2

I understand that all of the communication between a client and a hidden service (.onion) takes place within the Tor network and is therefore end-to-end encrypted. What I am wondering, however, is how the URL / URI of a given request is handled. If in my Tor Browser I see this;

http://hiddenservxxxxxx.onion/index.php?page=someidentifyinginformation

Are there nodes within the Tor circuit that can see that I am attempting to access a page with some potentially identifying information in it?

Is the whole URL obscured from leaking sensitive info? Or even part of it?

Improve this question
1
  • Bumping this thread here. Isn't it technically this way that an attacker, lets say the NSA, could (just technically) control enough Nodes that they will definitely see who requested which URL? Otherwise connecting to Tor hidden services would be a bulletproof thing. I refuse to believe that.
    – Pumped334
    Commented Feb 11, 2020 at 13:09

2 Answers 2

Reset to default
4

(Assuming the URL is http://X.onion?foo=bar)

One relay (HSDir) knows that someone (but not who) wanted to look up the record for where to leave a message to request to talk to "X".

Another relay (Introduction Point) knows that someone (but not who) left a message asking to talk to "Y" (see note.) at some location that it doesn't know.

(Note: "Y" is not the same as "X", it is actually a distinct key that it published for each Introduction Point in the Hidden Service descriptor. If the Introduction Point has a descriptor for "X", it knows "Y" is "X" and therefor it is serving "X", otherwise it knows nothing about either party.)

Yet another relay (Rendezvous Point) know that someone (but not who) is talking to some hidden service (but not which).

No single relay knows with certainty that they ever did talk or who either of the participants were nor what they spoke about.

At most the value of "X" is known by some HSDir(s).

Improve this answer
1

http://

and

/index.php?page=someidentifyinginformation

Only you and HS, because end-to-end encryption takes place. Encryption hides the protocol you use and thus its payload (in this case /index.php?page=someidentifyinginformation).

hiddenservxxxxxx.onion

Introduction points, you and HS. The guard and the last hop of the HS circuit and rendezvous points may also know this through some sort of attacks (actually all nodes can know if the attack is 'strong' enough).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .