73

Up to at least October 2013 the hidden services work like this: A hidden service calculates its key pair (private and public key, asymmetric encryption). Then the hidden service picks some relays as its introduction points. It tells its public key to those introduction points over Tor circuits. After that the hidden-service creates a hidden service ...


24

They use a tool like Shallot to brute-force the onion address. What Shallot does is to generate a private key in the same way that the Tor software does when generating a new hidden service address. It then manipulates the public key portion of the key to create new versions of the .onion address and checks through those to see if they match the desired ...


23

Yes, but it may not provide the sort of load balancing you have in mind. See http://archives.seul.org/tor/relays/Apr-2011/msg00022.html The answer if two different Tors have the same hidden service private key is that they will each publish a hidden service descriptor. Whichever one published more recently is the one that a user accessing the ...


18

Alaf's answer is a good start. Describing all known attacks on Tor and how they apply to hidden services is a broad task and not really suited for a little text box here. :) But I'll give you an example. If I run a middle relay (neither a Guard nor an Exit), then I can visit your hidden service over and over and eventually you will use my relay in one of ...


18

It doesn't resolve them in the common sense - there is no DNS involved at all. It looks up their introduction point on the hidden service directories - see Is it possible to look up the public key for a .onion-address?. Then a rendezvous point is set up where the hidden service and the client meet - answers to How do onion addresses exactly work? have more ...


17

In theory, it should be just a matter of fetching /tor/rendezvous2/<hidden service identity> via HTTP from the hidden service directory responsible for that hidden service, as per the rend spec, in particular section 1.6. In practice, you need to find the right server to download it from and then form the request correctly. That's a bit icky to do ...


16

From the criminal complaint, it is fairly clear that this isn't an issue with de-anonymizing Tor. If you look under Volume of Business Activity Reflected on Silk Road Servers, on page 14 it states that on or about July 23, 2013 an image of the SR web server was made and provided to the FBI (presumably by the hosting company.) They don't mention how they ...


15

No, .onion sites are not using https/ssl by default. But the connection inside the Tor network is always encrypted, so it is not really necessary to use https for .onion sites. Exit nodes aren't used at all with hidden services, because the connection stays inside the Tor network until the hidden service is reached.


14

What's going on? You got a malware that encrypted all your files. To get them back, you have to pay. This type of malware is called Ransomware (Wikipedia). What do you mean by encrypted all my files?! When you caught the ransomware, it took your files one by one and encrypted it with a key. When all your files were encrypted, it probably created a small ...


13

I believe that all of your questions can be answered by explaining the underlying threat when running any relay on the same Tor as a hidden service: Relays publish bandwidth information about their usage and availability to enable the Tor network to efficiently route traffic and provide bandwidth where it is needed. Given that I see bandwidth information ...


13

You can extract the list from Hidden Service lists and search engines which are available at OnionDir - Deep Web Link Directory. Or you can try Ahmia.fi site which is gathering .onion addresses using various methods by crawling the hidden services, downloading visited page data from the Tor2web nodes, and users can use an HTML form to add new addresses. ...


12

Your question is quite hard to answer, because as far as I know the special capabilities of the agencies in this field are yet unknown. However you can first look into Tor's design document. Section 3.1 states: A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency ...


12

There is a HiddenServiceDir in your torrc. After you have stopped the Tor process, delete the above-mentioned directory and restart Tor. Now the directory contains two new files: hostname and private_key. The name in hostname is now different from the previous version.


12

There are few available Tor2web network gateways: *.tor2web.org, *.tor2web.fi (managed by Ahmia - Onion Search Engine), *.tor2web.blutmagie.de (managed by O.Selke with no block), *.onion.sh (managed by my unknown friend: “hey anon!”). Source: Tor2web: exposing the darknet on Internet (PDF) How it works Whenever you see a URL like http://xxx.onion/, that'...


11

Running a hidden service with safety can be really complicated. Hidden service administrator has to make sure that no application running on the server can be exploited remotely. Α hidden website may be vulnerable to the same threats every other website is. If the software a server uses to show a website is vulnerable, for example apache server or a ...


