat such monitoring without compromising latency.
[+] zmanian|9 years ago|reply
The combination of watering hole attacks and internet scale packet timing collection is pretty big problem for the security of Tor users.

Fortunately Internet wide timing attacks are mostly a Five Eyes and domestic Chinese capability. Chaff, padding etc can help here.

Compromising the servers of target services and using that a platform to distribute anonymity stripping malware is also a problem. The Firefox codebase that TBB is based isn't awesome from a security point of view. Hopefully the Firefox code base can catch up from a security perspective and give them something better to work with.

[+] ikeboy|9 years ago|reply
If they're going to use random numbers to enhance security, they should make sure that at worst, if the numbers are predictable and controlled by an attacker, it's no worse than the current security.

Does anyone know if their protocol does that?

[+] cyphar|9 years ago|reply
The randomness will be used to defend against knowing in advance what nodes are responsible for the HSDir entries in the hashring (allowing DoS and statistics gathering). If an attacker knew the next numbers, then this protection would be broken (but none of the other important protections would be broken).
[+] nxzero|9 years ago|reply
Given to my knowledge they still have no way to insure the exit nodes are not control by a single majority, no idea why this would be any different.
[+] DSingularity|9 years ago|reply
Interesting. Can you give an example of how a security enhancing protocol can be end up degrading security?
[+] peterwwillis|9 years ago|reply
Disclaimer: My knowledge of the Tor architecture is very rudimentary

It would be nice to see some new tcp/ip protocols that handle point-to-point and cross-network communication more flexibly. Take a p2p router (let's say Gnutella2), but pared down to only do addressing and routing of traffic. Then another proto on top to do handle name resolution, secrets and tunnels. Then maybe tcp on top of that just to make tunneling arbitrary applications easy. Everything written with IPv6/ICMPv6 in mind as the parent protocol to be more future-proof. In this way, we can have both a reusable framework for p2p networks (the first layer) and a repurposeable protocol for doing name, auth and secret management/tunneling.

I believe the second thing is already handled by tor, but I don't know if separating the secrecy from the routing exists currently. Those different layers could be reused for different purposes, while also being written with a "new Tor" use-case in mind.

[+] aakilfernandes|9 years ago|reply
My understanding of distributed commit/reveal RNGs is they need some sort of incentive mechanism. Otherwise, its trivial for an attacker to flood the network with lots of commits and only reveal the ones that give him a useful outcome.

https://github.com/randao/randao

[+] cyphar|9 years ago|reply
As far as I understand, the distributed randomness will only be distributed on the 11 trusted directory servers (where you get your node manifest from). So you don't need to worry about malicious nodes killing the randomness.
[+] hotpockets|9 years ago|reply
I can't access the website because it's using HSTS and my browser says their certificate is invalid. There is no option to bypass the browser security warning. I'm at a public library. Anyone know what's going on?
[+] Pica_soO|9 years ago|reply
Running a Tor Node- should be a form of payment. A user having no talent, requesting help from a open source community, could "donate" his bandwith and machine in return. And this form of contract should come with ease of use.
[+] abricot|9 years ago|reply
Bandwidth and machine time is not the biggest hindrance for running a tor relay or exit node. The muddy legality in most countries is.
[+] bunkydoo|9 years ago|reply
I still really don't understand why people keep developing Tor over I2P - I2P is clearly the better protocol offering complete untraceable anonymity and a chance to secceed from the stigma of Tor...
[+] zmanian|9 years ago|reply
Tor is a solution for both anonynmity & privacy and censorship evasion. I2P is oriented primarily towards anonymity and privacy.

I2P has an attractive anonymous service design and can run applications like Bittorrent over it. But it also developed basically by 3 people in New Zealand.

Tor has more funding b/c of censorship evasion features being attractive to funders. Successes in the anonynmity feature set like SecureDrop. A vibrant academic community with conferences etc. Lots and lots of review from the external crypto and security community. A deep well of technical talent.

[+] qrmn|9 years ago|reply
Respectably, no tool - be it I2P's garlic routing, Tor's onion routing or anything else - could ever provide "complete untraceable anonymity"; that is a huge (and potentially very harmful) misunderstanding of what these techniques can do, I strongly encourage you to learn more about them to correct that misconception.

Both projects have designs which have inspired each other and have relative advantages and disadvantages. Technically, I like I2P, but I accept I may be somewhat biased there. Practically speaking, Tor has a much larger anonymity set because it is far more widely used and receives more support, with very well-established volunteer outproxies. I would never criticise anyone for contributing to either: Tor in particular has the widest practical impact of any tool in this space.

This distributed random idea is a very impressive achievement; I'm glad to see it work in the wild! Congratulations.

I'm not sure what you mean about "stigma". Any reasonably effective solution in such a politically-charged space as the anonymity and privacy of human communication is likely to become controversial to some degree.

[+] praptak|9 years ago|reply
Anything that replaces Tor will get the stigma of Tor.
[+] cyphar|9 years ago|reply
I've heard that I2P tends to add experimental features that don't have any rigorous analysis of the privacy impact. So there's that.
[+] MajesticHobo|9 years ago|reply
> offering complete untraceable anonymity

Your argument falls apart the moment you claim this.

[+] arca_vorago|9 years ago|reply
I think tor has more marketing and mindshare than I2P, and thats why you see tor more than it. I would like to see a more in depth comparison of the two, do you know of a good one?
[+] htns|9 years ago|reply
Isn't I2P still "peer-to-peer" by default? That is, the fact your IP is connected to I2P is broadcast to everyone. That makes every disconnection an opportunity to trace you, directly and by elimination. It's especially bad with torrents, which are probably the most popular use of I2P.
[+] yurt3|9 years ago|reply
How does I2P defend against traffic analysis attacks?
[+] imaginenore|9 years ago|reply
I don't understand why these TOR guys can't rent like 10-20 cheap VPSs all around the world and do their testing there. They are describing getting 11 nodes like some sort of struggle.

VPSs are truly cheap now, you can get one for $3.52 per year:

https://lowendbox.com/blog/i-83-100mbps-unmetered-openvz-nat...

[+] Vendan|9 years ago|reply
Didn't read that way to me. Read like they normally use VMs on their computer to have a "testing tor net", but decided to set up actual distributed nodes for testing this. More like, "Hey look, this is nifty", rather then "Ugh, it was so hard to set this up"
[+] nxzero|9 years ago|reply
Where would the funds to run the servers come from?

Why do you believe these "cheap" servers would be secure?

[+] detaro|9 years ago|reply
> They are describing getting 11 nodes like some sort of struggle.

Where are they doing that? I see nothing the like in the article. Only that this was the first time they did a test of that scale, not that there was anything preventing them from doing it earlier.

[+] h4waii|9 years ago|reply
And they also explicitly prohibit using Tor, it's right in their ToS => https://quadhost.net/policies/terms-of-service/

Many of the cheap (read: sub $10/year) OpenVZ VPS offerings prohibit ANY type of Tor traffic, even use of a client (such as torsocks) - I've used many of them, and they are quick to detect and suspend based on traffic analysis.

[+] ashitlerferad|9 years ago|reply
The security of the Tor network depends on diversity of relays and exit nodes. If the Tor project ran all nodes, then that is low sysadmin diversity (but high network and jurisdiction diversity) and thus lower security.
[+] sanqui|9 years ago|reply
In addition to what other replies have said, using their own computers has the advantage of testing on a variety of systems, environments, and connections. VPS would be fairly monolithic.