We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

51

Tor clients do not, in general, directly do DNS requests. When you open a connection through the tor network you usually ask your client (on its socks ports) to connect you to a hostname and port, say www.example.com:80. Your tor client, once it has created a circuit, will send that hostname and port to the exit node in its RELAY_BEGIN cell. The exit node ...


16

It doesn't resolve them in the common sense - there is no DNS involved at all. It looks up their introduction point on the hidden service directories - see Is it possible to look up the public key for a .onion-address?. Then a rendezvous point is set up where the hidden service and the client meet - answers to How do onion addresses exactly work? have more ...


6

The creation of the hostname is described in rend-spec, the Tor Rendezvous Specification. You are 100% correct: There is no central domain name provider on the Tor network. There is no central anything provider on the Tor network. How it works: Tor generates two keys for every service on the Tor network. Tor generates a private "secret" key, and a ...


6

You have to remember, that Tor is a PROXY. Proxies act on behalf of another, and therefore, theoretically you would only need to "resolve" the address of the first node of the circuit. But you don't have to do that, because Tor already has that information in its configuration files. What happens is that the exit node "handles" everything, including DNS, ...


6

Always useful to search Tor's bug tracker. They discussed it, see Ticket #6116: apply for .onion gTLD at IANA. I'd say it's undecided. There are no plans to spend the money for now, but if one of Tor's sponsors wanted them to apply for that domain in future, they'd do it. I'd speculate, it's pretty unlikely. I guess they would rather talk their sponsors ...


6

No, the HS directory is accessed via Tor. See: https://gitweb.torproject.org/torspec.git/tree/rend-spec.txt#n549 The nodes running HS directories do form a distributed hash table, though it's not decentralized the same way that Freenet is, since all of the HS directory nodes are listed in the Tor consensus. So the client identifies which HSDir node is ...


5

One technique is to firewall your computer off so it can only communicate through Tor, and then use the application, watching your firewall logs. Set up a Tor bridge on another host in your network/on the internet. Boot your client/testing machine from a LiveCD. Install Tor on your client, have it point to the bridge. Use a firewall such as shorewall or ...


5

I recommend building one of your own rather than sharing one. You can run a non-logging DNS service (a recursive caching resolver) on the same system as the Tor node, or on another system netwise nearby. This can provide good safety and performance. As you note, other DNS services can and often will log DNS queries, engage in typo-squating/hijacking, or be ...


5

DNSCrypt does not give you protection against man-in-the-middle attacks, it just moves where the man-in-the-middle would need to be. For example, if the man-in-the-middle existed between your upstream resolver and the authoritative DNS servers for the domain or between them and some recursive resolver or between their upstream recursive resolver and the ...


4

(not a full answer, but relevant) ICANN published the study Name Collision in the DNS (PDF, 3.3 MB): A study of the likelihood and potential consequences of collision between new public gTLD labels and existing private uses of the same strings


4

According to RFC 6761 domain names can be reserved for "special use". Currently several people are attempting to reserve .onion, .exit, .i2p, .gnu, and .zkey so that they couldn't become TLDs (as mentioned in this weeks Tor Weekly News)


4

The WikiLeaks list is good. And then there's the JonDonym list.


4

I found the issue after some reading. The VirtualAddrNetwork setting was the same as the dhcp pool in my network configuration so when .onion domains were returned the browser was attempting to forward traffic to an address on my local area network, which was not the correct configuration. If anyone is interested I can post the config files, but a much ...


4

If a user connects to the clearnet webservice with Tor - then the webserver sees the exit node used by the user. If the user connects to the webservice through the .onion domain - the webserver sees the ip as 127.0.0.1 (localhost), and have no idea where the traffic comes from. The main difference is that if you connect through the onion domain everything ...


4

Use DNSPort 53 setting in torrc and configure nameserver to 127.0.0.1


3

If you're using Tor within GNU/Linux, you can use tor-resolve: > tor-resolve tor.stackexchange.com 198.252.206.16 The program sends a DNS request and shows you the answer. The option -x also does a reverse lookup.


