I've noticed that Tor connects to sites on clearnet with 3 relays (see first picture). In this particular example my packets go through relays in Germany, Canada and US. But when I connect to duck duck go on deepweb (see second picture), it uses 6 relays, 3 of which are concealed. Am I interpreting it correctly? If so, why are they secret? And why do I need 3 more to connect to the onion site? I've been researching a lot, but no guide mentioned this (maybe I got something confused). Thanks a lot.
1 Answer
The general conception of an onion service is that both the client and the service should have anonymity, both from an eavesdropper and also each other. If the client and service wish to identify themselves and their location to each other, they can do so by some application-level mechanism (such as by logging in), but Tor itself is going to work very hard to provide anonymity by default.
In order to do this, both sides need to create a circuit whose routing they control, so as to prevent attacks from a malicious counterparty. They do this by selecting a "rendezvous" node, which will pass traffic between the client's anonymity circuit and the service's. If you think about who could be "evil" in this scenario, and what information they have access to, you can determine that the anonymity of both sides of the connection are no worse than that of any other operation within the Tor network.
An interesting side-note: there are some services, such as Cloudflare's Tor access proxy, which do not need anonymity for themselves. Everyone knows what Cloudflare's .onion addresses are, who Cloudflare is, and where their servers are. Cloudflare isn't providing an onion service to hide their location, but instead only to make a more convenient way for Tor users to access Cloudflare's services. Thus, if you make a connection to a Cloudflare-using site using Tor, the circuit information will only show one hop between the rendezvous and Cloudflare. This is a special setting you can enable in the onion service configuration, if you (as the service provider) don't need anonymity.