1

Is it advisable to host a very lightweight (less than 300 KiB per page, including all images, stylesheets etc.) general purpose site as a hidden service?

I do not expect there to be many users (overestimating 1 GiB bandwidth usage over 1 month)

I am not worried about me nor my users being anonymous

Is this small amount of traffic good for the Tor network?
It adds some noise so that the legitimate users blend in. But it also reduces their available bandwidth.

I am also planning on using server-side processing (PHP in particular).

Pros:

  • I can get a semi-custom Onion domain for free/low cost
  • I can provide better uptime than free hosts on the clearnet
  • Allows legitimate users that require Tor to blend in with traffic generated from site
  • Introduces people to Tor and Tor Browser Bundle (eventually some will become relays)

Cons:

  • Reduces the bandwidth for legitimate users
  • Possibly more likely for me to be D/DoS-ed
    (people aren't going to take down a site that is helping them blend in, will they?)
  • More people trying to hack me (even easier since they can do it anonymously)
  • Less accessible for people (but that's my problem)
Improve this question

2 Answers 2

Reset to default
0

If your server is not anonymous, then you may opt to reduce the number of server-side hops from 3 to 1. This reduces your load on the network without reducing the user's anonymity while benefiting from the E2E properties of using onion services. As a bonus of throwing away the server-side anonymity you may run a relay without worrying about the IP-leakage when running onion services.

While neither you, nor your users abuse your service to break laws, this is legitimate usage of tor. You increase the anonymity set at a slight cost of additional load on the tor network. Host a relay if you're feeling guilty (or just because you can).

PHP will increase your attack surface from straight HTML, but in either case you should consider any public server easy to compromise and plan for the failure cases.

Do not use third party services to generate private keys. Targeting the prefix will not improve usability much, if at all. Users tend to bookmark .onion addresses. You might be able to remember the old 16-byte addresses but you cannot (or at least probably wont) memorize the new 56-byte addresses.

If you can provide better uptime than free hosting services, you're running this from your home network? This may open your network up to remote attackers, be wary.

Using onion services (especially the new 56-byte addresses using blinded ed25519 identities as the domain instead of just the hash of the public key) protects your service from automated service discovery. I.e. Your site will not be found by bots that scan the whole IPv4 space on ports 80,443. Your only attackers will be people (or bots) who have discovered your .onion address.

If you limit your users to .onion exclusively, then yes users without tor cannot consume your site (I'm ignoring trusted third party services like onion.to). Many sites that exist as onion services also exist as traditional services.

For a list of onion services for *.torproject.org see https://onion.torproject.org. Or https://facebook.com vs https://facebookcorewwwi.onion.

Improve this answer
0

Well, the weight requirements are literally the same about a clearnet and darknet sites. To make the CDN-like offload and to improve decentralization - use IPFS! If you need more details - just drop me a line, I'll be glad to help! In my project I'm packing it all together, but it's still not released yet, sadly

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .