Is it possible that a HSDir can see visited onion urls? If I make a onion website and my friend visits it could there be a way that someone can capture the url he used? (the .onion url).
Yes, currently HSDirs can see the looked up .onion hostname. This does not include the full URL but just the .onion hostname. Proposal 224 (ticket #12424) will fix this issue. See also #8106.
If you want to make the page accessible to your friends only the HiddenServiceAuthorizeClient
option might be something that could interest you.
-
-
tcpdump won't work since it only sees encrypted traffic but it shouldn't be hard to modify Tor to log the addresses somewhere. – Peter Gerber Apr 26 '17 at 14:12