Talking in terms of privacy, is it better to use the same .onion domain, mapping different ports to the same .onion or is it better to generate different hidden services?

  • Different hidden services. This is a fact-based question, though it would be easier to answer if you told us your threat model. See answer below. – DylanYoung Dec 20 '20 at 21:58

Use different hidden services if anonymity (hidden services don't necessarily provide "privacy") is paramount.

The reason being that if the service operating on one port reveals your identity (or if that identity is somehow leaked out-of-band), it also reveals the identity of the operator of the service on the other port.

Moreover, you should operate the services in separate sandboxes/servers to avoid timing attacks if you require that level of anonymity.

If you're concerned about your users' anonymity, i can't say for sure, but I suspect someone within the network (one of the service's introduction nodes?) might be able to correlate access between the two ports. This correlation is a form of fingerprinting that could contribute to deanonymizing your users. Perhaps someone in the research community can correct me here?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy