1

Suppose that a Tor client wants to access a certain hidden service. According to the protocol, instead of submitting a request directly to the server IP (which is hidden[1][2]), this client submit a request via a series of relays.

However, at some point, there will be a final relay in charge of delivering the client's message specifically to the server running the hidden service. In order to do so, this final relay must know the IP of this hidden server, otherwise the current internet infrastructure cannot deliver the message.

If the aforementioned steps are indeed correct, this means that in order to host a website using TOR Hidden Service you must reveal the IP address to a final relay. Therefore, Tor network does not hide the IP address of hidden services.

How to reconcile that? Am I missing something?

 

[1]: "TOR Hidden Service allows you to host a website, without revealing where the website is, and hence protects the identity of the publisher/webmaster.", WikiBooks

[2]: "The Tor network hides the IP address of hidden services, instead using onion addresses and public keys to keep the real location hidden.", Privay.net

Improve this question

2 Answers 2

Reset to default
0

Tor uses TCP tunnels, so - regardless of the previous answer - no need to use it. The hidden service is reached from the Tor node that is hosting it, usually through a localhost. The scenario you've described about IP revealing - yes, it can be a privacy problem. The design doc states clear - the system is anonymizing mostly the client, not the server - it's only rudimentary in a standard setup. To conceal your server IP use bridges-only for your hosting server(s) - that will elevate the privacy, but if you want both client and server to be equally anonymized - use I2P, not Tor - it's designed for exactly that purpose

Improve this answer
-1

This is a bit of a simplistic explanation, but I hope it helps.

The Tor service, running on the machine where the onion service is being hosted, reaches out to the Tor Network and says, if you want to use onion abcxyz.onion or port 80, then you have to talk to me (the service) but not to the IP of the machine. Because the connection is originated from the machine being hosted and not from an external machine, no actual IP is needed to be shared.

To look at it another way.

I set up a web server on standard TCP port 80 I make sure that my firewall is closed on TCP port 80 so nobody can connect to that web server. (sounds pointless, right?) I then tell the Tor service to advertise that web server on Tor so people can view it. You say, "but wait you have a firewall up, they won't be able to see your web sserver!" That would be true if I was expecting external users to connect to me. Instead, the Tor service connected to the Tor Network via UDP (not TCP) and other people are able to use that connection to come in and view my web server even with the firewall turned on. Nobody ever sees my IP because that UDP connection from my web server to the Tor network doesn't contain TCP/IP informatation. It just contains an address and a connection to get in.

Improve this answer
13
  • > "if you want to use onion abcxyz.onion or port 80, then you have to talk to me (the service) but not to the IP of the machine" The only way a node can communicate with you using the current internet infrastructure is by knowing your IP address. Without your IP address, you will never receive any income message. Mind to explain that?
    – Mark Messa
    Commented Sep 12, 2019 at 7:17
  • Tor isn't the current internet infrastructure. Tor is an overlay network that uses UDP. > Without your IP address, you will never receive any income message. That's because you don't get incoming TCP connections like you do with the Internet. People who want to visit your onion service use the connection that your local Tor service made to Tor. It is almost the opposite of how we normally think about how clients and servers work.
    – elmerjfudd
    Commented Sep 12, 2019 at 7:24
  • One more example: My ISP only gives me an internal 192.168 IP. They don't give me a real IP of my own. The real IP is shared with dozens of other people (it sucks, I know). How do users find my onion service if traffic can't come to me on a real IP? By coming in over my existing connection to Tor.
    – elmerjfudd
    Commented Sep 12, 2019 at 7:29
  • > "Tor isn't the current internet infrastructure." Ok, Tor is not the current internet infrastructure. The current internet infrastructure encompass several devices that, among other things, uses the OSI model. Considering such model, Tor is implemented in the application layer. Therefore it uses the services below it (mainly, the network layer), which requires an IP address for communication. It is simply not possible to submit internet packets without an IP address. Routers simply wouldn't know where to forward such packet.
    – Mark Messa
    Commented Sep 12, 2019 at 7:41
  • > "Tor is an overlay network that uses UDP." UDP (transport layer) requires an IP address. Without an IP address you simply can not submit an UDP packet.
    – Mark Messa
    Commented Sep 12, 2019 at 7:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .