3

Relays in the Tor network have varying CPU and networking performance. This means that the throughput of a circuit depends on the performance of the relays in the circuit. Some circuits will be slower and others will be faster. Having a video that loads quickly does not indicate any kind of attack, and you just may be accessing the website over a circuit ...


3

The way to check to see if a website is or is not a phishing attempt is the exact same way regardless of the browser. Click on the information link: Click on the arrow for the certificate on the right: Check the certificate: Facebook has one of the few onion services that uses trusted certificates. They are still expensive and hard to get. If the onion ...


3

This is now possible in Tor Browser 9.5: https://www.torproject.org/releases/tor-browser-95/ You can set the Onion-Location HTTP header or add a <meta> tag to the HTML. See https://community.torproject.org/onion-services/advanced/onion-location/ and https://kushaldas.in/posts/onion-location-and-onion-names-in-tor-browser-9-5.html for details. To ...


2

You have a simple nginx webserver and it is listening on http port 80 for mywebsite.com. You set up tor to also listen externally on virtual port 80 as a onion service for mywebsiteabcxyz.onion. This can all live on the same web server at the same time. No reverse proxy is required. The key is that tor will always listen for a virtual onion service port ...


2

I also tried google search console and added the tag into first page of my onion site and also added the proxified site (MyWebsite.onion.to or MyWebsite.onion.ws) inot google but google can't detedct it. It's not that Google can't detect it, it's that they don't try. You can't even find facebook's .onion service there. Why? Because their search spiders are ...


2

If no login/password is implemented in any form, then it is 100% scam.


2

I've messaged one of the tor developpers and he's been kind enough to answer. In the rend-spec-v3.txt document, the function is actually specified in appendix A2. And the "HSDirV3" flag never existed. It'll be removed from the specification.


1

The question is basically saying that Facebook started with this onion address, then set out to generate the corresponding private key. This premise is incorrect, as pointed out by Steve’s answer: in fact, this task would be infeasible using current hardware. Where could this incorrect premise have come from? According to Facebook’s announcement [1], their ...


1

Facebook's onion domain has only 8 custom characters, not 15. Since they generated multiple names with those 8 characters, they chose the one that looked best. It is still out of reach of modern hardware to brute-force all 16 characters. Onion names with 16 characters are for v2 onion services, which are deprecated and will be removed from the network later ...


1

First, let's establish the proper definitions of each term: The clearnet: the publicly available internet. This is the surface web, the part of the web that can be accessed by search engines. Darknet: A darknet is an overlay network within the Internet that can only be accessed with specific software, configurations, or authorization, usually using a unique ...


1

Neither of those links are to onion services. The first one (https://randomletters.onion.pet) is a MITM proxy which you can see from the .pet at the end. The second one (https://otherletters.com) is a site pretending to be an onion address which you can see by the .com at the end. So to answer your question, no DuckDuckGo is not indexing onion services.


1

The private_key file is an old format for v2 onion services, and the hs_ed25519_secret_key is the modern format for v3 onion services. Tor version 0.4 and above defaults to v3 onion services, but you can specify this manually in your torrc settings using the line HiddenServiceVersion 3 after your HiddenServiceDir line. The only important file to copy is the ...


1

Use different hidden services if anonymity (hidden services don't necessarily provide "privacy") is paramount. The reason being that if the service operating on one port reveals your identity (or if that identity is somehow leaked out-of-band), it also reveals the identity of the operator of the service on the other port. Moreover, you should ...


1

Your closest option would be tor's MapAddress option. You can use this to set up an alias for all connections made by the tor client. For example: MapAddress blah.fx fvadgbdfgbdfg5vdg46dg6v4df6gv4dfgd6f4g8vdf4g864.onion MapAddress foo.fx g546vgvhgewg34grthrth45hg5tgt5rgrsgdfsg45gyregd.onion


1

I don't know of any uptime SaaS providers that support monitoring websites on their onion service endpoints. Until that day comes (as it's hard to think of a reason why any admins shouldn't make their websites accessible at a .onion address--which benefits the privacy of their visitors), a simple solution is just to spin up a small micro sever (such as the &...


1

I guess the easiest way would be one of: Use separate port number for each hidden service and have your server listen on all of them; Use separate ip address on loopback / dummy device for each hidden service. This was you have unambiguous mapping from hidden service name to either target port or target address.


1

The encoding of the onion service address is specified in section 6 of the rendezvous specification: https://github.com/torproject/torspec/blob/master/rend-spec-v3.txt#L2136 The onion address of a hidden service includes its identity public key, a version field and a basic checksum. All this information is then base32 encoded as shown below: onion_address = ...


1

Thanks to @Steve, I ran the following: systemctl cat tor@default.service Which gave me: # Hardening AppArmorProfile=-system_tor NoNewPrivileges=yes PrivateTmp=yes PrivateDevices=yes ProtectHome=yes ProtectSystem=full ReadOnlyDirectories=/ ReadWriteDirectories=-/proc ReadWriteDirectories=-/var/lib/tor ReadWriteDirectories=-/var/log/tor ReadWriteDirectories=...


1

I believe the traffic is encrypted 8 times (not including the TLS link crypto): 3 times along the client's circuit, 4 times along the onion service's circuit, and once more for the end-to-end encryption from the rendezvous handshake. Client ─── A ─── B ─── C ─── Z ─── Y ─── X ─── Onion │ ^ ^ ^ ^ ^ ^ ^ │ └───────┴─────┴────...


1

I did the experiment suggested by @Steve in the comments. Spins up a simple http server on my Android phone, setup Orbot to expose it as a hidden service and written a script to periodically send request to the hidden service. Then just use my phone as usual. Browsing, streaming, play games and what not. And I did what I do usually: cycling, go to work, etc.....


1

https://www.reddit.com/r/onions/ has a large number of them. Make sure to read the sidebar for a list of search engines. You can find all contributed onion services here. The Tor project's own onion service is here.


1

There is no way to know that. If they were like Facebook and had a signed certificate, you can at least say, "that looks legit" even though they could still be run or have a backdoor for law enforcement. Since there isn't even that, anything you say that can very well be sent directly to law enforcement and you have no way to know and there's no way to find ...


1

The introduction point never learns the IP address of the onion service. The onion service builds a 3-hop circuit to the introduction point in order to stay anonymous, just like clients build 3-hop circuits. Also, the answer you linked to was for V2 onion services. Since then Tor has added support for V3 onion services which provide much better security/...


1

So it seems the public key is only 32 bytes long, but in your example it is 64 bytes long. I coded the following script, given the full public key of 64 bytes and got the sample address you put. So take it as a reference! from base64 import b32encode from hashlib import sha3_256 def main(): # Expected result: ...


Only top voted, non community-wiki answers of a minimum length are eligible