1

I would like to develop a small hidden service that require authentication, i.e. the first thing that must show up is the login page.

I'm pretty newbie in all this web-services world and some questions arise in mi head:

  • What are the secure recommendations when implementing this feature?
  • What software do you recommend? (apache + php?)
  • It is necessary to get a SSL certificate?
  • And more important, will this feature be seeing as a challenge in the eyes of some enthusiast Tor users?

So far I've just seeing this question with "Who knows, it might even work." as the final sentence of the correct answer. So I'm a little intrigued.

Thanks in advance! Warren.

Improve this question
1
  • It does work :)
    – Jeff
    Commented May 22, 2015 at 3:08

1 Answer 1

Reset to default
0

I would suggest that you get acquainted with clearweb hosting practices before trying to turn them into a hidden service.

Some would recommend a LAMP configuration at least initially. There are new schools of thought when it comes to deciding on a TLS certificate for your hidden service, but technically it is unnecessary as the current Tor Hidden Service Protocol connection is already encrypted to provide the confidentially integrity checking.

The question about "What are the secure recommendations" is too open of a question to answer but points back to you should look into how other web applications implement secure authentication. Consider implementing existing code that provides hardening guidelines.

Improve this answer
3
  • Thank you for answering @Lizbeth :D! I do have some experience (only 2 projects though) with clean webs using LAMP, so I may be not so lost (hopefully). Respect to implementing existing code, do you have any samples of secure and functionally ones? Thanks again for answering and please excuse my English :s
    – AronNeewart
    Commented May 19, 2015 at 20:36
  • Not really but OWASP provides a lot of guides for this type of thing: owasp.org/index.php/Guide_to_Authentication
    – Lizbeth
    Commented May 19, 2015 at 21:09
  • I will definitely have a look at it, thank you very much! Edit: I will wait a couple of days. If nobody post anything more I will set you answer as the correct one :)
    – AronNeewart
    Commented May 19, 2015 at 21:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .