Hacker News new | past | comments | ask | show | jobs | submit login

If the server is on the Tor network, an onion server, then it is encrypted end to end and no traffic or identity is exposed to either the onion server or any intermediary.

That is to say, if I started an onion server on one side of the world, then connected to it from somewhere else, my connection to it would be anonymous and encrypted to any external entity.




How are you imagining the penultimate node in the chain connects to the target server without knowing anything about them?


This is well understood public knowledge.

https://community.torproject.org/onion-services/overview/



This: https://www.sciencedirect.com/science/article/pii/S266729522...

Uses a dataset created from aggregation of logs from all nodes in a simulated Tor environment to train a model that can identify the onion server's IP based on fingerprints created from that model.

>We ran the modified Tor software in the Shadow simulation environment to obtain a large amount of circuits for analysis. Shadow is a discrete-event network simulator developed specifically for Tor network simulation experiments and can run Tor software directly. Therefore, Shadow follows all logic related to Tor circuits. In the simulation environment provided by Shadow, we can build servers, clients, directory authorities, onion services and relays, and can control all nodes. Therefore, we can get circuit data in Shadow without the real Tor network.

This is: a) Not a real world example b) Not an example of interception of unencrypted traffic between a client and an onion site c) Not de-anonymization of a client

This: https://www.usenix.org/system/files/raid2019-iacovazzi.pdf

Is super interesting, it's a real world example of using collusion of an entry node that inserts "watermarked" data to identify an onion service.

It does not: a) Intercept or break encryption between client and onion service b) De-anonymize a client

This: https://www.ndss-symposium.org/ndss-paper/flow-correlation-a...

Is the same data watermarking scheme to use entry collusion to identify onion services.

None of your examples show that a connection to an onion server is insecure insofar as data integrity or client anonymity is concerned.


Ok so you admit we can identify onion services, and it’s common knowledge that the NSA knows your personal traffic patterns. If you think they can’t correlate the two, I have a bridge to sell you.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: