March 2021 - tor-commits - lists.torproject.org

[community/staging] Update how to setup tor with a webserver. Fix #157
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 1505dabdf82300cf32c307cc6bc8db8a82f72465 Author: gus <gus(a)torproject.org> Date: Tue Dec 8 09:03:06 2020 -0500 Update how to setup tor with a webserver. Fix #157 --- content/onion-services/setup/contents.lr | 130 ++++++++++++++++++++++++------- 1 file changed, 101 insertions(+), 29 deletions(-) diff --git a/content/onion-services/setup/contents.lr b/content/onion-services/setup/contents.lr index 464596f..50fed1c 100644 --- a/content/onion-services/setup/contents.lr +++ b/content/onion-services/setup/contents.lr @@ -19,77 +19,149 @@ cta: Get Started html: two-columns-page.html --- body: - -This guide shows you how to set up an onion service for your website. +This guide shows you how to set up an onion service for your website. +For the technical details of how the onion service protocol works, see our onion service protocol page. ## Step 0: Get a working Tor -As part of this guide, we will assume you have a functional Tor in your machine. Tor should be up and running correctly for this guide to work. You should also know where Tor's configuration files are. - -To setup Tor, Windows users can follow the [Windows howto](https://2019.www.torproject.org/docs/tor-doc-windows.html.en), OS X users should follow the [OS X howto](https://2019.www.torproject.org/docs/tor-doc-osx.html.en), and Linux/BSD/Unix users should follow the [Unix howto](https://2019.www.torproject.org/docs/tor-doc-unix.html.en). +As part of this guide, we will assume you have a functional Tor in your machine. +To set up Tor, please follow the [Tor installation guide](https://community.torproject.org/onion-services/setup/install/). +Tor should be up and running correctly for this guide to work. +You should also know where Tor's configuration files are. ## Step 1: Get a web server working -As a first step you should setup a web server locally, like nginx or lighttpd. Setting up a web server can be complex. -We're not going to cover how to set up a web server here. If you get stuck or want to do more, find a friend who can help you. +As a first step, you should set up a web server locally, like Nginx, Apache, or your favorite web server. +Setting up a web server can be complex. +If you get stuck or want to do more, find a friend who can help you or connect with any of the forums online that offer help. + +As an example, we will cover how to set up an onion site with Nginx and Apache on Debian. We recommend you install a new separate web server for your onion service. -You need to configure your web server so it doesn't give away any information about you, your computer, or your location. -This is not an easy task and in the end of this document we will offer more resources on how to make this possible. +On this page, the commands to manage the web server are based on Debian-like operating systems and may differ from other systems. +Check your web server and operating system documentation. + +### Apache + +Apache is available in the main repository of multiple Linux and *BSD distributions. +To install `apache2` package: + +`$ sudo apt install apache2` -Once your web server is set up, make sure it works: open your browser and go to http://localhost:8080/, where 8080 is the webserver port you chose during setup (you can choose any port, 8080 is just an example). +### Nginx + +Nginx is available in the main repository of multiple Linux and *BSD distributions. +To install `nginx` package: + +`$ sudo apt install nginx` + +By default, the web server will be running on `localhost:80` at the end of the installation. +If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. + +Once your web server is set up, make sure it works: open your browser and go to http://localhost/. Then try putting a file in the main html directory, and make sure it shows up when you access the site. ## Step 2: Configure your Tor onion service The next step is opening the config file of Tor (torrc) and doing the appropriate configurations to setup an onion service. Depending on your operating system and setup, your Tor configuration file can be at a different location or look different. -You will need to put the following two lines in your torrc: - HiddenServiceDir /var/lib/tor/hidden_service/ - HiddenServicePort 80 127.0.0.1:8080 +You will need to put the following two lines in your `torrc` file: + HiddenServiceDir /var/lib/tor/my_website/ + HiddenServicePort 80 127.0.0.1:80 The `HiddenServiceDir` line specifies the directory which should contain information and cryptographic keys for your onion service. You will want to change the `HiddenServiceDir` line, so that it points to an actual directory that is readable/writeable by the user that will be running Tor. -The `HiddenServicePort` line specifies a _virtual port_ (that is, the port that people visiting your onion service will be using), and in the above case it says that any traffic incoming to port 80 of your onion service should be redirected to `127.0.0.1:8080` (which is where the web server from step 1 is listening). +The `HiddenServicePort` line specifies a _virtual port_ (that is, the port that people visiting your onion service will be using), and in the above case it says that any traffic incoming to port 80 of your onion service should be redirected to `127.0.0.1:80` (which is where the web server from step 1 is listening). + +**Tip:** A good practice to avoid leaking an onion service to a local network is to run onion services over Unix sockets instead of a TCP socket. +You will need to edit and put the following two lines in your `torrc` file: + +``` +HiddenServiceDir /var/lib/tor/my-website/ +HiddenServicePort 80 unix:/var/run/tor-my-website.sock +``` ## Step 3: Restart Tor and check that it worked Now save your `torrc` and restart Tor. +`$ sudo systemctl tor restart` + If Tor starts up again, great. Otherwise, something is wrong. First look at your logfiles for hints. -It will print some warnings or error messages. That should give you an idea what went wrong. -Typically, there are typos in the torrc or wrong directory permissions (See the [logging FAQ](https://www.torproject.org/docs/faq#Logs) entry if you don't know how to enable or find your log file.) +It will print some warnings or error messages. That should give you an idea of what went wrong. +Typically, there are typos in the `torrc` or wrong directory permissions (See the [logging FAQ](https://www.torproject.org/docs/faq#Logs) entry if you don't know how to enable or find your log file.) -When Tor starts, it will automatically create the `HiddenServiceDir` that you specified (if necessary). Make sure this is the case. +When Tor starts, it will automatically create the `HiddenServiceDir` that you specified (if necessary). +Make sure this is the case. ## Step 4: Test that your onion service works Now to get your onion service address, go to your `HiddenServiceDir` directory, and find a file named `hostname`. -The `hostname` file in your hidden service configuration directory contains the hostname for your new onion v3 hidden service. -The other files are your hidden service keys, so it is imperative that these are kept private. +The `hostname` file in your onion service configuration directory contains the hostname for your new onion v3 service. +The other files are your onion service keys, so it is imperative that these are kept private. If your keys leak, other people can impersonate your onion service, deeming it compromised, useless, and dangerous to visit. -Now you can connect to your onion service using Tor Browser, and you should get the html page you setup back in step 1. +Now you can connect to your onion service using Tor Browser, and you should get the html page you setup back in **Step 1**. If it doesn't work, look in your logs for some hints, and keep playing with it until it works. -## Step 5: More tips +It is important to note that an onion service configured like this will be readable by anybody who knows or discovers the address. +You can make onion services require authentication, and only users with a private key will access the service. +Read more about [Client authorization](https://community.torproject.org/onion-services/advanced/cli… documentation. -If you plan to keep your service available for a long time, you might want to make a backup copy of the `private_key` file somewhere. +## (Optional) Step 5: Running multiple onion services -If you want to forward multiple virtual ports for a single onion service, just add more `HiddenServicePort` lines. If you want to run multiple onion services from the same Tor client, just add another `HiddenServiceDir` line. All the following `HiddenServicePort` lines refer to this `HiddenServiceDir` line, until you add another `HiddenServiceDir` line: +If you want to forward multiple virtual ports for a single onion service, just add more `HiddenServicePort` lines. +If you want to run multiple onion services from the same Tor client, just add another `HiddenServiceDir` line. +All the following `HiddenServicePort` lines refer to this `HiddenServiceDir` line, until you add another `HiddenServiceDir` line: - HiddenServiceDir /usr/local/etc/tor/hidden_service/ - HiddenServicePort 80 127.0.0.1:8080 + HiddenServiceDir /var/lib/tor/onion_service/ + HiddenServicePort 80 127.0.0.1:80 - HiddenServiceDir /usr/local/etc/tor/other_hidden_service/ + HiddenServiceDir /var/lib/tor/other_onion_service/ HiddenServicePort 6667 127.0.0.1:6667 HiddenServicePort 22 127.0.0.1:22 - -You can use [stem](https://stem.torproject.org/) to [automate the management of your onion services](https://stem.torproject.org/tutorials/over_the_river.html). +If you're running multiple onion sites on the same web server, remember to edit your web server virtual host file and add the onion address for each website. +For example, in Nginx and using Tor with Unix sockets, the configuration would look like this: + +``` +server { + listen unix:/var/run/tor-my-website.sock; + server_name <your-onion-address>.onion; + access_log /var/log/nginx/my-website.log; + index index.html; + root /path/to/htdocs; +} +``` + +Or in Apache with Tor service listening on port 80: + +``` + <VirtualHost *:80> + ServerName <your-onion-address.onion> + DocumentRoot /path/to/htdocs + ErrorLog ${APACHE_LOG_DIR}/my-website.log + </VirtualHost> +``` - * To set up an Onion Service on Raspbian have a look at Alec Muffett's [Enterprise Onion Toolkit](https://github.com/alecmuffett/eotk). +## Step 6: Security advice and more tips + +The default version of onion services is version 3 and it has 56 characters long. +Onion services version 2 is being deprecated and will be retired soon from the Tor network, after 0.4.6.x Tor release, in July 2021. +Please read the blog post [Onion Service version deprecation timeline](https://blog.torproject.org/v2-deprecation-timeline) for more information. + +Some onion site operators may not want to disclose their onion service location. +Therefore, you need to configure your web server so it doesn't give away any information about you, your computer, or your location. +That is not an easy task, and these resources will help on how to make this possible: + + * [Operational Security](https://community.torproject.org/onion-services/advanced/opsec/). * [Onion services best practices](https://riseup.net/en/security/network-security/tor/onionservice… by Riseup Collective. + * [OnionScan](https://onionscan.org/) is a tool to check if your onion site is leaking information that could compromise your anonymity like your server IP address. + +Finally, if you plan to keep your service available for a long time, you might want to make a backup copy of the `private_key` file somewhere. + +Now that you have an onion site working, you may want to deploy [Onion-Location](https://community.torproject.org/onion-services/advanced/on…, or use tools like Docker, [Ansible](https://galaxy.ansible.com/systemli/onion) or [stem](https://stem.torproject.org/tutorials/over_the_river.html) to automate the management of your onion services. +If you have a static website, but never installed Nginx or Apache, another project to try is [OnionShare](https://onionshare.org), where running an onion site will be easier: guided with a graphic interface and with minimal configuration.

1 0

[community/staging] Add onion routing and onion services mini zines
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 7e5e02c4ae1c01a7f03785dba0fb3c8e4b609188 Author: gus <gus(a)torproject.org> Date: Thu Dec 17 19:41:44 2020 -0500 Add onion routing and onion services mini zines --- .../outreach/print/minizine-onion-routing-A4.jpg | Bin 0 -> 715035 bytes .../outreach/print/minizine-onion-service-A4.jpg | Bin 0 -> 704462 bytes databags/outreach-materials.ini | 16 +++++++++++++++- 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/assets/static/images/outreach/print/minizine-onion-routing-A4.jpg b/assets/static/images/outreach/print/minizine-onion-routing-A4.jpg new file mode 100644 index 0000000..ee27374 Binary files /dev/null and b/assets/static/images/outreach/print/minizine-onion-routing-A4.jpg differ diff --git a/assets/static/images/outreach/print/minizine-onion-service-A4.jpg b/assets/static/images/outreach/print/minizine-onion-service-A4.jpg new file mode 100644 index 0000000..4341fa0 Binary files /dev/null and b/assets/static/images/outreach/print/minizine-onion-service-A4.jpg differ diff --git a/databags/outreach-materials.ini b/databags/outreach-materials.ini index 178b23b..f4d597e 100644 --- a/databags/outreach-materials.ini +++ b/databags/outreach-materials.ini @@ -1,3 +1,17 @@ +[onion-service] +location = https://community.torproject.org/static/images/outreach/print/ +filename = minizine-onion-service-A4.jpg +label = Onion services explained in 7 steps +type = mini zine +year = 2020 + +[tor-routing] +location = https://community.torproject.org/static/images/outreach/print/ +filename = minizine-onion-routing-A4.jpg +label = Onion routing explained in 8 steps +type = mini zine +year = 2020 + [anti-censorship] location = https://gitlab.torproject.org/torproject/community/outreach/-/raw/master/pr… filename_front = Front_anti-censorship_en_EN.pdf @@ -51,4 +65,4 @@ location = https://media.torproject.org/misc/2015-03-tor-brochure/ filename = tor-brochure-en.pdf label = Tor Brochure type = brochure -year = 2015 \ No newline at end of file +year = 2015

1 0

[community/staging] Update lego
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 033a0177ba7343d9613023e88eb5371a65bfe8fa Author: gus <gus(a)torproject.org> Date: Fri Dec 18 17:46:20 2020 -0500 Update lego --- lego | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lego b/lego index 7bb98ba..8ba3580 160000 --- a/lego +++ b/lego @@ -1 +1 @@ -Subproject commit 7bb98ba753539250d3346ad559f0279b76dfb0fb +Subproject commit 8ba35806bbd2c4f37ce331ac3296971668ccbcd8

1 0

[community/staging] Update lego
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 08c72575bea409c1a375bac4c76a1a9341026d0a Author: gus <gus(a)torproject.org> Date: Mon Dec 21 08:17:02 2020 -0500 Update lego --- lego | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lego b/lego index 8ba3580..6fb6429 160000 --- a/lego +++ b/lego @@ -1 +1 @@ -Subproject commit 8ba35806bbd2c4f37ce331ac3296971668ccbcd8 +Subproject commit 6fb6429d4ed88b213dce9876d37b7e244ed00513

1 0

[community/staging] Merge branch 'onion-zines'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 02626d8f2a69902e0b2ff0bc8647afbbd41c6c9b Merge: 5858da8 7e5e02c Author: gus <gus(a)torproject.org> Date: Thu Dec 17 19:52:47 2020 -0500 Merge branch 'onion-zines' .../outreach/print/minizine-onion-routing-A4.jpg | Bin 0 -> 715035 bytes .../outreach/print/minizine-onion-service-A4.jpg | Bin 0 -> 704462 bytes databags/outreach-materials.ini | 16 +++++++++++++++- 3 files changed, 15 insertions(+), 1 deletion(-)

1 0

[community/staging] Merge branch 'update-onion-services-images'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 66a2b6656053cd72cc3571d7abc8ebf127b964db Merge: 7ad8087 21b5856 Author: gus <gus(a)torproject.org> Date: Mon Dec 14 17:13:42 2020 -0500 Merge branch 'update-onion-services-images' .../onion-services/overview/onion-service-01.png | Bin 0 -> 152528 bytes .../onion-services/overview/onion-service-02.png | Bin 0 -> 119489 bytes .../onion-services/overview/onion-service-03.png | Bin 0 -> 141765 bytes .../onion-services/overview/onion-service-04.png | Bin 0 -> 159940 bytes .../onion-services/overview/onion-service-05.png | Bin 0 -> 172457 bytes .../onion-services/overview/onion-service-06.png | Bin 0 -> 147472 bytes .../onion-services/overview/onion-service-07.png | Bin 0 -> 137636 bytes .../onion-services/overview/onion-service-08.png | Bin 0 -> 137909 bytes .../onion-services/overview/onion-service-09.png | Bin 0 -> 125387 bytes .../overview/tor-onion-services-1.png | Bin 17222 -> 0 bytes .../overview/tor-onion-services-4.png | Bin 21419 -> 0 bytes content/onion-services/overview/contents.lr | 101 ++++++++++++--------- 12 files changed, 57 insertions(+), 44 deletions(-)

1 0

[community/staging] Add gaba's review, explicitly say SecureDrop onion service
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 21b58560186f095aab029f02fd087785599f1cb8 Author: gus <gus(a)torproject.org> Date: Mon Dec 14 12:47:43 2020 -0500 Add gaba's review, explicitly say SecureDrop onion service --- content/onion-services/overview/contents.lr | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/onion-services/overview/contents.lr b/content/onion-services/overview/contents.lr index 1fa3c20..8d6be84 100644 --- a/content/onion-services/overview/contents.lr +++ b/content/onion-services/overview/contents.lr @@ -93,7 +93,7 @@ All the previous steps were just set up for the onion service so that it's reach Now let's fast-forward to the point where an actual client wants to visit the service. In this case, the client has the onion address of SecureDrop and want to visit it, so they connect to the service with Tor Browser. -Now the next thing that needs to happen is that the client goes to the _distributed hash table_ from **Step 2** and ask for the signed descriptor of SecureDrop. +Now the next thing that needs to happen is that the client goes to the _distributed hash table_ from **Step 2** and ask for the signed descriptor of SecureDrop's onion service. <img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-04.png" alt="Onion Services: Step 4"> @@ -102,7 +102,7 @@ Now the next thing that needs to happen is that the client goes to the _distribu When the client receives the signed descriptor, they verify the signature of the descriptor using the public key that is encoded in the onion address. This provides the _end-to-end authentication_ security property, since we are now sure that this descriptor could only be produced by that onion service and no one else. -And inside the descriptor, there are the introduction points that allow the client to introduce themselves to SecureDrop. +And inside the descriptor, there are the introduction points that allow the client to introduce themselves to SecureDrop's onion service. <img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-05.png" alt="Onion Services: Step 5"> @@ -115,7 +115,7 @@ The client asks the relay to become their rendezvous point and give it an "one-t ### Act 7: Where the onion service rendezvous with the client -The introduction point passes your details on to the onion service, which runs multiple verification processes to decide whether you're trustworthy or not. +The introduction point passes your details (secret string and rendezvous address) on to the onion service, which runs multiple verification processes to decide whether you're trustworthy or not. <img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-07.png" alt="Onion Services: Step 7">