3

The list of all Tor relays and whether they are exits needs to be public, because Tor clients use this information to build circuits. There is no point in trying to keep this information 'secret' because anyone could obtain the list by running a client and then publish it. For operators of exit relays, the fact that they are publicly advertised as such ...


3

It works normally with Tor and without any configuration.For example, when your browser are trying to find IP of https://en.wikipedia.org/wiki/Domain_Name_System ,it will check hosts(this file in C:\WINDOWS\system32\drivers\etc\hosts )first,if the IP is in here,then job done.


3

Update 2015 IANA added .onion to the list of Special-Use Domain Names. This was based on RFC 7686: The ".onion" Special-Use Domain Name. Tor’s ticket #6116: apply for .onion gTLD at IANA got closed. Everything’s fine.


3

Anyone with the private key can submit HSDir entries for a .onion address. There is no "registration" per se, only deriving the private key and its public key, but creating a private key with a specific public key is computationally infeasible. Those vanity url's like Facebook's facebookcorewwwi.onion are discovered, not registered, by generating billions ...


3

You should prefer torsocks over proxychains, since torsocks is intended to block potential leaks. Especially in cases with tools like youtube-dl which might try to pass over execution to programs that can make network connections of their own in unexpected or attacker controlled ways. Specifically with proxychains, if anything wrapped in proxychains tries ...


3

Yes, that's possible. Note that no serious censorship is done through DNS (alone) though, it's trivially easy to defeat, even without Tor. Exit relays should be censorship free, so people shouldn't be setting up exits inside of censored countries. If they are they should maybe try excluding censored sites or locations from their Exit Policy so that people ...


2

Watching syscalls Alternative to detecting unwanted traffic on a network level (by firewall or a packet sniffer like tcpdump) is to watch system calls of the application. For example on Linux you can run the application under control of strace: strace -e trace=socket,getsockopt,setsockopt,getsockname,connect,bind,send,sendto,sendmsg,recv,recvfrom,recvmsg ...


2

http://www.opennicproject.org/ please keep in mind that by using a dns server you provide valuable information to the operator of the dns server, because the operator CAN SEE the requested lookups: : )


2

The problem was in my torrc, with: VirtualAddrNetwork 192.168.0.0/8 My bad. This should be: VirtualAddrNetwork 192.168.0.0/16 github.com is accurately 192.30.252.129 I enable the debug in torrc: Log debug file /var/log/tor/debug.log And, first success: Feb 27 02:01:48.000 [debug] {APP} parse_socks(): socks5: fqdn address type Feb 27 02:01:48.000 [...


2

If you enable tcp-upstream: yes in your unbound configuration, the remote DNS server should also be able to reply to TCP requests, in other words, to be listening on port 53 TCP. I couldn't find a free DNSSEC enabled server that does this, all of them talk only UDP.


2

The 3 configuration examples given offer different benefits and drawbacks. Our preference would be towards #1, as this minimizes latency while offering security on the transportation layer (and with a DNSSEC validating cache, validation of the origin and answer itself). From a security standpoint, this should allow the same level of protection that Tor ...


2

These requests are meant to detect DNS resolvers that fake answers for non-existant domains. This feature was added for relays in Tor 0.1.2.13 (released 2007-04-24): - Workaround for name servers (like Earthlink's) that hijack failing DNS requests and replace the no-such-server answer with a "helpful" redirect to an advertising-driven search portal. ...


2

That is an issue in Norton ConnectSafe DNS. It is resolving invalid domain names. What is really happening is that Norton ConnectSafe DNS redirects to a Norton domain (used for advertising) in the case of misspelled or non-existant domain names. Unfortunately, this behavior cannot changed from the user side. It is up to Norton to change it. As a fix for ...


2

Tor is saying that a program did not use DNS through Tor and instead used DNS through your clearnet IP address. While the DNS server, and those that saw your connection to the DNS server, do not know what you did on the website you connected to, provided there was an encrypted connection to the site. They may be able to figure out what you did on the visited ...


Only top voted, non community-wiki answers of a minimum length are eligible