Does hosting a Tor hidden service also on clearnet DNS reduce privacy/security for the Tor user?

Question

I am wondering about the anonymity and security differences in visiting an .onion site, from the user's perspective, between one that is ONLY a hidden service, and one that also points the same webserver to clearnet DNS - whether its DNS face has HTTPS or not.

(Also - some .onion sites / URLS offer HTTPS with the .onion URL anyway, and it's a self-signed certificate - I assume - on TOP of the HSP end-to-end encryption that already exists.)

There are many sites which offer an .onion URL counterpart to their clearnet domains:

• Riseup.net has an .onion equivalent for all servers and URLs they offer and operate.
• Tor Project itself has an official .onion address to access its site, here. (at least it doesn't work at this time, perhaps it has been removed or for the time being is inactive.)
• Whonix.org until recently, (and not again until a certain issues with hidden service scability are fixed), also offered their site to be accessed via a .onion URL.
• The Pirate Bay has an official .onion mirror which it has been operating since 2012.
• Wikileaks from time to time have also had mirrors set up by either an endorsed partner of theirs, or possibly other supporters.
• DuckDuckGo has an official .onion URL from which to use its service, http://3g2upl4pq6kufc4m.onion/.

But when a connection is made between a Tor user and a hidden service that also hosts that same webserver in non-anonymous DNS namespace (i.e. revealing the hidden service's outfacing IP), involving DNS lookups outside Tor, and with security protocols totally separate to Tor, do any of those clearnet 'compromises' somehow translate to the user connecting only to the hidden service side of the webserver? How insulated is the Tor-facing 'side' of the webserver from the clearnet-facing 'side'?

I can't imagine DNS lookups occur (and thus DNS metadata being snoopable by standard backbone sniffing), but I can think of data on the server database (user account details) being more vulnerable due to having less hops (or no hops) between its domain name and its real server IP (and no Tor encryption compared to simple server proxying either), and also wonder whether serving HTTPS on an .onion domain somehow translates to the user downloading the self-signed certificate from the server's DNS space instead of onion space too.

If the service can manage only operating in .onion namespace, is it advantageous, from the users' point of view?

Answer 1

If a user connects to the clearnet webservice with Tor - then the webserver sees the exit node used by the user.

If the user connects to the webservice through the .onion domain - the webserver sees the ip as 127.0.0.1 (localhost), and have no idea where the traffic comes from.

The main difference is that if you connect through the onion domain everything is end-to-end encrypted between you and the server, if you connect to the service through the clearnet address through tor then if there is not https on the webserver then the traffic can be sniffed by the exit node.

So thinking about that - then connecting directly to the onion domain is considered safer.