- tor-onions - lists.torproject.org

Exit Enclaves 2.0 ?
by Fabio Pietrosanti (naif) - lists 11 Feb '16

11 Feb '16

Years ago there where the so called "Exit Enclaves" https://trac.torproject.org/projects/tor/wiki/doc/ExitEnclave but those where abandoned. That approach was quite cool, because the end-users would had been able to just avoid using onion addresses, but keep using internet addresses having the very same security properties. It would be very nice to restore the exit-enclaves concept, reshaping it in this new context, so that end-users on Tor Browser could just hist www.website.com and, if that website support Tor, his traffic will go directly to him as an Exit node. -- Fabio Pietrosanti (naif) HERMES - Center for Transparency and Digital Human Rights http://logioshermes.org - https://globaleaks.org - https://tor2web.org - https://ahmia.fi

4 4

Re: [tor-onions] Protect against ddos in tor
by Ann O'Nymous 10 Feb '16

10 Feb '16

Ron Risley: > >> On Jan 27, 2016, at 08:24, Flipchan <flipchan(a)riseup.net> wrote: >> >> Hi all! Great with a new mailing list anyhow i was wondering IF >> anyone have any tips on some good ddos defense for .onion sites , >> take care > > Hi! > > Many DDoS attacks, particularly those that use reflection and > amplification, rely on the attacker knowing your IP address. Such > attacks cannot be used against a properly implemented .onion site, as > the service's IP address is hidden. There are also torloris and pyloris, which are not volumetric. > Conversely, defense against DoS attacks often involve blacklisting > attacking IP addresses. Since the attacker's IP addresses will also > be hidden, such defenses cannot be implemented. Indeed. > What you're left with is using good fundamental site design. > Specifically, putting any resource-intensive operations behind > authentication or a CAPTCHA. Of course, any CAPTCHA should probably > be locally generated to avoid leaking the hidden service's address, > and CAPTCHA generation could, itself, become the target of a DOS > attack. > > If it's appropriate to the site's mission, I would make only a > simple, static authentication page visible to non-authenticated > users. Wouldn't torloris or pyloris work against that too? Are these attacks still effective against onion sites? If so, what are the best defenses? One can reduce webserver read and write idle times, but that can also block legitimate users on high latency circuits. There is also the flag CloseHSServiceRendCircuitsImmediatelyOnTimeout. Is it useful to set that to "1"?

2 4

mkonion?
by Alec Muffett 09 Feb '16

09 Feb '16

I've never played with Docker myself, but this looks interesting: "mkonion is a very simple tool to allow you to set up a Tor Onion Service (also known as a Tor Hidden Service) for an existing Docker container." https://github.com/cyphar/mkonion <https://github.com/cyphar/mkonion> and https://news.ycombinator.com/item?id=11063900 <https://news.ycombinator.com/item?id=11063900> -a

1 0

Protect against ddos in tor
by Flipchan 09 Feb '16

09 Feb '16

Hi all! Great with a new mailing list :) anyhow i was wondering IF anyone have any tips on some good ddos defense for .onion sites , take care -- Sincerly Flipchan

4 3

Trasfer onions site from one host to an other
by Xonumi 08 Feb '16

08 Feb '16

Hi, i need to tranfer my onion site from one host to an other... i setup a new debian with tor, all fine and i copy the old hostname and privat key to the new debian. web server runs fine, tor log is fine but i cant visit my onion web site .... whats wrong? need a hint! Thank you!

3 10

Announcing Onion-Website with x-onion response-header?
by MacLemon 07 Feb '16

07 Feb '16

Hi! Just an idea: What about announcing that your site is also available via onion-service by sending an x-onion HTTP response header on your HTTPS website? For example: The clearweb site https://www.torproject.org/ could send a header like this: x-onion:http://examplefoobarbaz.onion/ Or in case you can actually provide a valid TLS certificate for your Onion: x-onion:https://examplefoobarbaz.onion/ Another idea would be to also provide the fingerprint of the to-be-expected TLS certificate. This could look like so: x-onion:cert-sha256="1h89m/yelEy6l1poFiXZQbJ1s6BkrOquBl7Fd+0EOO0="; https://examplefoobarbaz.onion/ Similar to what is done with HPKP headers, but without pinning. Follow up question: How could this be done with non-HTTP services? (XMPP, SMTP, etc.) Best regards @MacLemon

6 5

Random Onion Tip
by Alec Muffett 05 Feb '16

05 Feb '16

Happy Friday! Obligatory Onion tip: if you are running a public/onion hybrid site, you probably want to block Tor2web. This may sound weird ("zomg block!") but since you are already on both networks then there is risk and isn't much benefit to being accessible via Tor2web. We actually worked with Fabio/naif from Tor2web to achieve this, to keep people safer: https://github.com/globaleaks/Tor2web/issues/162 <https://github.com/globaleaks/Tor2web/issues/162> The block is simple: deny (with a helpful message) Onion requests which contain a 'X-Tor2web' header; see the SecureDrop discussion at https://github.com/freedomofpress/securedrop/issues/43 <https://github.com/freedomofpress/securedrop/issues/43> for more context. Whether your message issues or offers a redirect link is a matter of taste. We chose not to. The block is reinforced by those sites which are able to obtain an EV Onion certificate, which hampers use from uncertificated domains. -a

1 0

IRC Idea
by Alec Muffett 04 Feb '16

04 Feb '16

#tor-onions on OFTC?

5 4

Onion Mirrors
by Jonathan Marquardt 01 Feb '16

01 Feb '16

Hello onions! I just wanted to tell you about a new Onion Service I set up. Onion Mirrors is a project dedicated to setting up file mirrors as Onion Services. URL: http://onionmirors63y7c.onion/ Right now, since the project just started, there's only a Debian archive mirror. Please tell me what you think about this and use the mirror as you please. :) Parckwart

1 0

Gitlab as a HS
by spriver 31 Jan '16

31 Jan '16

Hi, yesterday I tried to setup Gitlab Community Edition as a hidden service. Nearly almost worked until I tested the functionality of pushing back into the online repo - gitlab's shell told me first this error: Failed to connect to internal API <POST http://http://gitlab.agsdcxdr6z2wbjf5.onion/api/v3/internal/allowed>: #<SocketError: getaddrinfo: Name or service not known> So i configured my server to relay .onion addresses to the Tor DNS port. But after that I'm getting the following error: [2016-01-31T17:24:43.071616 #1219] WARN -- : Failed to connect to internal API <POST http://gitlab.agsdcxdr6z2wbjf5.onion/api/v3/internal/allowed>: #<Errno::EINVAL: Invalid argument - connect(2) for "gitlab.agsdcxdr6z2wbjf5.onion" port 80> I'm out of ideas for now, does anybody has a clue what can be done now to resolve this? Cheers! spriver

2 1