Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Guys, I have a question. If it's this simple to put a server into the onion, why are people not doing this with torrent trackers? I'm thinking specifically about thepiratebay.org which is still banned in the UK (at the ISP level, I believe). Then mirrors appear and then the mirrors get banned?

Why not just put it into the onion? Put it there once, problem solved.



Perhaps the primary reason is accessibility. Onion addresses are not easily memorized. See https://en.wikipedia.org/wiki/Zooko%27s_triangle

I believe this inconvenience is minor, however.


Incidentally, is there any fundamental reason why onion addresses are always so cryptic?


The answers are correct, but a less cryptographically-related answer:

When you go to a website on the regular internet, the name you type into your URL bar doesn't contain any location information. Instead, you go to a Dynamic Name Server (DNS) server (often run by your ISP) and and get the IP address, which tells your browser where to go.

With Tor, the hashes you see are analogous to the IP in regular internet: they tell your browser where to go. But there's no DNS for Tor, so you can't hide address behind a name.

Incidentally, this story is about SciHub being blocked at the DNS level, meaning that the domain https://sci-hub.io/ was removed from the DNS servers. But it's still available at the IP level at https://31.184.194.81/

This story demonstrates the need for DNS to be decentralized. ICANN has far too much control and is now using it for censorship that holds back the progress of all of humanity.


It's not ICANN censoring them but their registrar which has pulled the domain. I agree that the ICANN monopoly is a bad thing, but the above statement is somewhat misleading.


So would a sort of decentralized DNS be possible?


Though even if we decentralize DNS, ICANN controls all of the underlying IP addresses.


> Though even if we decentralize DNS, ICANN controls all of the underlying IP addresses.

IANA would have to un-delegate a whole range from RIPE.

I don't see that happening unless they want to fracture the network.

Perhaps Elsevier will be able to force ISPs to blacklist that particular IP, but nothing more.

I also suspect they will move the domain under a ccTLD, not subject to the whims of ICANN.


check out namecoin. they are attempting that, afaik.


They don't have to be cryptic, but it takes a lot of brute-forcing to get a memorable one.

Facebook managed to get https://facebookcorewwwi.onion/


I get that, my point is why do they have to be brute forced? Why can't you just pick one?


They're hashes. If you don't have the number that hashes to and address, you can't run a server at that address.


Hashes are easy to run forwards and hard to run backwards.


Crypto noob here. Why is that? are the hashes generated from an input randomly?


A hash verifies an input, but you can not reproduce the input from a hash.

A simplified version: X % 2 = H

If I give you the formula, and a H of 1, can you, with certainty, tell me that my input was 1029? Cryptographic hashes have a similar property, just with a very large collision space - for Tor only 1 in 36^16 inputs will produce a given hash; yet you still can't guarantee that an input that produces that hash is the original input (and just guessing the possible inputs will take you a very long time).

The downside of our hash above is that it gives you a pretty good clue of what the original input was: if you get an H of 1029 from the forumla X % 10000000 = H, you'll have a pretty good idea of what the X was. Cryptographic hashes do not share this weakness - they will stretch the input, and ensure that there are no clues left as to what the original input was.


https://en.wikipedia.org/wiki/Cryptographic_hash_function

TLDR: they are designed to behave that way. Their alternative name is "one-way hash function".


The hash is generated from the onion services's private key.

Edit: I'm wrong. It's based on the hash of the public key. But it's rather confusing. After you create an onion service, you get a private key and an onion address. You don't actually get a public key, just the hostname based on it. I suspect that the public key could be found somehow. But it's not used for anything, that I know of.


Perhaps more intuitive, 11*17 is pretty easy to do in your head, but factoring 187 is much harder


They are cryptographically generated.


The answer to that is in the Zooko's Triangle link, give it a read.

But, in short: for a name to be useful in a global context, it has to be unambiguous or unique. If there isn't a centralized naming authority / registry, then that means that you can't be able to pick an arbitrary name. (If you could, you could just decide to use the same name as someone else, and now there's no way to figure out which one of you the name indicates.)


They are a hash generated from the service's public key.


No, from its private key! The same key that's used to sign outgoing content, authenticating to the Tor network.

Edit: I'm wrong. It's based on the hash of the public key.


How can anyone verify a hash of the private key without having it? Anyway, see https://trac.torproject.org/projects/tor/wiki/doc/HiddenServ...


I don't know the details. But basically, a Tor relay provides some token to the onion server. The onion server signs that token with its private key, and returns the output to the Tor relay. Then the Tor relay verifies that the token was signed by the private key corresponding to the onion hostname.


What about blockchain based DNS solutions like namecoin?


They do: http://uj3wazyk5u4hnvtk.onion/

But most people don't run tor often or at all.


If you're lazy and aren't looking for any strong degree of privacy for this kind of thing, you can run an onion transparent proxy on your router fairly easily, so then you can just navigate to .onion domains in any browser and browse away.

Of course, the privacy implications of this are pretty bad if you're just going to load most websites via direct connection. A simple image embed can deanonymize you. But it's probably good enough if you're just going to browse TPB or similar sites and are mostly just looking for a bypass without the privacy concern.

https://trac.torproject.org/projects/tor/wiki/doc/Transparen...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: