Noob question about Onion sites

[airstrea 1]

I've read that .onion sites do not leave the TOR network / they do not utilize tor exit nodes.

 

Therefore, are .onion sites completely safe when anonymity is a concern?

 

Thanks.

[InactiveUser 188]

It's true that .onion sites (Hidden Services) don't utilize exit nodes. Here's how it (roughly) works:

• The Hidden Service advertises its existence and its public key to a few relays (which act as "introduction points")
• The Hidden Service publishes that information to a hash table (which is stored by relays known as "HSDirs")
• The client contacts such a relay and requests that information
• The client randomly picks another relay to act as a "rendezvous point"
• The client sends a message (encrypted to the Hidden Service's public key) to one of the introduction points to tell the Hidden Service about the rendezvous point
• Both Hidden Service and client use their circuits to the rendezvous point to establish a connection to each other

A more detailed explanation can be found here.

Now, to answer your question: No - while an impressive piece of technology, they are not completely safe (nothing will ever be completely safe).
In 2014, an attacker used a combination of malicious HSDir and guard nodes to deanonymize users.

One of the biggest advantages of Hidden Services - one that often gets overlooked - is their built-in end-to-end crypto. A website hosted as a Hidden Service does not have to use SSL on top, which is a huge deal as it totally eludes the compromise of certificate authorities and man-in-the-middle attacks.

If you're interested in further improving Hidden Services, keep an eye on the upcoming crowdfunding campaign.

[iwih2gk 93]

Its interesting that this thread is posted on AirVpn forums.  I assume the OP is using Air in tandem with TOR then.  I am too.

 

If you read through the links posted above and give them due consideration you would quickly see that adding AirVpn to your TOR circuit configuration strengthens the circuit alot.  Even in the unlikely event that you were a victim of the traffic confirmation attack described, the adversary/attacker would of only managed to get an Air IP address and not your actual IP.  If you are using virtual machines properly, a breakout to the host would be very unlikely so the physical machine ID's would also be protected from prying eyes.  I allow Air to connect me to the best server each session so even the IP an adversary would get to is changing daily.  There might even be more than one VPN in use too, LOL!

[zhang888 1066]

In fact, since this thread is already started, there could be a nice feature here in case Air would like to implement this.

 

The .onion domains can be accessed within the Tor network, so in case every VPN server will have a Tor client or bridge,

accessible only from the 10.0.0.0/8 subnet, this might be possible to implement a client-less access for all .onion sites

without the actual need to have a local Tor client running. Just like with the existing OpenNIC and Namecoin names resolutions.

This would require you to use Air's DNS servers of course.

[OpenSourcerer 1435]

This is an interesting suggestion, Mr. zhang888!

 

(Sent via Tapatalk - this generally means I'm not sitting in front of my PC)

[difflehuffy 0]

It's true that .onion sites (Hidden Services) don't utilize exit nodes. Here's how it (roughly) works:

• The Hidden Service advertises its existence and its public key to a few relays (which act as "introduction points")
• The Hidden Service publishes that information to a hash table (which is stored by relays known as "HSDirs")
• The client contacts such a relay and requests that information
• The client randomly picks another relay to act as a "rendezvous point"
• The client sends a message (encrypted to the Hidden Service's public key) to one of the introduction points to tell the Hidden Service about the rendezvous point
• Both Hidden Service and client use their circuits to the rendezvous point to establish a connection to each other

A more detailed explanation can be found here.

 

Now, to answer your question: No - while an impressive piece of technology, they are not completely safe (nothing will ever be completely safe).

In 2014, an attacker used a combination of malicious HSDir and guard nodes to deanonymize users.

 

One of the biggest advantages of Hidden Services - one that often gets overlooked - is their built-in end-to-end crypto. A website hosted as a Hidden Service does not have to use SSL on top, which is a huge deal as it totally eludes the compromise of certificate authorities and man-in-the-middle attacks.

 

If you're interested in further improving Hidden Services, keep an eye on the upcoming crowdfunding campaign.

 

If the FBI can shut down .onion servers/websites can they trace back users of those servers/websites?

[InactiveUser 188]

@difflehuffy: Difficult question.

There are many, very different ways to go about unmasking hidden services - some of them mentioned in this Tor blog post.
Most of these attacks are actually not too advanced (follow the money trail /  exploit and take control of the website / personal infiltration).
Something in that vein would not directly lead to the deanonymization of individual users.

We do know that the FBI uses commandeered hidden services to spread unmasking malware.

Thanks to the disgusting practice of parallel construction it is unclear to what extent an agency like the FBI would be able to make use of NSA's capabilities for network-level unmasking attacks.

[difflehuffy 0]

Thx for the thoughtful response.  i think the first link i

 

@difflehuffy: Difficult question.

There are many, very different ways to go about unmasking hidden services - some of them mentioned in this Tor blog post.
Most of these attacks are actually not too advanced (follow the money trail /  exploit and take control of the website / personal infiltration).
Something in that vein would not directly lead to the deanonymization of individual users.

We do know that the FBI uses commandeered hidden services to spread unmasking malware.

Thanks to the disgusting practice of parallel construction it is unclear to what extent an agency like the FBI would be able to make use of NSA's capabilities for network-level unmasking attacks.

 

Thx for the response.  i think the first link is broken?

[InactiveUser 188]

Thanks, link fixed!

[flat4 79]

I'm far from the anonymity guy, but i watched the documentary "bitcoin" and was surprised about the Silkroad website. the dark web is scary and i thought i was a bad ass for having a few torrents here and there.