Why offer an Onion Address rather than just encourage browsing-over-Tor?

[bauruine]

If you are running an onion service but don't need to hide the server IP, like you do if you also provide clearnet access to the same server, you should enable single hop mode [0] to reduce the load on the Tor network and also speed up the connections. This way your server directly connects the introduction and rendezvous points while the client still stays anonymous with a 3 hop circuit.

[0]: Search for HiddenServiceSingleHopMode on https://2019.www.torproject.org/docs/tor-manual.html.en or just use the following config options

SOCKSPort 0

HiddenServiceNonAnonymousMode 1

HiddenServiceSingleHopMode 1

[stingraycharles]

For my understanding, usually establishing a connection with a hidden service involves two separate Tor circuits: one circuit for the visitor, but another full circuit for the hidden service.

This “Non Anonymous Mode” effectively omits the second circuit, and allows relays to connect directly to the hidden service’s IP address, thus significantly improving latency and reducing the strain on the Tor network?

[ycuser2]

I'm using Tor to access my local network services through hidden services. Since I don't need to hide my IP address I'm going to follow your advice gratefully. Didn't know that's possible.

[danuker]

You are not just reducing load, you are also reducing anonymity for other participants. The extra hops make it harder to analyze the data overall.

[Terry_Roll]

Tor is not anonymous just like VPN's are not anonymous when you have 5eyes oversight of the network. Its like watching trucks navigating around the road network, you can see the junctions they take and you can see where they start and end, but you cant see the contents of the truck.

The Road network and internet have an awful lot in common!

[brnt]

If I use Onionshare, where do I set this?

[nextaccountic]

> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent

Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it?

I mean, suppose all of the existing nodes weren't malicious. Could a government agency plausibly run 1000 exit nodes in a way that doesn't give away they are government-run? This would make the majority of exit nodes malicious.

[stingraycharles]

It’s not even about three letter agencies; many exit nodes are being scanned for passwords, if you happen to go through http instead of https.

Here’s research conducted years ago about this matter: https://www.vice.com/en/article/mgbdwv/badonion-honeypot-mal...

Effectively they set up a honeypot and used clear text passwords to log in, and plenty of exit nodes picked up on this and those credentials were later used to (attempt to) log in into the honeypot.

[Stevvo]

There were slides in the Snowden leaks where it laid out the NSA's strategy for dealing with TOR and compromising exit nodes was a big part of it. They have had the last 10 years to work on it; one might expect they had results.

[RL_Quine]

The behaviour of not always using the same exit means that you, over time, will almost assuredly use a malicious exit should more than zero exist. It's reckless to suggest that anybody should be using this system, your situation is almost always going to be worse than not.

[heavyset_go]

Even if every exit node in the US is operated by private people or organizations, courts can compel the node owners to work with the government and not talk about it.

[idontwantthis]

What does compromising the exit do? I thought the layering means you would need to compromise the entire path to do anything.

[bawolff]

Or just use HSTS. Problem solved.

[p4bl0]

It is possible to advertise your .onion address and offer automatic redirect to it for Tor Browser users using the "Onion-Location" HTTP header. Example with my personal home page:

    $ curl -I https://pablo.rauzy.name/
    HTTP/1.1 200 OK
    Server: nginx/1.14.2
    Date: Thu, 10 Mar 2022 14:04:44 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 2843
    Last-Modified: Sun, 23 Jan 2022 22:21:41 GMT
    Connection: keep-alive
    Onion-Location: http://c2fk5i7jqn7am7nfo7eb7hwrkclyj3jj4qcwgdh6ievp7v5ie4gd3mid.onion/

It would be interesting to try to see if the Tor Browser has a TOFU policy and warn its user if the onion address change after they visited the site once.

If it is the case then you combine the ease of access of typing a normal domain name and the Onion security through an HSTS equivalent mechanism.

[kingcharles]

Is there some sort of attack possible here where you could hand out unique onion addresses to each visitor, so when they connect with Tor you could fingerprint their Tor connection and match it to their cleartext connection? *takes off his black hat*

[linuxandrew]

I think the avoiding exit nodes part is probably the most important to me. Exit nodes have always been problematic - from memory about 20% of relays have an exit flag but most of the traffic is directed to the most performant relays. Tor actively discourages using the network for file sharing because of the exit node bottleneck.

I think there are probably some uses of the Tor network that aren't fully realised yet - file sharing (something similar to I2P) which avoids the exit node using onion addressing and chat applications (like Briar which uses onion addresses, or Secure Scuttlebutt).

As for web traffic, it is nice to offer an onion address. I wonder if websites could offer an "upgrade" to onion addresses, similar to how IPFS does?

[bauruine]

Yes there is the onion-location http header to upgrade from clearnet to .onion [0]

[0]: https://community.torproject.org/onion-services/advanced/oni...

[Asan1]

The Tor network has 1Tbps+ of real exit capacity available, real usage is a small fraction of that.

Exit capacity as a significant bottleneck has not been a realistic issue for many years.

[nonrandomstring]

I think some comments here are misunderstanding the intent of the article. For those saying TLS already solves... it is not advocating Tor as a replacement for transport layer security, indeed most Tor users also use TLS (and site certs) with little overhead.

No, the article is asking how you could, as a website owner, make things easier on Tor users and yourself! It starts with the assumption that you care, and want to help users who require better privacy.

It answers, though not in detail, the many HN readers who invariably post replies concerning Tor that "All my abuse comes through Tor".

Creating an .onion address mitigates that significantly.

[tempestn]

I'm not clear from the article how having an onion address helps website operators who receive abusive traffic through Tor. Perhaps some of that abusive traffic will come in via the onion address instead, but presumably such an operator will want to continue serving their regular site to Tor exit nodes as well, so I don't see how it would actually mitigate anything, nor make the malicious traffic easier to segregate from valid traffic over Tor. What am I missing?

[noname120]

This article beats around the bush but never explains why Onion addresses solve these issues.

From Wikipedia:

> Addresses in the onion TLD are […] automatically generated based on a public key when an onion service is configured.

> 256-bit ed25519 public key along with a version number and a checksum of the key and version number

That's all you need to know.

[shp0ngle]

> The first benefits are authenticity and availability: if you are running Tor Browser and if you click/type in exactly the proper Onion address, you are guaranteed to be connected to what you expect — or not at all.

What? Writing raw onion addresses is like writing raw IPv6 addresses. Nobody can remember then and check them.

What is easier

> https://nytimes.com

or

> ej3kv4ebuugcmuwxctx5ic7zxh73rnxt42soi3tdneu2c2em55thufqd.onion

[nsotelo]

You can use the onion location header[0] to redirect the user, as mentioned in another comment thread.

0: https://community.torproject.org/onion-services/advanced/oni...

[rosndo]

> you are guaranteed to be connected to what you expect — or not at all.

Exactly the same guarantees are also achieved by putting your clearnet address on HSTS Preload lists, or by writing https:// in front of the url on the users side.

[shaky-carrousel]

Neither. Either can be mistyped. Nobody enters addresses directly anymore. Either you google them or you get them from bookmarks.

[Sami_Lehtinen]

> “.onion” address demands that the person is using a TorBrowser

Actually this is not true. Tor runs as SOCKS5 proxy, and you can use any browser or application with it.

[bawolff]

I think the only legit reason (assuming your clearnet site is using HSTS) is that .onion site reduces the risks of users screwing up. And i suppose better performance if you don't have to use exit bandwidth (i would guess, dont actually know)

Users are bad at security. If they fail to set up tor, .onion links don't work, so it acts as a barrier against users shooting themselves in the foot.

This is counterbalanced by higher phishing risks.

[rosndo]

> This is counterbalanced by higher phishing risks

I would argue that this is the much bigger footgun for users. Just look at how much money darknet users are losing to the big industry of .onion phishing pages.

[moltke]

It's good motivation to start using client certs instead of passwords.

[JulianMorrison]

Hiding the server IP is probably quite important when you want to get around nation states trying to blockade factual information.

[djdjfhsje33edh]

Another good reason is that Twitter launching an onion address has given Tor a lot of positive press in the mainstream media for a change.

[badrabbit]

Heh. An article for a two word answer: Tor exits.

[Tepix]

One reason that i haven't mentioned today is forcing users to use tor by only publishing a .onion address.

[hpcoke]

> https://hstspreload.org/ offers the same benefits. You are guaranteed to be connected to what you expect - or not at all.

TLS/HSTS is still subject to CA attacks, e.g. diginotar.

CA/X.509 is a complex stack too.

> TLS mitigates attacks that can be executed by malicious exit nodes (or WiFi networks, or ISPs), that is the whole purpose of TLS.

A malicious exit node could refuse to serve some websites. This seems a minor risk though.

Reducing load on exit nodes is a technical benefit that's in that blog post.

Another benefit to using Tor onion services for large sites is that the Tor circuit ID can be used as an additional key in an IP rate limit cache. This helps block Tor bots (on the basis that establishing a Tor circuit is expensive).

[rosndo]

Most of the technical points listed here are pretty much entirely mitigated by TLS. Exit nodes can of course deny access to specific sites, but hidden services suffer from comparable (or worse) issues.

There are no other practical attacks that malicious exit nodes could execute against sites using TLS and HSTS preload lists. If you’re a website administrator, fixing those things should be your priority before implementing onion addresses.

Onion addresses also come with slight drawbacks. They’re difficult for users and more vulnerable to phishing. Hidden services are also extremely vulnerable to CPU-based DoS attacks.

[egberts1]

But, but … BUT TLS man-in-the-middle at exit node isn’t fully mitigated … UNLESS TLS Client mode is used as well.

We all should know how infrequent this TLS Client mode get evoked, right, right? Yeah, righto.

[moltke]

It's much harder to deanonymize people who are connecting to hidden services because they don't have to use exit relays which are often illegal to run.