1

Is it possible that a HSDir can see visited onion urls? If I make a onion website and my friend visits it could there be a way that someone can capture the url he used? (the .onion url).

|improve this question
2

Yes, currently HSDirs can see the looked up .onion hostname. This does not include the full URL but just the .onion hostname. Proposal 224 (ticket #12424) will fix this issue. See also #8106.

If you want to make the page accessible to your friends only the HiddenServiceAuthorizeClient option might be something that could interest you.

|improve this answer
  • Simply by logging with for instance tcpdump? – Luud van Keulen Apr 26 '17 at 14:08
  • tcpdump won't work since it only sees encrypted traffic but it shouldn't be hard to modify Tor to log the addresses somewhere. – Peter Gerber Apr 26 '17 at 14:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.