Spinning Up an Onion Mirror Is Stupid Easy
205 points
11 days ago
| 16 comments
| flower.codes
| HN
crtasm
4 days ago
[-]
>I have no interest in running a relay or exit node on my VPS, so I made some minimal changes to the config file

Noting the default configuration does not turn your server into a relay or exit node, in case anyone interprets this that way.

Thanks for offering a .onion, bookmarked for the caddy configuration.

reply
qhwudbebd
4 days ago
[-]
This has prompted me to look at how the Tor Project's Arti reimplementation is going. They've got way further along than I realised:

https://tpo.pages.torproject.net/core/arti/

https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CHAN...

Hosting onion services is apparently still a work-in-progress, though, and turned off by default.

reply
yogorenapan
4 days ago
[-]
I was already able to host onion services last year by using the crate directly. A few footguns related to flushing but it generally works as expected. I will however say that the code quality could be improved though. When trying to contribute, I found a lot of somewhat bad practices such as having direct file read/writes littered around without abstraction which made refactoring difficult (trying to add different storage/cache options such as in-memory only or encrypted)
reply
cncjchsue7
4 days ago
[-]
Opting not to over engineer the solution with abstractions nobody asked for until you came along is the definition of best practice. something not being designed for any and all use cases doesn't make something bad practice. Reading and writing from a filesystem you always expect to available is more than reasonable. Modular code for the sake of modularity is a recipe for fizz buzz enterprise edition.
reply
embedding-shape
4 days ago
[-]
> along is the definition of best practice

Not disagreeing or agreeing, but "best practice" is probably one of the concepts together with "clean code", that has as many definitions as there are programmers.

Most of the time, it depends, on context, on what else is going on in life, where the priorities lie and so on. Don't think anyone can claim for others what is or isn't "best practice" because we simply don't have enough context to know what they're basing their decisions on nor what they plan for the future.

reply
m00dy
4 days ago
[-]
Letscage [0] is also using Arti to implement its privacy features.

[0]: https://github.com/letscage

reply
dewey
4 days ago
[-]
> I'm not sure if this is generally considered acceptable within the Tor network

Tor is already encrypted, that’s why you don’t need TLS. Some services (Like the hidden service from Facebook back in the days) have https but that was more of a vanity from what I remember.

reply
embedding-shape
4 days ago
[-]
> have https but that was more of a vanity from what I remember

It has a functional difference as well, lots of new client-side features (like webcrypto) only work on "Secure Origins" which .onion isn't, but websites behind TLS are. So if you wanna deploy say something that encrypts/decrypts something client-side on .onion, you unfortunately need TLS today otherwise the APIs aren't available.

Of course browsers could fix this, but I don't think they have any incentives to do so. I guess Tor Browser could in fact fix this, and maybe they already do, but it'd be a patch on top of Firefox I think, something they probably want to do less off, not more.

reply
crtasm
4 days ago
[-]
My understanding is Tor Browser already treats .onion as a secure origin, could anyone confirm?
reply
Hakkin
3 days ago
[-]
That only helps so much, some things still won't work if the browser thinks you're talking over an unencrypted connection, like HTTP/2. Technically HTTP/2 allows unencrypted connections (h2c) but as far as I know, no browser implements it (including Tor Browser) and server support is also somewhat limited, so Tor Browser is limited to HTTP/1.[01] on Onion sites unless they have a TLS certificate.
reply
bauruine
4 days ago
[-]
Yes it does but you can use Tor with other browsers too so it can make sense if you want to support them.
reply
bragr
4 days ago
[-]
I wouldn't recommend using Tor with anything other than Tor browser because there are so many browser features that will expose you now. If you don't need the Tor browser protections, you probably don't need Tor either.
reply
dewey
4 days ago
[-]
Fair point but using Tor even if you don't need it, just to put more legit traffic noise in the network is a valid use case.
reply
bragr
4 days ago
[-]
Given the actual correlations attacks governments have done on Tor traffic, I don't think more traffic moves the needle in any appreciable way. Ultimately the Tor architecture is very vulnerable to timing and correlation attacks (never use something like IRC over Tor), and the kinds of changes that would be needed to mitigate those would probably slow it down past the point of usability.

