Can a onion domain I register be discovered if I don't make it public?

Question

This tutorial teaches how to register a hidden service and point it to a server's SSH port, so that we can keep this port closed on the open Internet and acess it from inside Tor network.

Of course this seemed odd to me. If for whatever reason it's not secure to let port 22 open on Internet, why'd it be so inside Tor? What kind of thing would change security risks?

If I register an onion domain and don't tell it to anybody and if I'm not hacked and this domain is found, can it be found in anyway other way? Is it certain to say that nobody will discover it if not by my telling or stealing directly from me?

Also, is Tor hidden services aimed at reducing security risks? Isn't it aimed at anonymously serve contents and services in a way that an adversary wouldn't know where our service/content is hosted?

Anyway, if it's indeed a security good practice, or at least if it doesn't increase risks, since I alrdy use Tor outside home, I'd like to make some of my stuff available for me only.

Answer 1

If you are using a v2 address. It is theoretically possible for it to be found on accident. Security via obscurity isn't very good.

Let's say you up your game. Instead, you use a v3 address. This one is 56 characters long and very unlikely to ever be stumbled upon. Furthermore it has some build in protections that keep it more safe.

You can add one more step to this by running your service on port 2222 or 8888 or something completely random like port 23485. You have made your service practically impossible to find.

Also, is Tor hidden services aimed at reducing security risks? Isn't it aimed at anonymously serve contents and services in a way that an adversary wouldn't know where our service/content is hosted?

Yes you're right, you will still want to perform hardening best practices like with any other web application. Just because it's on Tor doesn't mean that you get a free pass with security.

Anyway, if it's indeed a security good practice, or at least if it doesn't increase risks, since I alrdy use Tor outside home, I'd like to make some of my stuff available for me only.

I do this myself. In my apartment, I run nextcloud so I can sync everything to my NAS on the local lan. The nextcloud instance also has an v3 onion service running on a funky port. If I need to grab something from the NAS while I am out, I can connect via Tor on my laptop or my phone and get it.

Answer 2

If for whatever reason it's not secure to let port 22 open on Internet, why'd it be so inside Tor? What kind of thing would change security risks?

• You could be behind some corporate firewall that blocks SSH, while Tor is slightly harder to block.
• You may not want to expose your home IP address to the Internet.
• Tor has a hidden service authorization feature that allows you to control who can connect to the SSH server, which reduces the attack surface.

If I register an onion domain and don't tell it to anybody and if I'm not hacked and this domain is found, can it be found in anyway other way? Is it certain to say that nobody will discover it if not by my telling or stealing directly from me?

With hidden service protocol v2, this is mission impossible. Anyone can harvest your hidden service descriptor by impersonating HSDirs, unless you are using 'stealth' authorization.

Hidden service protocol v3 is designed with harvest attack resistance in mind, so you might be able to be certain to say so. It is not completely impossible to harvest, though.

Also, is Tor hidden services aimed at reducing security risks? Isn't it aimed at anonymously serve contents and services in a way that an adversary wouldn't know where our service/content is hosted?

Tor hidden services are mainly aimed at anonymity, but providing extra security is also a goal.

Anyway, if it's indeed a security good practice, or at least if it doesn't increase risks, since I alrdy use Tor outside home, I'd like to make some of my stuff available for me only.

Use Client Authorization for v3 hidden services. Use 'stealth' mode authorization if you stick to v2 hidden services. Using random ports somehow helps, but it is another kind of security via obscurity, so I would not recommend doing so.