Jump to content
Not connected, Your IP: 35.175.180.255
airstrea

Noob question about Onion sites

Recommended Posts

I've read that .onion sites do not leave the TOR network / they do not utilize tor exit nodes.

 

Therefore, are .onion sites completely safe when anonymity is a concern?

 

Thanks.

Share this post


Link to post

It's true that .onion sites (Hidden Services) don't utilize exit nodes. Here's how it (roughly) works:

  • The Hidden Service advertises its existence and its public key to a few relays (which act as "introduction points")
  • The Hidden Service publishes that information to a hash table (which is stored by relays known as "HSDirs")
  • The client contacts such a relay and requests that information
  • The client randomly picks another relay to act as a "rendezvous point"
  • The client sends a message (encrypted to the Hidden Service's public key) to one of the introduction points to tell the Hidden Service about the rendezvous point
  • Both Hidden Service and client use their circuits to the rendezvous point to establish a connection to each other

A more detailed explanation can be found here.

Now, to answer your question: No - while an impressive piece of technology, they are not completely safe (nothing will ever be completely safe).
In 2014, an attacker used a combination of malicious HSDir and guard nodes to deanonymize users.

One of the biggest advantages of Hidden Services - one that often gets overlooked - is their built-in end-to-end crypto. A website hosted as a Hidden Service does not have to use SSL on top, which is a huge deal as it totally eludes the compromise of certificate authorities and man-in-the-middle attacks.

If you're interested in further improving Hidden Services, keep an eye on the upcoming crowdfunding campaign.


all of my content is released under CC-BY-SA 2.0

Share this post


Link to post

Its interesting that this thread is posted on AirVpn forums.  I assume the OP is using Air in tandem with TOR then.  I am too.

 

If you read through the links posted above and give them due consideration you would quickly see that adding AirVpn to your TOR circuit configuration strengthens the circuit alot.  Even in the unlikely event that you were a victim of the traffic confirmation attack described, the adversary/attacker would of only managed to get an Air IP address and not your actual IP.  If you are using virtual machines properly, a breakout to the host would be very unlikely so the physical machine ID's would also be protected from prying eyes.  I allow Air to connect me to the best server each session so even the IP an adversary would get to is changing daily.  There might even be more than one VPN in use too, LOL!

Share this post


Link to post

In fact, since this thread is already started, there could be a nice feature here in case Air would like to implement this.

 

The .onion domains can be accessed within the Tor network, so in case every VPN server will have a Tor client or bridge,

accessible only from the 10.0.0.0/8 subnet, this might be possible to implement a client-less access for all .onion sites

without the actual need to have a local Tor client running. Just like with the existing OpenNIC and Namecoin names resolutions.

This would require you to use Air's DNS servers of course.


Occasional moderator, sometimes BOFH. Opinions are my own, except when my wife disagrees.

Share this post


Link to post

This is an interesting suggestion, Mr. zhang888!

 

(Sent via Tapatalk - this generally means I'm not sitting in front of my PC)


NOT AN AIRVPN TEAM MEMBER. USE TICKETS FOR PROFESSIONAL SUPPORT.

LZ1's New User Guide to AirVPN « Plenty of stuff for advanced users, too!

Want to contact me directly? All relevant methods are on my About me page.

Share this post


Link to post

It's true that .onion sites (Hidden Services) don't utilize exit nodes. Here's how it (roughly) works:

  • The Hidden Service advertises its existence and its public key to a few relays (which act as "introduction points")
  • The Hidden Service publishes that information to a hash table (which is stored by relays known as "HSDirs")
  • The client contacts such a relay and requests that information
  • The client randomly picks another relay to act as a "rendezvous point"
  • The client sends a message (encrypted to the Hidden Service's public key) to one of the introduction points to tell the Hidden Service about the rendezvous point
  • Both Hidden Service and client use their circuits to the rendezvous point to establish a connection to each other

A more detailed explanation can be found here.

 

Now, to answer your question: No - while an impressive piece of technology, they are not completely safe (nothing will ever be completely safe).

In 2014, an attacker used a combination of malicious HSDir and guard nodes to deanonymize users.

 

One of the biggest advantages of Hidden Services - one that often gets overlooked - is their built-in end-to-end crypto. A website hosted as a Hidden Service does not have to use SSL on top, which is a huge deal as it totally eludes the compromise of certificate authorities and man-in-the-middle attacks.

 

If you're interested in further improving Hidden Services, keep an eye on the upcoming crowdfunding campaign.

 

If the FBI can shut down .onion servers/websites can they trace back users of those servers/websites?

Share this post


Link to post

@difflehuffy: Difficult question.

There are many, very different ways to go about unmasking hidden services - some of them mentioned in this Tor blog post.
Most of these attacks are actually not too advanced (follow the money trail /  exploit and take control of the website / personal infiltration).
Something in that vein would not directly lead to the deanonymization of individual users.

We do know that the FBI uses commandeered hidden services to spread unmasking malware.

Thanks to the disgusting practice of parallel construction it is unclear to what extent an agency like the FBI would be able to make use of NSA's capabilities for network-level unmasking attacks.


all of my content is released under CC-BY-SA 2.0

Share this post


Link to post

Thx for the thoughtful response.  i think the first link i

 

@difflehuffy: Difficult question.

There are many, very different ways to go about unmasking hidden services - some of them mentioned in this Tor blog post.
Most of these attacks are actually not too advanced (follow the money trail /  exploit and take control of the website / personal infiltration).
Something in that vein would not directly lead to the deanonymization of individual users.

We do know that the FBI uses commandeered hidden services to spread unmasking malware.

Thanks to the disgusting practice of parallel construction it is unclear to what extent an agency like the FBI would be able to make use of NSA's capabilities for network-level unmasking attacks.

 

Thx for the response.  i think the first link is broken?

Share this post


Link to post

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
  • Security Check
    Play CAPTCHA Audio
    Refresh Image

×
×
  • Create New...