1 0

[community/staging] Add https for you onion page. Fix #130
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit a730de4c19b2b6a4d03293afa4ac511c75fd815f Author: gus <gus(a)torproject.org> Date: Fri Dec 18 17:01:17 2020 -0500 Add https for you onion page. Fix #130 --- content/onion-services/advanced/https/contents.lr | 70 +++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/content/onion-services/advanced/https/contents.lr b/content/onion-services/advanced/https/contents.lr new file mode 100644 index 0000000..04c249c --- /dev/null +++ b/content/onion-services/advanced/https/contents.lr @@ -0,0 +1,70 @@ +section: advanced configuration +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: HTTPS for your onion service +--- +subtitle: Learn why some onions have TLS certificates. +--- +key: 4 +--- +html: two-columns-page.html +--- +body: + +When visiting a site over HTTPS (HTTP over TLS), the TLS protocol prevents data in transit from being read or manipulated by man in the middle attacks, and an x.509 certificate obtained from a Certificate Authority (CA) is validates that the user is actually connecting to a server representing the domain name in the browser address bar. +Modern browsers indicate that a connection is insecure if not using TLS, and require that a TLS connection is authenticated by a CA-issued x.509 certificate. + +When visiting a site over the onion services protocol, the Tor protocol prevents data in transite from being read or manipulated by man in the middle attacks, and the onion service protocol validates that the user is connected to the domain name in the browser address bar. +No certificate authority is required for this proof, because that name is the actual public key used to authenticate the underlying connection. + +As ".onion" is a [special top level domain name](https://tools.ietf.org/html/rfc7686), most Certificate Authorities don't have support for issuing X.509 certificates for onion sites. +Right now, HTTPS certificates are only provided by DigiCert with an Extended Validation (EV) TLS certificate, which means a considerable cost for an organization. + +That said, there are some specific cases where you would need or want to have an HTTPS for your onion site. + +We compiled some topics and arguments, so you can analyze what's the best for your onion site: + +1. As anyone can generate an onion address and its 56 random alphanumeric characters, some enterprise onions believe that associating their onion site to an HTTPS certificate might be a solution to announce their service to users. +Users would need to click and do a manual verification, and that would show that they're visiting the onion site that they're expecting. +Alternatively, websites can provide other ways to verify their onion address using HTTPS, for example, linking their onion site address from an HTTPS-authenticated page, or using [Onion-Location](https://community.torproject.org/onion-services/advanced/on…. + +2. Another topic of this discussion is user expectations and modern browsers. +While there is extensive criticism regarding HTTPS and the CA trust model, the information security community has taught users to look for HTTPS when visiting a website as a synonym of secure connection and avoid HTTP connections. +Tor Developers and UX team worked together to bring a new user experience for Tor Browser users, so when a user visits an onion site using HTTP [Tor Browser doesn't display a warning or error message](https://support.torproject.org/onionservices/onionservices-5/). + +3. Some websites have a complex setup and are serving HTTP and HTTPS content. +In that case, just using onion services over HTTP could leak [secure cookies](https://github.com/alecmuffett/eotk/blob/master/docs.d/security-ad…. +We wrote about [Tor Browser security expectations](https://blog.torproject.org/tor-brower-onion-services-challen…, and how we're working on onion services usability and adoption. +There are some alternatives you might want to try to address this problem: + + * To avoid using an HTTPS certificate for your onion, the easiest answer is to write all your content so it uses only relative links. +Then the content will work smoothly no matter what website name it's being served from. + * Another option is to use webserver rules to rewrite absolute links on the fly. + * Or use a reverse proxy in the middle or more specifically EOTK with an HTTPS certificate. + +4. Related to the previous point, some protocols, frameworks, and infrastructures use SSL as a technical requirement; they won't work if they don't see an "https://" link. +In that case, your onion will need to use an HTTPS certificate in order to function. + +5. Actually HTTPS does give you a little bit more than onion services. +For example, in the case where the webserver isn't in the same location as the Tor program, you would need to use an HTTPS certificate to avoid exposing unencrypted traffic to the network in between the two. +Remember that there's no requirement for the webserver and the Tor process to be on the same machine. + +### What's next + +Recently in 2020, the Certificate Authority/Browser Forum voted and [approved version 3 onion certificates](https://archive.cabforum.org/pipermail/servercert-wg/2020-Feb…, so CAs are now allowed to issue Domain Validation (DV) and Organization Validation (OV) certificates containing Tor onion addresses. +In the nearby future, we hope that [Let's Encrypt](https://letsencrypt.org/) CA can start issuing v3 onion certificates for free. + +If you're going to purchase an HTTPS certificate be aware that [v2 onion service deprecation](https://blog.torproject.org/v2-deprecation-timeline) will happen between July - October 2021. + +### Read more + + * For a detailed step by step how to create an HTTPS onion certificate, check [Brave's blog post](https://brave.com/new-onion-service/). + * [Tor Browser and Onion Services - Challenges and Opportunities (2020)](https://blog.torproject.org/tor-brower-onion-services-challenges-opp…) + * [Facebook, hidden services, and https certs (2014)](https://blog.torproject.org/facebook-hidden-services-and-https-certs) + * [DigiCert](https://www.digicert.com/blog/onion-officially-recognized-special… + * [The ".onion" Special-Use Domain Name - IETF RFC 7686](https://tools.ietf.org/html/rfc7686)

