Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Whats not easy is dealing with harassment from the law as a result.by badmoddingyo
- Which is funny when anecdotal evidence says that over 50% of existing tor relays are controlled by US TLAs :)by theshrike79
- Very unlikely if you just hosting an onion service with legal content, where all traffic is encrypted.
Having to deal with law enforcement is unlikely even if you run a normal, encrypted, TOR relay.
Exit nodes, on the other hand, will most likely get letters or even visits by law enforcement. But those are not involved at all when just running an onion service.
by phaer - This is a good reminder for myself to get some onion addresses for my sites and spread awareness of Tor.
TIL that Onion-Location is a header, only new about the <meta> element.
<meta http-equiv="onion-location" content="http://<your-onion-service-address>.onion" />by simonmales - The "http-equiv" in that meta tag means "equivalent HTTP header", FYI.by CGamesPlay
- It's not a mirror, it's a proxy. If someone encroaches on their free speach and shuts down their hosting account that "mirror" will not save them.
Just saying, this is an important distinction to me and I've been hosting tor nodes since the 2000s.
Archiving information, and making it available, is sometimes more powerful than anonymous proxying.
Especially if there's an anonymous proxy available to that archive. ;)
by INTPenis - "Mirroring" is a term also used when a single source publishes data in different mediums (technically in this case we're talking only about the internet but the internet is full of different protocols so I'll call them mediums). For example there are websites that mirror their content to Geminispace or in this case make it available as an onion service.
You are correct that this solution does not prevent problems if the server goes down. This particular approach aims to reach a larger audience, while your idea of mirroring enables resiliency.
Both approaches have their use cases and can even be combined too!
by a022311 - As long as they have the private key they can move it to new hosting infrastructure without issue, and the same onion address will still be operational.by Retr0id
- What a pleasant read. Informative in all the right places without losing brevity. Thank you.by stephenlf
- One problem with .onion is that it is not for casual sites or people trying to build lasting communities. The Tor Project only prioritizes security and they can and have and will again wipe out the entire tor web to nothing if they feel it is required by security. They have full control of the network. No v2 tor sites exist anymore, none of the communities, they were are just wiped out by the Tor Project because only their security use case matters. They care nothing for communities that use their software. Do not try to build communities on Tor .onion. It'll just be made inaccessible some day. All the hyperlinks will become useless. All the databases of sites, all the discussions, just gone. Because the tor project cannot abide potential lax security of older protocols.
.onion is not a way to own your domain. Even though you may have the private key and no one else does, the true owners of your domain remain the tor project themselves, as they can make it inaccessible to tor clients any time they want. They have before, they will again. And they aren't going to listen to any community feedback about it. Tor .onion is only for people that don't care about longevity or links working. Only for people who have 'security' as their number 1 and only concern.
I wasted a decade building my personal sites and casual communities on .onion. I won't be fooled again. A dot com or org is just as much mine as a .onion is, unfortunately, and at least those don't all disappear every 10 years.
by superkuh - I would love to hear more. Have you published this somewhere you wanna share?by bfkwlfkjf
- > Oh, and free speech and anti-censorship and all that jazz.
That jazz is increasingly played by the same band of 185.220.0.0/16 exit nodes, and plays it in a scale which is all but Anonymian.
by wartywhoa23 - I would like to know more, can you give me some insight?by storm1er
- Run more exit nodes then, and more onion services so they don't need to involve exit nodes.
It's also not such a big deal, provided they aren't messing with your exit traffic which you did encrypt, right? There are few exit nodes, but a great many non-exit nodes which still help anonymize your traffic. If you think it's a problem though, run an exit node.
by immibis - No part of hosting or visiting onion services involves exit nodes. Onion service traffic stays within the Tor network instead of exiting to the clearnet.by flotzam
- I do something similar like this for xeiaso.net (http://ryelkcbr65vy7pzx26c3rvxya54yuh5ciafth7p6d3p3phpgo2wkz...), but I use Kubernetes so I installed the Tor controller: https://github.com/bugfest/tor-controller. I then added an OnionService pointing to the website: https://github.com/Xe/site/blob/main/manifest/xesite/onionse.... It works pretty great!by xena
- You can generate yourself a vanity .onion address using https://github.com/AlexanderYastrebov/onion-vanity-address tool. It can also generate vanity client authorization keypair.by age123456gpg
- Unfortunately I got a hard crash on go 1.25.3 when running this: https://github.com/AlexanderYastrebov/onion-vanity-address/i...by Trung0246
- Be careful with vanity address generators. A cryptocurrency market maker once lost around $160,000,000 in a vanity Ethereum address because the generator they used was only seeded with 32 bits of entropy.
https://www.forbes.com/sites/jeffkauflin/2022/09/20/profanit...
by tripplyons - It is also very useful to expose services to the world wide web behind a restrictive network, Tor takes care of the Nat punching and all that jazz, and you get free dns and encryption as an extra bonus :)by maeln
- NAT punching to ssh is an incredibly useful feature of this kind of setup. As long as the machine has an internet connection, and you know the onion URL, you can tunnel into it and proceed from there. I usually do this to any machine I'm putting behind NAT.
I don't know if onion links are discoverable/crawlable, so I can't claim if this is more secure than just listening on port 22 on the open internet.
torsocks is a very useful tool for easily running programs like ssh through tor with no advance setup.
- > I'm not sure if this is generally considered acceptable within the Tor network
Tor is already encrypted, that’s why you don’t need TLS. Some services (Like the hidden service from Facebook back in the days) have https but that was more of a vanity from what I remember.
by dewey - Proton also uses HTTPS for their onion site, and they used the same certificate provider as Facebook did for theirs, Digicert, per this page:
https://proton.me/blog/tor-encrypted-email
In the above blog post, they seem to imply that they made HTTPS mandatory for Proton Mail over Tor for security reasons.
by aspenmayer - Without https can't the last relay snoop the traffic?
edit: oh, is the last relay the onion service? So the entire chain is encrypted?
by orbisvicis - Back when EV certificates were widely supported by browsers, HTTPS was a great way of cryptographically associating a .onion service with a real legal entity, for sites like Facebook which didn't care about being anonymous.by Ajedi32
- > have https but that was more of a vanity from what I remember
It has a functional difference as well, lots of new client-side features (like webcrypto) only work on "Secure Origins" which .onion isn't, but websites behind TLS are. So if you wanna deploy say something that encrypts/decrypts something client-side on .onion, you unfortunately need TLS today otherwise the APIs aren't available.
Of course browsers could fix this, but I don't think they have any incentives to do so. I guess Tor Browser could in fact fix this, and maybe they already do, but it'd be a patch on top of Firefox I think, something they probably want to do less off, not more.
- This has prompted me to look at how the Tor Project's Arti reimplementation is going. They've got way further along than I realised:
https://tpo.pages.torproject.net/core/arti/
https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CHAN...
Hosting onion services is apparently still a work-in-progress, though, and turned off by default.
by qhwudbebd - Letscage [0] is also using Arti to implement its privacy features.by m00dy
- I was already able to host onion services last year by using the crate directly. A few footguns related to flushing but it generally works as expected. I will however say that the code quality could be improved though. When trying to contribute, I found a lot of somewhat bad practices such as having direct file read/writes littered around without abstraction which made refactoring difficult (trying to add different storage/cache options such as in-memory only or encrypted)by yogorenapan
- >I have no interest in running a relay or exit node on my VPS, so I made some minimal changes to the config file
Noting the default configuration does not turn your server into a relay or exit node, in case anyone interprets this that way.
Thanks for offering a .onion, bookmarked for the caddy configuration.
by crtasm