One could argue, given the limited bandwidth of the Tor network, that by using it when you don't need it, you make the experience for those that do need it worse (looking at you everyone who tries to torrent over tor).

reply
Ajedi32
4 days ago
[-]
Back when EV certificates were widely supported by browsers, HTTPS was a great way of cryptographically associating a .onion service with a real legal entity, for sites like Facebook which didn't care about being anonymous.
reply
orbisvicis
4 days ago
[-]
Without https can't the last relay snoop the traffic?

edit: oh, is the last relay the onion service? So the entire chain is encrypted?

reply
rendx
4 days ago
[-]
The key used to encrypt traffic is in the URL, everything including path is encrypted from client to the onion service end. What you are saying is true for non-onion HTTP sites, not for onions.
reply
edm0nd
4 days ago
[-]
side note: there is a built in flag mechanism called BadExit for Tor that if a relay or exit is detected to be malicious, it is quickly removed from being used.
reply
aspenmayer
4 days ago
[-]
Proton also uses HTTPS for their onion site, and they used the same certificate provider as Facebook did for theirs, Digicert, per this page:

https://proton.me/blog/tor-encrypted-email

In the above blog post, they seem to imply that they made HTTPS mandatory for Proton Mail over Tor for security reasons.

reply
adobrawy
4 days ago
[-]
The best is to refer to official Tor project documentation for .onion over https: https://community.torproject.org/onion-services/advanced/htt...

tl;dr: Pressure from browsers, enterprise, and the overall ecosystem to use HTTPS (e.g., unavailability of advanced web features without HTTPS) is pushing for the use of HTTPS without exception, even for .onion sites with no significant technical advantage.

reply
jszymborski
3 days ago
[-]
Tor browser doesn't warn on http though and I feel like 90% of folks use it exclusively.
reply
maeln
4 days ago
[-]
It is also very useful to expose services to the world wide web behind a restrictive network, Tor takes care of the Nat punching and all that jazz, and you get free dns and encryption as an extra bonus :)
reply
extraduder_ire
1 day ago
[-]
NAT punching to ssh is an incredibly useful feature of this kind of setup. As long as the machine has an internet connection, and you know the onion URL, you can tunnel into it and proceed from there. I usually do this to any machine I'm putting behind NAT.

I don't know if onion links are discoverable/crawlable, so I can't claim if this is more secure than just listening on port 22 on the open internet.

torsocks is a very useful tool for easily running programs like ssh through tor with no advance setup.

reply
age123456gpg
4 days ago
[-]
You can generate yourself a vanity .onion address using https://github.com/AlexanderYastrebov/onion-vanity-address tool. It can also generate vanity client authorization keypair.
reply
tripplyons
4 days ago
[-]
Be careful with vanity address generators. A cryptocurrency market maker once lost around $160,000,000 in a vanity Ethereum address because the generator they used was only seeded with 32 bits of entropy.

https://www.forbes.com/sites/jeffkauflin/2022/09/20/profanit...

reply
age123456gpg
4 days ago
[-]
Indeed, be careful with anything that involves secret bits.

This tool uses proper crypto/rand initialisation of the starting key https://github.com/AlexanderYastrebov/onion-vanity-address/b...

Check out my other vanity generators (they all use crypto/rand):

https://github.com/AlexanderYastrebov/wireguard-vanity-key

https://github.com/AlexanderYastrebov/age-vanity-keygen

https://github.com/AlexanderYastrebov/ethereum-vanity-addres...

reply
Trung0246
3 days ago
[-]
Unfortunately I got a hard crash on go 1.25.3 when running this: https://github.com/AlexanderYastrebov/onion-vanity-address/i...
reply
xena
4 days ago
[-]
I do something similar like this for xeiaso.net (http://ryelkcbr65vy7pzx26c3rvxya54yuh5ciafth7p6d3p3phpgo2wkz...), but I use Kubernetes so I installed the Tor controller: https://github.com/bugfest/tor-controller. I then added an OnionService pointing to the website: https://github.com/Xe/site/blob/main/manifest/xesite/onionse.... It works pretty great!
reply
wartywhoa23
4 days ago
[-]
> Oh, and free speech and anti-censorship and all that jazz.