1 0

[community/staging] Add onion guides zine. Fix #166
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 9dfb4fc7bd657a837245d07fbbfdf4e565aa5e78 Author: gus <gus(a)torproject.org> Date: Fri Dec 18 14:25:53 2020 -0500 Add onion guides zine. Fix #166 --- .../images/outreach/print/onion-guide-fanzine.pdf | Bin 0 -> 343863 bytes databags/outreach-materials.ini | 7 +++++++ 2 files changed, 7 insertions(+) diff --git a/assets/static/images/outreach/print/onion-guide-fanzine.pdf b/assets/static/images/outreach/print/onion-guide-fanzine.pdf new file mode 100644 index 0000000..4416930 Binary files /dev/null and b/assets/static/images/outreach/print/onion-guide-fanzine.pdf differ diff --git a/databags/outreach-materials.ini b/databags/outreach-materials.ini index f4d597e..4b811eb 100644 --- a/databags/outreach-materials.ini +++ b/databags/outreach-materials.ini @@ -1,3 +1,10 @@ +[onion-guide] +location = https://community.torproject.org/static/images/outreach/print/ +filename = onion-guide-fanzine.pdf +label = Onion guide fanzine +type = zine +year = 2020 + [onion-service] location = https://community.torproject.org/static/images/outreach/print/ filename = minizine-onion-service-A4.jpg

1 0

[community/staging] Add talk about onions. Fix #143
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit d1962b0732d00720cd30215c001580c48b3780bb Author: gus <gus(a)torproject.org> Date: Fri Dec 18 16:50:16 2020 -0500 Add talk about onions. Fix #143 --- content/onion-services/talk/contents.lr | 142 ++++++++++++++++++++++++++++++++ 1 file changed, 142 insertions(+) diff --git a/content/onion-services/talk/contents.lr b/content/onion-services/talk/contents.lr new file mode 100644 index 0000000..d22860d --- /dev/null +++ b/content/onion-services/talk/contents.lr @@ -0,0 +1,142 @@ +section: onion services +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Talk about onions +--- +subtitle: Become an onion advocate and explain the importance of onion services. +--- +key: 0 +--- +html: two-columns-page.html +--- +body: + +Beyond myths and misperceptions, advocating for onion services and privacy enhancing technologies sometimes is challenging. +There are different use cases, and approaching potential adopters with a specific use case instead of another, can engage them and lead to new onions services being setup. + +These talking points will help to explain how onion services offer multiple privacy and security benefits in different contexts. + + * How Onion Services Work + * Freedom of Press and Censorship Circumvention + * Network sustainability + * Level up your service privacy + * Protect sources, whistleblowers, and journalists + * Decentralization + * Educate users about privacy by design + * Metadata obfuscation or elimination + +### How Onion Services Work + +A potential adopter has probably already heard about the Tor Project, the network and even Tor relays, and that's great! +[Tor relays](https://community.torproject.org/relay/types-of-relays/) are part of a [public infrastructure](https://metrics.torproject.org/rs.html#toprelays), where Tor users encrypted traffic is routed around to reach out the open internet. +Onion services aren't like a Tor relay in the network. + +An onion service on the Tor network behaves like any other Tor clients. +The Onion Service to become available on the network connects to rendezvous nodes. +A client that wants to access the onion service does the same. + +This means that connections from the client to the server never leave the Tor network. +In contrast to running a [Tor relay](https://community.torproject.org/relay), running a Tor Onion Service does not result in your IP address being publicly listed anywhere, nor does your service relay other Tor traffic. + +For a broader understanding, read [Onion Services overview](https://community.torproject.org/onion-services/overview/) and watch this talk: [DEF CON 25 - Next Generation Tor Onion Services](https://www.youtube.com/watch?v=Di7qAVidy1Y). + +### Freedom of Press and Censorship Circumvention + +Regular Tor connections already provide censorship circumvention, but only onion services can anonymize both parts of communication - users and provider -, creating a metadata free communication between the user of the service and the service itself. + +Censorship technologies are being deployed by different actors, like governments and Internet providers, worldwide to block access to free press and privacy tools. + +To protect freedom of speech and freedom of opinion in censored spaces, major media organizations have made their websites available over onion services in the last few years. + +That's the case of NY Times, ProPublica, Deutsche Welle, BBC, The Markup and other newsrooms. + +The project [Secure The News](https://securethe.news/), developed by [Freedom of the Press Foundation](https://freedom.press/news/onions-side-tracking-tor-availability-reader-privacy-major-news-sites/), tracks how secure news organizations’s websites are. One of its metrics is the adoption of onion services . + +Read the news organizations announcement about their onion site: + + * "We launched this in part because we do a lot of reporting, writing, and coding about issues like media censorship, digital privacy and surveillance, and breaches of private medical information. Readers use our interactive databases to see data that reveals a lot about themselves, such as whether their doctor receives payments from drug companies. Our readers should never need to worry that somebody else is watching what they’re doing on our site. So we made our site available as a Tor hidden service (onion service) to give readers a way to browse our site while leaving behind less of a digital trail." [ProPublica](https://www.propublica.org/nerds/a-more-secure-and-anonymous-pr… + + * "Some readers choose to use Tor to access our journalism because they're technically blocked from accessing our website; or because they worry about local network monitoring; or because they care about online privacy; or simply because that is the method that they prefer." [New York Times](https://open.nytimes.com/https-open-nytimes-com-the-new-york-times-a… + + * "DW is a global advocate for freedom of opinion and freedom of speech. […] It is therefore a logical step for us to also use Tor to reach people in censored markets who previously had limited or no access to free media." [Deutsche Welle](https://www.dw.com/en/dw-websites-accessible-via-tor-protocol/a-5133… + + * "The browser can obscure who is using it and what data is being accessed, which can help people avoid government surveillance and censorship. Countries including China, Iran and Vietnam are among those who have tried to block access to the BBC News website or programmes." [BBC](https://www.bbc.com/news/technology-50150981) + +### Network sustainability + +The traffic generated by onion services doesn't leave the Tor network, and therefore, these onion circuits free up exit relay bandwidth for others. +This is important because exit relays are a limited resource, making up 20% of the [7000 relays](https://metrics.torproject.org/networksize.html). +As they're a small fraction of the network, in general, exit relays are overloaded and represent a bottleneck for Tor users' browsing experience. + +Onion services don't use the same circuit path as regular Tor connections. +When a service is available over onion services, it adds diversity to the Tor network since it uses a different set of circuits on the network, avoiding exit relays completely. +As a result of this design, onion services and its users are immune to attacks related to [bad exit relays](https://blog.torproject.org/bad-exit-relays-may-june-2020). + +### Level up your service privacy + +Beyond websites and onion sites, it's possible to do many things with onion services, for example, email. +Even though privacy aware users can adopt tools to protect their communications like OpenPGP, there is plenty of metadata on encrypted emails: for example who is communicating with whom, when, how frequently, where, when it was sent and received, what type of computer it was generated, etc. + +As Edward Snowden points out in his book, **"Permanent Record"** (2019), + + "You know what you're saying during a phone call, or what you're writing in an email. But you have hardly any control over the metadata you produce, because it is generated automatically. [...] In sum, metadata can tell your surveillant virtually everything they'd ever want or need to know about you, except what's actually going on inside your head." + +[Onionmx](https://github.com/ehloonion/onionmx) is a software that allows the delivery of emails entirely over onion services, obfuscating the metadata of who is talking with whom. +E-mail providers like [Riseup](https://riseup.net/en/security/network-security/tor#riseups-tor-oni…, [Systemli](https://www.systemli.org/service/onion.html) and [many others](https://github.com/ehloonion/onionmx/blob/master/sources/map.yml) protect their users privacy using onionmx. + +Other providers like [ProtonMail](https://protonmail.com/blog/protonmail-tor-censorship/) allow users to read and send their e-mail securely and anonymously over their webclient that serves an onion site. + +### Protect sources, whistleblowers, and journalists + +Many journalists and media organizations use tools based on onion services to protect their sources. +They share and accept documents from anonymous sources using tools like SecureDrop, GlobaLeaks or OnionShare. + +Originally developed by Aaron Swartz, [SecureDrop](https://securedrop.org/) is an open source whistleblower submission system maintained by [Freedom of the Press Foundation](https://freedom.press) and deployed by many news organizations around the world. +With SecureDrop, sources can only submit documents in a secure and anonymous way, using Tor Browser. +Thus, a journalist won't know who the author is and can't put the source at risk. + +[GlobaLeaks](https://globaleaks.org) is an open source whistleblowing framework focused on portability and accessibility. +It is a web application running as an onion service that whistleblowers and journalists can anonymously exchange information and files. +Started in 2011 by a group of Italians, the project is now developed by the [Hermes Center for Transparency and Digital Human Rights](https://www.hermescenter.org/). + +[OnionShare](https://onionshare.org) is another tool based on onion services used to provide strong anonymity to transmit sensitive files between journalists safely. +It makes it possible to host files on your own computer and share (send and receive) using onion services. +All the recipients of this communication need to have Tor Browser installed on their computer to open the onion address. +OnionShare was developed after a human rights violation during the Snowden revelations in 2013, + + "I first saw the need for this tool when I learned about how David Miranda, the partner of my colleague Glenn Greenwald, got detained for nine hours at a London airport while he was trying to fly home to Brazil. + Working on a journalism assignment for the Guardian, Miranda was carrying a USB stick with sensitive documents. + I knew that he could have securely sent the documents over the internet using a Tor onion service, one of the most underappreciated technologies on the internet, and avoided the risk of physically traveling with them. + I developed OnionShare to make this file sharing process over the Tor network more accessible to everyone." [OnionShare 2 release](https://blog.torproject.org/new-release-onionshare-2) + +### Decentralization + +As explained in [Overview](https://community.torproject.org/onion-services/overview/), there's no central authority that approves or rejects onion services. +The address of an onion service is automatically generated. +Operators don't use the regular DNS infrastructure and do not need to purchase or register a domain name. + +A great example of this use case is the chat program [Ricochet Refresh](https://ricochetrefresh.net/). +Ricochet uses onion services to build secure communication with these features: metadata resistant, anonymous, and decentralized. +In Ricochet Refresh, each user is an onion service. +And because of that, there isn't a central server that can be compromised by an attacker. + +### Educate users about privacy by design + +Onion services are an excellent example of privacy by design technology, where one is secure and anonymous by default. +Making your service available over onion services is an opportunity to educate the general public about Tor and how a more secure way to access the internet looks like: easy as browsing a web page. +Get inspired by our campaign [#MoreOnionsPorFavor](https://blog.torproject.org/more-onions-porfavor) and teach others about the importance of anonymity. + +### Metadata obfuscation or elimination + +When you use the Tor network to browse the web you are not sending any information by default of who you are or where you are connecting from. +The Onion Services use the Tor network to eliminate information about where they are situated. +Using them eliminates all metadata that may be associated with the service otherwise. + +### One onion a day keeps the surveillance away + +Now that you know all the benefits of onion services, you may want to set up an [onion site](https://community.torproject.org/onion-services/setup/) and read about the [protocol overview](https://community.torproject.org/onion-services/overview/).

1 0