0

Given the fact that exit nodes seem to be implicated with just about every bad story covering Tor - why have them?

Could not the clearweb be left to just continue it's evolution into a corporate cesspool, while onion services evolved to handle everything else (both legit and criminal...but supportive of non corporate interests)?

As I see it, Tor keeps getting a black eye from people who use it to inflict harm on others. Eliminating the exit nodes would remove this trouble and might actually make it safer for Tor users? No chance of accidental exit where attackers congregate.

Those new protections for onion sites have real potential, but this potential is likely drowned out by the continuing propaganda LE quarters use to justify their bullshit jobs. Elimination of exit nodes would eventually "cut such people off from the money".

What's the worst that can happen? Hackers being forced to build their own string of VPN links so they can attack clearweb sites? Why would anyone within the Tor organization care? What's in it for them when they protect such people? What is the cost of providing such protection?

Right now, the only way to avoid exit mistakes is to use a VPN provider supporting in house Tor2Web. And of course, that leaves one vulnerable to personnel changes at that VPN provider. Onion clients which "stayed within Tor" would be very useful.

1

Given the fact that exit nodes seem to be implicated with just about every bad story covering Tor - why have them?

I almost exclusively use non-onion sites via Tor. The only times I use hidden services is when I log into one of my machines using SSH and authenticated hidden services. I believe, like me, most people use Tor to be able to anonymously browse the clearnet. So, for most people, having onion services only, renders Tor useless.

It would be great to have an alternative to clearnet that has privacy and security built in but I don't believe we are anything close to a working solution. This are just a few issues I can think of if I wanted to use .onion only: a) how do I find an onion service, b) how do I know xyz123….onion is controlled by the site I want to visit, c) most services are not available via .onion (news, weather, bus schedule, good search engines, wikipedia, stackexchange, …), d) Scalability.

You may want to take a look at I2P or GNUnet if you don't want clear net access.

Also, I don't agree with "exit nodes seem to be implicated with just about every bad story". Many story cover drugs, child porn, weapons sales, etc. all happening on hidden services. I, myself, have only ever heard rather insignificant stories affecting exits.

Could not the clearweb be left to just continue it's evolution into a corporate cesspool, while onion services evolved to handle everything else (both legit and criminal...but supportive of non corporate interests)?

I don't see how abandoning the clearnet would be of any help. Tor is trying to provide journalist, whitleblowser and activist a platform to securely and anonymously reach the public. If you want to reach the mass you'll need the information to be in the clearnet, at least in the foreseeable future. Of course, there are also other people that want anonymous, uncensored access to the clearnet.

Furthermore, if hidden services become more successful and lucrative, what is going to stop corporations from entering the hidden realm?

As I see it, Tor keeps getting a black eye from people who use it to inflict harm on others. Eliminating the exit nodes would remove this trouble and might actually make it safer for Tor users? No chance of accidental exit where attackers congregate.

Yes, using hidden services removes the exit nodes as attack vector. Having no access to clearnet via Tor would not improve the situation though. People would just keep using the clearnet with no protection. I can't see how that's more secure.

Those new protections for onion sites have real potential, but this potential is likely drowned out by the continuing propaganda LE quarters use to justify their bullshit jobs. Elimination of exit nodes would eventually "cut such people off from the money".

Being an relay operator myself, I've received quite a few abuse mails and I have even received a summon from the Police once. The number of incidents is rather low though, considering the amount of traffic. Let's not forget that the people at law enforcement are just regular people struggling to keep up with modern technologies. If we want them to support Tor, we need to help them understand technologies like Tor. The same also holds true for businesses, if you used Tor for malicious purposes on any of the web sites operated by the company I work for, I'd likely be the one dealing with the case. I would be up to me to explain to cooperate and our customers what happened and why it isn't Tor's fault. Unfortunately, in many cases people are not even aware what Tor is and assume it's something bad just because it was used for something bad. We shouldn't blame cooperations and law enforcement, we should help them to understand.

What's the worst that can happen? Hackers being forced to build their own string of VPN links so they can attack clearweb sites? Why would anyone within the Tor organization care? What's in it for them when they protect such people? What is the cost of providing such protection?

I don't believe the cost of having to deal with abuse on clearnet sites outweighs the cost of having no protection at all when surfing in clearnet. (Looks at at answers of the previous questions.)

Right now, the only way to avoid exit mistakes is to use a VPN provider supporting in house Tor2Web. And of course, that leaves one vulnerable to personnel changes at that VPN provider.

Sorry, I don't get what exactly you mean by this. Can you explain to me what you mean by "VPN provider supporting in house Tor2Web" and "vulnerable to personnel". Also, how exactly would such a setup look like?

Onion clients which "stayed within Tor" would be very useful.

If you really want that, blocking non-onion addresses shouldn't be hard. I don't believe that is what most people want though.


Conclusion:

Security and anonymity are important but useless if you can't provide a solution that people are willing to use. I certainly wouldn't use it without clearnet access.

  • 2
    blog.torproject.org/blog/some-statistics-about-onions suggests that only 3% of client traffic is onion traffic. Further, if you wish to use only .onion traffic you can specify the OnionTrafficOnly flag for a SocksPort or TransPort (on recent versions of tor) to only allow client access to .onion resources, if you were so inclined. – cacahuatl May 2 '17 at 0:26
  • Good, well considered comments. – Batshit May 2 '17 at 1:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.