Is it possible that a HSDir can see visited onion urls? If I make a onion website and my friend visits it could there be a way that someone can capture the url he used? (the .onion url).


Yes, currently HSDirs can see the looked up .onion hostname. This does not include the full URL but just the .onion hostname. Proposal 224 (ticket #12424) will fix this issue. See also #8106.

If you want to make the page accessible to your friends only the HiddenServiceAuthorizeClient option might be something that could interest you.

  • Simply by logging with for instance tcpdump? Apr 26 '17 at 14:08
  • tcpdump won't work since it only sees encrypted traffic but it shouldn't be hard to modify Tor to log the addresses somewhere. Apr 26 '17 at 14:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.