I’m being asked by an onion site to add HidServAuth to my torrc file. I was wondering if my anonymity could be compromised in any way through the use of this feature. Thanks in advance.

| improve this question | | | | |

It could be used to track you across attacker controlled sites and link together multiple identities.

Imagine a scenario where an attacker creates a HidServAuth key for each of their intended victims. The attacker controls multiple websites (onion services or normal websites). The attacker convinces the user to configure the HidServAuth option.

The user is now able to access the onion for which the HidServAuth is intended. The users access is unique to them.

The attacker adds "Web beacon" type resources to all of the websites they control. The web beacon points to a URL under the HidServAuth onion, along with a unique string for each of the attacker controlled websites.

The user, over time and under differing identities, visits some of these websites. The user loads the web beacon, this links together the users HidServAuth access and the website their visiting, if the attacker fully controls the websites they can link together account and identity information and perform long-term tracking of the user across any services they control.

Making such changes to your Tor configuration will make you behave in a unique way, different to all other Tor clients. Anyone, like the attacker, with knowledge of in what way it will behave differently can try to manufacture circumstances where the behaviour will become apparent, I.E., the user is able to load a resource from an .onion that no other user could.

To defend against this, you might want to setup a second Tor Browser installation which has the HidServAuth configuration option which is used exclusively for that .onion associated with that HidServAuth key. This will prevent it potentially contaminating your other activity on Tor.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.