11

Instructions: Download an existing 'opensearch' XML file for one of the DuckDuckGo provider add-ons, such as the 'Lite' version (or the 'html' version which is also non-JS by default): https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-lite/ or https:// addons.mozilla.org/en-us/firefox/addon/duckduckgo-html/. Do it by right-clicking on the 'Download ...


11

You should use --socks5-hostname instead of just --socks5. This way, the socks5 proxy does the hostname resolution. Otherwise curl tries to resolve the hostname itself, which it can't.


10

It's prudent to use open-source software, given the greater risk of backdoors in closed-source products. You want to thoroughly lock down remote access to the server. In my experience, servers are constantly hammered by login attempts. It's crucial to disable password-based ssh logins, allowing only key-based logins. I've also seen thttpd recommended for ...


10

If your goal is load balancing, and the concern is the CPU usage of your machine, another option is to run the Tor Hidden Service on a machine with a load balancer like HAProxy installed. HAProxy will transfer the requests to one of several beefy webservers to handle the request, leaving the load balancer running (only) Tor and HAProxy. Another thing to ...


10

Tor's announcement over the matter states: So far, nothing about this case makes us think that there are new ways to compromise Tor (the software or the network). The FBI says that their suspect made mistakes in operational security, and was found through actual detective work. So in answer to your question, no, deanonymization did not play a role.


10

There are many onion sites that are basically lists of onion sites. But many of those are not maintained or not well. Here are some links to find more links: http://skunksworkedp2cg.onion/sites.html Harry71 - An auto-generated up to date list of sites. Search inside that page for 'links' and 'directory'. http://msydqstlz2kzerdg.onion/search/ ahmia.fi - a ...


9

Tor isn't a content-storage system. Tor is an anonymous communications system. As such, it facilitates communication, not storage. Even hidden services are about communication. They allow you to talk to services such as a hidden SSH server, hidden mail server, or a hidden HTTP server. Anything that does TCP, really. Tor could, however, be used to build ...


9

I discussed your question in the #tor IRC channel. phobos and velope helped with this answer. When I fiddled around with your question I tried to create a large number of hidden services (HS). It was quite easy to create 100 HS, but when I started Tor, the process run for some minutes on 100% CPU utilization. There was no impact on the memory. I looked it ...


9

Some people like http://onion.direct . However I am a fan of onion.link. I do know at least in terms of size of GOOG index, the results come out to: onion.direct | 21k onion.cab | 232k onion.link | 1060k Both onion.link as well as onion.cab do caching. AFAIK the other various t2w gateways do not.


8

According to the manual, there are two configuration options (i.e. things you put in your torrc): HidServAuth is what can be used on the client. It allows you to provide authentication cookies for hidden services as in HidServAuth <onion-address> <auth-cookie>. HiddenServiceAuthorizeClient is the server side companion. Protocol-related ...


8

In addition to Jens' answer, from the front page of Tor project website: For most uses, Tor provides the best available protection against a well-resourced observer. It's an open question how much protection Tor (or any other existing anonymous communications tool) provides against the NSA's large-scale Internet surveillance. On its own, Tor can't ...


8

TL;DR — When you visit a hidden service through Tor, your traffic is never exiting the Tor network (No exit node is involved) like the picture below. An overview of how we get to the above picture without revealing either parties location to anyone is below. A comprehensive explanation (with more pictures) can be found in the docs. When a hidden service is ...


8

TL;DR — Yes, traffic is end-to-end encrypted between the client and the server node. To understand why, it's important first to clear up a misconception in the original question: when Alice don't know destination node's key how is that possible encrypt traffic on this point? Alice does know the destination's public key (identity) and visa versa. Keys ...


8

In regard to the server requirements, there are a few important differences between a hidden FTP service and a regular FTP service. Also, you should check your ftp server software to make sure it doesn't leak your IP address. Force the client to use passive mode, not active/port mode. In passive mode the client initiates both the control and the data ...


Only top voted, non community-wiki answers of a minimum length are eligible