That jazz is increasingly played by the same band of 185.220.0.0/16 exit nodes, and plays it in a scale which is all but Anonymian.

reply
flotzam
4 days ago
[-]
No part of hosting or visiting onion services involves exit nodes. Onion service traffic stays within the Tor network instead of exiting to the clearnet.
reply
immibis
4 days ago
[-]
Run more exit nodes then, and more onion services so they don't need to involve exit nodes.

It's also not such a big deal, provided they aren't messing with your exit traffic which you did encrypt, right? There are few exit nodes, but a great many non-exit nodes which still help anonymize your traffic. If you think it's a problem though, run an exit node.

reply
denkmoon
3 days ago
[-]
I’m sure lots of people would run exit nodes if it wasn’t the equivalent of putting a flashing neon sign saying “please ruin my life mr government” in front of your house
reply
storm1er
4 days ago
[-]
I would like to know more, can you give me some insight?
reply
wartywhoa23
4 days ago
[-]
Well if you use Tor somewhat regularly and check your exit node IP, it is about 50% possible that yours is in that subnet each time you renew the route. Which begs questions.

Maybe I'm wrong, but it would look more benign to have exit nodes distributed without this much bias towards that particular subnet.

reply
bauruine
4 days ago
[-]
It's only 185.220.100 [0] and 185.220.101 [1] that contain all those relays. Some of the bigger German families work together as "Stiftung Erneuerbare Freiheit" that's why you see a big cluster there. But Tor never uses relays in the same /16 for a circuit so it's not really an issue.

[0] https://metrics.torproject.org/rs.html#search/185.220.100 [1] https://metrics.torproject.org/rs.html#search/185.220.101

reply
mo
4 days ago
[-]
Correct. "Stiftung Erneuerbare Freiheit" acts as LIR in charge of the address space, handing out chunks of that space to exit relay operating non-profits for free, but does not operate any Tor infrastructure themselves and has no visibility into the traffic. The cost for us are the RIPE membership fees (approx 2000€/yr).

Source: I'm its director and founder of torservers.net. Usually using a different nick here.

reply
5f3cfa1a
4 days ago
[-]
https://nusenu.github.io/OrNetStats/ should give you a feel for the overall size & relative homogeneity of the current Tor network.
reply
superkuh
4 days ago
[-]
One problem with .onion is that it is not for casual sites or people trying to build lasting communities. The Tor Project only prioritizes security and they can and have and will again wipe out the entire tor web to nothing if they feel it is required by security. They have full control of the network. No v2 tor sites exist anymore, none of the communities, they were are just wiped out by the Tor Project because only their security use case matters. They care nothing for communities that use their software. Do not try to build communities on Tor .onion. It'll just be made inaccessible some day. All the hyperlinks will become useless. All the databases of sites, all the discussions, just gone. Because the tor project cannot abide potential lax security of older protocols.

.onion is not a way to own your domain. Even though you may have the private key and no one else does, the true owners of your domain remain the tor project themselves, as they can make it inaccessible to tor clients any time they want. They have before, they will again. And they aren't going to listen to any community feedback about it. Tor .onion is only for people that don't care about longevity or links working. Only for people who have 'security' as their number 1 and only concern.

I wasted a decade building my personal sites and casual communities on .onion. I won't be fooled again. A dot com or org is just as much mine as a .onion is, unfortunately, and at least those don't all disappear every 10 years.

reply
bfkwlfkjf
4 days ago
[-]
I would love to hear more. Have you published this somewhere you wanna share?
reply
jjmarr
3 days ago
[-]
reply
stephenlf
4 days ago
[-]
What a pleasant read. Informative in all the right places without losing brevity. Thank you.
reply
INTPenis
4 days ago
[-]
It's not a mirror, it's a proxy. If someone encroaches on their free speach and shuts down their hosting account that "mirror" will not save them.

Just saying, this is an important distinction to me and I've been hosting tor nodes since the 2000s.

Archiving information, and making it available, is sometimes more powerful than anonymous proxying.

Especially if there's an anonymous proxy available to that archive. ;)

reply
Retr0id
4 days ago
[-]
As long as they have the private key they can move it to new hosting infrastructure without issue, and the same onion address will still be operational.
reply
a022311
4 days ago
[-]
"Mirroring" is a term also used when a single source publishes data in different mediums (technically in this case we're talking only about the internet but the internet is full of different protocols so I'll call them mediums). For example there are websites that mirror their content to Geminispace or in this case make it available as an onion service.

