Can a Tor Hidden Service be run safely with remote assets?

Question

Is it possible to run a Tor Hidden Service with remote assets, i.e. files, databases, etc? Would such a setup decrease the security and anonymity of the service? Would the remote assets also need to be within hidden services?

Answer 1

For remote assets on the client/browser side, like javascript (which you might want to avoid in first place, though, as many people will probably want to disable JavaScript when using Tor), CSS, etc. you might, in the interest of your users consider to also have them inside Tor, maybe provided the same server.

For databases, etc.: It would probably make sense to either keep them on the same server, not allowing connections from Tor/the internet in general. Else, for example when you have a hidden service running on one server and another server with the DB it might make it possible/easier to correlate this traffic with your hidden service. You should at least make sure any such connections are encrypted, but you should do that either way, even when not using Tor.

Using external services for either of these might however reveal your identity. For example an external JavaScript that somehow communicates with the hidden service, that wasn't created by you might be modified in a way that tried to reveal your identity. For databases, etc. you of course need to trust the provider/administrator to not use it to reveal your identity as you will most likely use a non-tor location. For latency reasons using another hidden service there might not be an option. However if you really control that other server and make sure that the connections are encrypted (probably create a VPN between them?) you should be fine.

However, if you create such a setup you really want to double check that there are only authorized connections possible. So for example use a VPN and make the database bind to the IP of that VPN only. As usual multiple layers of security (firewall, VPN, ACL, ..) might increase your security.