Questions tagged [hidden-services]

Questions relating to Tor Hidden Services

Filter by
Sorted by
Tagged with
62
votes
1answer
27k views

How do onion addresses exactly work?

I understand that the .onion address is a public key of sorts, but not much more than that (I can vaguely guess, though). When nobody knows the IP of the .onion address, how do requests reach it? Are ...
36
votes
6answers
5k views

Can a hidden service be hosted by multiple instances of Tor?

Is it possible for multiple Tor clients, running on different machines or even networks, to publish the same Tor hidden service using the same private key to load balance requests between them?
25
votes
2answers
2k views

How strong is the anonymity of a hidden service compared to an average Tor client? How much easier is it to learn the Hidden Service's IP address?

Another way of putting this: How hard would it be to de-anonymize a hidden service? By "de-anonymize" I mean revealing the IP address of whatever server the hidden service is hosted on. Of course, ...
23
votes
5answers
9k views

Securely hosting a Tor hidden service/site

There are some detailed instructions for setting up a Tor site at torproject.org1. It seems that it would be most secure to use a dedicated machine for this task if possible. I've read elsewhere that ...
21
votes
1answer
15k views

.onion Domains DNS lookup

How does Tor resolve .onion Domains? Are there also some central DNS servers in the Tor network that store these records? Is there a chance that two hidden services generate the same domain name?
21
votes
1answer
662 views

What are the implications of a Relay hosting a Hidden Service?

Are there any implications if whilst running a non-exit relay, I also use the same machine to host a Hidden Service? Specifically: How will this affect the anonymity of the Hidden Service (in terms ...
20
votes
1answer
6k views

Is it possible to look up the public key for a .onion-address?

I know .onion addresses are a (partial) hash of a descriptor which contains a public RSA key, so I was wondering: it is possible to see the public key that is found when connecting to a .onion hidden ...
20
votes
3answers
11k views

How to set up a Tor hidden service?

Seeing that I find the technical side of it extremely interesting, I want to try to set up a Tor hidden service. For this I am following the Torproject instructions. I installed Tor, have it running, ...
18
votes
2answers
2k views

How do Hidden Services get .onion domains that aren't random?

Hidden Services usually have a long-ish string of alphanumeric characters for their .onion address, and this is generated by Tor as part of the Hidden Service Configuration. How did some Hidden ...
17
votes
3answers
73k views

Where I can find, export or download the biggest list of all .onion addresses?

Where or how I can find, export or download the biggest list of all hidden service .onion addresses?
15
votes
3answers
2k views

Is it known if Tor communication deanonymization played role in Ross Ulbricht arrestment and Silk Road store takedown?

On October 2, 2013 Ross William Ulbricht was identified by FBI as the Silk Road black market website owner and was arrested. Silk Road was operated as a hidden service on the Tor network. See also: ...
15
votes
2answers
6k views

Google indexing Onion hidden sites?

So I was searching to see what happened to Dread Pirate Roberts, the creator of underground marketplace Silkroad, and I came across something very strange; onion websites URLs being crawled by Google (...
15
votes
3answers
2k views

Can government agencies track what sites I'm visiting when using Tor?

Can agencies such as the NSA or GCHQ track what websites I'm visiting if I'm using the Tor Browser Bundle? What about hidden services?
15
votes
3answers
1k views

Register .onion as gTLD?

For some weeks in 2012, "arbitrary" gTLDs could be applied for at ICANN: On June 20, 2011 ICANN's board voted to end most restrictions on the generic top-level domain names (gTLD) from the 22 ...
12
votes
2answers
1k views

How many hidden services can I run on a single Tor instance?

I'm planning to run a service that will rely on hidden-services for anonymous data routing. Hence I will need to host a large number of them, sometimes in the same place. I have ideas about how to ...
12
votes
1answer
288k views

How do I find onion sites?

I heard one of my more software savvy friends at work telling me about the Tor Browser and about the deep web. I'm curious to find out what I can see. But I can't actually figure out how to get there. ...
12
votes
2answers
5k views

How to use Hidden Service Authentication?

How can Hidden Service Authentication be used? I never saw documentation about that anywhere.
12
votes
1answer
3k views

How to protect a hidden service against DDOS attack?

How to protect a hidden service against DDOS attack? I did some research and found that it is possible to do load balancing with HAProxy. Is there any other solution that could be implemented?
11
votes
3answers
5k views

I got infected by ransomware, and it tells me to download Tor. What's going on?

I went to a dangerous website using an unpatched browser and/or risky plugins like Java, Flash, and Adobe Reader, and now something has taken over my computer and encrypted my files. It left me a note ...
11
votes
1answer
1k views

Hidden .onion service with 2048 bit (or 4096 bit) RSA private key — how to host it?

2048 bit RSA is proven to be more secure than 1024 bit, so with the help of Scallion I have generated a pair of hidden service hostname + 2048 bit private key for it (there were 1024b 2048b and 4096b ...
11
votes
1answer
2k views

How are domain names created in the Tor network? [duplicate]

I wonder how the .onion domain names can be created? I mean, I don't assume that there is any central domain name provider. So how and where are those addresses created?
11
votes
3answers
856 views

How to programmatically detect a hidden service

Is there some magical way which I can programmatically detect whether a hidden service exists, is up, or is dead, other than trying to connect to it through the Tor socks protocol? I can connect ...
11
votes
1answer
288 views

How would a registration of the .onion gtld impact the Tor network?

The title pretty much says it all. What effects would a gtld registration of .onion domain have on the Tor network, is this something to worry about? Or is it something to welcome and slap a web2tor ...
10
votes
4answers
46k views

What are the best Tor2Web anonymous gateways?

What are the best Tor2Web anonymous gateways to make Hidden Web-Services available on clearnet/standard Internet?
10
votes
1answer
2k views

How do entry guards protect against a service location attack?

The paper Locating Hidden Servers mentions three attacks that can reveal the location of hidden servers. Among those is the service location attack. The paper states that the Tor network's use of ...
9
votes
3answers
4k views

Do all .onion addresses use SSL/TLS?

Do .onion sites encrypt the information going through the exit node? Because a lot of them start with HTTP and not HTTPS.
9
votes
4answers
3k views

Is it possible to run a secure email network using SMTP over Tor?

I have thought about some of the security issues inherent in email. For example that even if the body is encrypted the headers are plain text so metadata is available. I was wondering if this could ...
9
votes
1answer
1k views

Traffic secrecy in rendezvous points

In the Tor hidden service design Alice and Bob communicate via a rendezvous point that they agree to at one of the hidden service's introduction point. Can either of these nodes observe traffic ...
9
votes
1answer
50k views

Most .onion sites I am trying to access are unavailable: Why and how can I solve this? [duplicate]

I think that 80% of the onion sites I'm trying to reach are most of the time (if not always) unavailable. It tells me that Firefox can't estabilish a connection to the server at *****.onion and ...
9
votes
2answers
784 views

Could I run the hidden service software(e.g webserver) in a different system than the one Tor is running?

Running a hidden service in a secure way can be a really complicated matter. Ideally the system where the hidden service software (e.g. a web server) lives should not have a publicly routable IP ...
8
votes
3answers
45k views

How do I add the DuckDuckGo .onion version to the Tor Browser search providers?

By default, DuckDuckGo is included in TBB's default list of search providers in the search bar. But it is only their clearnet site (duckduckgo.com), and not their hidden service version, https://...
8
votes
2answers
676 views

Why do some websites have both onion address and non onion address?

Some websites have both public address and also a onion address. By having a public address, the service is no longer a hidden service. What is the point in having a .onion address? As a user, is ...
8
votes
1answer
5k views

What encryption algorithms does Tor use?

I am building an application that will be connected over tor, using onion services. I just realized that the file generated by Tor that contains the private key of the hidden site is only RSA 1024bits....
8
votes
1answer
163 views

Why do sites such as DuckDuckGo and freenode set up hidden services?

Presumably this doesn't help protect their identity, since they are also accessible over the regular Internet. Does it make things somehow easier for users? I think you have to set up a local Tor ...
8
votes
1answer
998 views

How to take control of a Tor hidden service if you have the private key?

I'm pretty new to Tor and don't know much about it. I was wondering how one would take control of a Tor hidden service if they had the private key. There's a darknet website called "DOXBIN" that was ...
8
votes
1answer
322 views

Should we expect to see Tor Hidden Services get load balancing (similar to I2P's and multi-homing feature) in the next several years?

I realize this question would be highly subject to unknown variables, but I have to presume a few devs are at least partially interested in onion features and someone might have an idea where load ...
7
votes
4answers
628 views

Freenet distributed hosting model: Could it be ported to Tor?

I've always wondered why Tor uses a server-based model of content storage rather than a Freenet-style, distributed, encrypted, plausible-denial model. It seems that it would be much more robust and ...
7
votes
3answers
2k views

Searching for Tor hidden networks

What resources are best for search .onion networks within the Tor? Unlike the web where you can search for a domain or portal, what equivalent systems are available for search for Tor specific ...
7
votes
2answers
922 views

Rendezvous Point (RP) & Introduction Point (IP), code question

# grep -n onion_address src/or/rendservice.c 567: oc->rend_data->onion_address); 1373: strlcpy(launched->rend_data->onion_address, service->service_id, 1374: ...
7
votes
2answers
2k views

Can onion sites have subdomains?

Can .onion sites have subdomains (e.g. subdomain.abcdefghijklmnop.onion/) or do the naming protocols prevent this? It appears to have been suggested in 2012, and the developers (or someone) say they ...
6
votes
2answers
4k views

resolve .onion address from bash

I have tried using curl through tor like so curl --socks5 127.0.0.1:9050 XXXXXXXXXXXXXXX.onion This works for public addresses like stackoverflow.com but not for tor .onion addresses
6
votes
1answer
364 views

What is the best way to reset a .onion address?

I have no particular interest in finding a specific, non-random URL (How do Hidden Services get .onion domains that aren't random?), but would like to reset an onion address for a given hidden ...
6
votes
1answer
552 views

How are Hidden Service Locations Protected From Exit Nodes?

What is to prevent exit nodes from seeing the location of servers hosting Tor hidden services?
6
votes
1answer
3k views

Do Tor hidden service directories (HSDirs) see the REAL IP of users who visit .onion sites?

I'm reading here about Tor's 'DNS' resolving mechanisms (for both clearnet and hidden services) . The mechanism for connecting to a hidden service itself (via a rendezvous point in a 7-hop circuit ...
6
votes
2answers
10k views

How to connect to a remote socket through Tor in Python?

Using normal sockets I can stream a list of numbers (updated every second) from a server to a client. This works perfectly fine. Now I want to do the same using Tor. Using Socksipy I am able to make ...
6
votes
1answer
527 views

1000s of hidden services

I run a small web hotel. I would like to give all my customers a .onion address to access their website - primarily to promote the use of Tor to my customers. So in my torrc I put: HiddenServiceDir /...
6
votes
2answers
326 views

Custom cryptography for Hidden services

Tor support AES for symmetric cryptography which is fine but for asymmetric cryptography we might prefer something else (I guess now its RSA1024 which is almost broken and proposals are saying to ...
6
votes
2answers
1k views

What is the reasoning behind keeping hidden service onion RSA keys at 1024 length?

Is the cost to performance of using larger key length not cost effective? How would it negatively impact anyone if some hosts decided to use a larger key length (i.e. Why isn't anyone free to manually ...
6
votes
2answers
850 views

Are Tor Hidden Service Addresses private by default?

If I want to configure a Hidden Service but only for personal use and didn't give out its hostname/.onion address to anyone. Can its address still be crawled/known to any third party? Summary: If no ...
6
votes
1answer
430 views

Adding/removing hidden services while not affecting the others

I want to host multiple hidden services on the same Tor instance and have the ability to add/remove "programmaticaly" hidden services while Tor is running. As of now I would update a Torrc file and ...