You are correct that this solution does not prevent problems if the server goes down. This particular approach aims to reach a larger audience, while your idea of mirroring enables resiliency.

Both approaches have their use cases and can even be combined too!

reply
simonmales
4 days ago
[-]
This is a good reminder for myself to get some onion addresses for my sites and spread awareness of Tor.

TIL that Onion-Location is a header, only new about the <meta> element.

  <meta http-equiv="onion-location" content="http://<your-onion-service-address>.onion" />
reply
CGamesPlay
4 days ago
[-]
The "http-equiv" in that meta tag means "equivalent HTTP header", FYI.
reply
immibis
4 days ago
[-]
But it's not always followed. Most HTTP headers aren't interpreted when specified with http-equiv, and vide versa.
reply
badmoddingyo
4 days ago
[-]
Whats not easy is dealing with harassment from the law as a result.
reply
phaer
4 days ago
[-]
Very unlikely if you just hosting an onion service with legal content, where all traffic is encrypted.

Having to deal with law enforcement is unlikely even if you run a normal, encrypted, TOR relay.

Exit nodes, on the other hand, will most likely get letters or even visits by law enforcement. But those are not involved at all when just running an onion service.

reply
jandrese
4 days ago
[-]
There is one form of harassment though, if you run even just a TOR Relay you tend to be put on realtime blackhole lists regularly which will cause random websites to refuse your connection. Things like banks, ticket sites, even your insurance company might suddenly block your connection because your IP is listed as "Exterme Risk, active threats, verified" on one of like 200 RBL sites because someone scraped TOR and put all of the IP addresses they found on there and tagged them as active threats.
reply
immibis
4 days ago
[-]
Don't run it at home then.

Or do, and call your bank's customer support until they fix it.

Or wait until the next day when it's your neighbour's problem because your IP changes every day and your bank gets a bunch of complaints from different customers who are your neighbours.

reply
dpoloncsak
4 days ago
[-]
....do ISP provided public IPs really change that often...? My homelab's public IP has been the same so long I have all four octets memorized....and I don't remember ever asking (or paying for) a static one.

I know they can, and sometimes do, but do people really experience this daily/weekly?

reply
wolrah
4 days ago
[-]
On DOCSIS and PON networks my experience has been that dynamic IPs are generally stable as long as your DHCP lease is active, so my IP generally wouldn't change unless I changed equipment or there was an extended outage that kept me offline during the entire time it would normally have renewed.

On DSL networks it's been the opposite, if the PPPoE session was lost I was definitely going to get a new IP address, and on some providers the session would be reset every 1-7 days so the IP would change at exactly the same time of day which almost always ended up being in the middle of a work day corresponding with whenever the equipment was last rebooted due to some other problem. I got in the habit of setting up my equipment to restart on its own terms in the middle of the night on those providers, but this came with its own downsides when something would go wrong and it'd fail to negotiate.

reply
RealityVoid
3 days ago
[-]
> because someone scraped TOR and put all of the IP addresses they found on there and tagged them as active threats.

Yeah, or, hear me out... Someone used the exit node for active attacks. (Gasp! What? On my onion?)

reply
jandrese
2 days ago
[-]
I'm not an exit node, only a relay.
reply
TOMDM
4 days ago
[-]
It does make me wonder if people are running very boring polite websites that can suddenly do very not boring or polite things if you know how to ask the right way over an onion address.

Surely I can't be the only one to think of this right?

reply
jazzyjackson
4 days ago
[-]
In fact dozens of US spies and informants were killed or imprisoned when a secret communications network was exposed doing just that. I wish I bookmarked a better source, it described that the HTML for the portal was reused on every site, so once it was discovered on one site, everyone using it was burned.

Here's one article that alludes to it re: CIA informants in Iran, but I seem to remember China killing US spies and it just not making the news at all

"an analysis by two independent cybersecurity specialists found that the now-defunct covert online communication system that Hosseini used – located by Reuters in an internet archive – may have exposed at least 20 other Iranian spies and potentially hundreds of other informants operating in other countries around the world.

This messaging platform, which operated until 2013, was hidden within rudimentary news and hobby websites where spies could go to connect with the CIA. Reuters confirmed its existence with four former U.S. officials."

https://www.reuters.com/investigates/special-report/usa-spie...

reply
throawayonthe
4 days ago
[-]
that seems unwise, you'd be associating your 'impolite' activities with an irl legal identity
reply
tux1968
4 days ago
[-]
Well, you could use a disposable legal identity. Say a hobby site, about bowling.
reply
bauruine
4 days ago
[-]
Tor does this sort of although not like you think. It's used as a bridge transport.

>https://blog.torproject.org/introducing-webtunnel-evading-ce...

>WebTunnel is a censorship-resistant pluggable transport designed to mimic encrypted web traffic (HTTPS) inspired by HTTPT. It works by wrapping the payload connection into a WebSocket-like HTTPS connection, appearing to network observers as an ordinary HTTPS (WebSocket) connection. So, for an onlooker without the knowledge of the hidden path, it just looks like a regular HTTP connection to a webpage server giving the impression that the user is simply browsing the web.

reply
theshrike79
4 days ago
[-]
Which is funny when anecdotal evidence says that over 50% of existing tor relays are controlled by US TLAs :)
reply
mo
4 days ago
[-]
Anecdotally, I used to be in control of more than half of Tors exit capacity (until I had inspired enough other people to take over), with no association to US TLAs, and I personally know many exit and other relay operators. I have no reason to assume they are affiliated with US TLAs or other TLAs. The majority in terms of numbers may be, but not the majority in terms of bandwidth.

Personally, I doubt the US TLAs have a need to operate any relays themselves. They can simply wiretap, and use control flow data for correlation when necessary. Tor can still be useful for all those who do not try to hide from the few agencies who may have this kind of visibility.

The relay community is pretty good in terms of interacting with each other. There are real-world meetings to get to know others in the space, which may make you also more comfortable seeing their personal reasons for providing bandwidth.

reply
ugur2nd
4 days ago
[-]
I'm not an expert. I'm asking because I don't know.

Did I understand correctly? You can create a site with a .onion extension without a domain on a hosting service.

I'm thinking. If you can do it this way with .onion, can you do it with something else? That would be a bit unusual.

If that were possible, being able to customize the extensions would be interesting. Being able to customize brand names. Like .mybrand, or .egg, .bread, whatever you want.

reply
hrimfaxi
4 days ago
[-]
I think you are misunderstanding. You may want to learn more about how onion services work but in the blog post, the hosting service is the author's server/host running Caddy.

https://community.torproject.org/onion-services/overview/

reply
hshdhdhehd
4 days ago
[-]
Anyone comment on the http thing? Does Tor layer security in that anyway so "Saul Goodman" or is there anything more needed here?
reply
mzajc
4 days ago
[-]
The onion address is the certificate, albeit not one that expires or can be revoked. As long as you get it from a trusted source, you should be good.
reply
blueflow
4 days ago
[-]
Without having a trustable certificate, the connection can be MITM'ed anyways. Anyone can produce a self-signed cert on demand.
reply
immibis
4 days ago
[-]
Onion addresses are unforgeable and traffic is encrypted. http over .onion is comparable to http over tls.
reply
ktallett
4 days ago
[-]
I am of the view having a .gopher and .onion version of sites is important for avoiding government blocking where possible and to keep information as free as possible.
reply
extraduder_ire
1 day ago
[-]
What do you mean by .gopher? Gopher is a transport protocol like http and can work over tor or any other transport just fine.
reply
szszrk
4 days ago
[-]
can you recommend some gopher server that is actively maintained? I always wanted to host gopher site but could not find a strong solution that I will not be afraid to be easily compromised.
reply
immibis
4 days ago
[-]
I don't know the answer, but fortunately the protocol is so simple that you have the option to write a short Python script.
reply
deadbabe
4 days ago
[-]
What’s a better place for hosting a .onion, Panaman or Switzerland?
reply
Bender
4 days ago
[-]
Anywhere and on just about anything. The only time a location would be of concern would be on Tor Exit nodes which is not what they are discussing.
reply
edm0nd
4 days ago
[-]
doesnt really matter. its just regular hosting underneath. I used DigitalOcean for my relays, exits, and hosting.
reply