▲ 251 points
back
89 comments
In a big company blog post like this, I wish they'd call them onion services instead of hidden services, especially since they are even using a v3 onion service.
Also, curious if they wrote any code to support this since OnionBalance doesn't support v3 yet. I know they use Go a lot and I wrote a Tor control client myself recently [0].
Thanks for the heads up, should be fixed now.
I knew Tor Project has been shifting away from "hidden services" for a while but I missed the email where teor clarified things for blog posts and such in late April [0]. Also, I wanted to avoid using "onion resolver" as it would be a worse misnomer than "hidden resolver."
Re. OnionBalance: we're working on a few ideas for this, but nothing conclusive yet.
0. https://lists.torproject.org/pipermail/tor-dev/2018-April/01...
> I knew Tor Project has been shifting away from "hidden services" for a while
I read the article after your correction, and on reading the `What are Tor onion services?` section, I thought “How nice, they’re using the new terminology to go with the new v3 service address”.
But then, just below, I saw the https://blog.cloudflare.com/content/images/2018/05/image_3.p... diagram still mention “hidden service” and thought “an old image slipped thru, tho” :)
Also, wouldn’t a “1111dns4tor” prefix look better? :)
For OnionBalance, on the mailing list they mentioned that while it is more difficult on v3, they are implementing HSFETCH/HSPOST[0]. I'm not sure of any other load balancing approaches outside of this. In the meantime I figure y'all have this all going through one hidden service endpoint or maybe share some priv keys or wrote some custom code or something.
0 - https://lists.torproject.org/pipermail/tor-dev/2018-April/01...
I've changed the blog post as you suggest.
Great work! Especially after Daniel (Stenberg) adding momentum to the DoH movement recently. Even though I wish you huge success let’s hope that many other ‚alternative‘ DNS providers jump on the bandwagon in order to make any (future) traffic correlation attacks less simple. Having just a single watering hole makes it too easy for predators to catch their prey - and I don’t assume cooperation from your side (as you already stated in other parts of this thread).
Could you educate the rest of us on the difference :)?
From "hidden" to "onion" is just a terminology change. For the v2/v3 change, not sure there is an in-depth blog post on the differences except for comparing the specs of v2[0] vs v3[1]. There's a wiki page with a high-level overview [2].
0 - https://github.com/torproject/torspec/blob/master/rend-spec-... 1 - https://github.com/torproject/torspec/blob/master/rend-spec-... 2 - https://trac.torproject.org/projects/tor/wiki/doc/NextGenOni...
Shouldn't your first reference point be 1? :P
As I said in the earlier duplicate post https://news.ycombinator.com/item?id=17238365
> That makes privacy worse than the default setup with Tor since there's no stream isolation. With the standard Tor Browser you get a different circuit for each first-party domain, that's not something you'd have with this.
So in the Tor browser, DNS resolution for non-onion addresses creates a new circuit each time? (not sarcasm, I really don't know) Because I consider this new onion service (aka a front for 1.1.1.1) to be a single first-party domain. How is this any worse than contacting any other onion service repeatedly? Or are you arguing they should provide a rotating list of onion addresses for this service?
> So in the Tor browser, DNS resolution for non-onion addresses creates a new circuit each time?
You can try it for yourself, open a tab in the Tor Browser with foo1.com, look at the circuit in the Torbutton. Then open another tab with foo2.com, look at the circuit and compare it with the earlier one.
>Still, the exceptionally privacy-conscious folks might not want to reveal their IP address to the resolver at all, and we respect that.
Who was it again that puts ReCAPTCHA on so many popular websites when using Tor, which could be used for traffic correlation? Oh. Cloudflare.
That’s the problem with anthropomorphising companies.
As far as I can tell Cloudflare single-handedly destroyed the usability of Tor Browser. It was just getting pretty fast when Cloudflare put literally half the Internet behind a spywall.
So should I be angry at them? Should I dismiss this valuable service to then remain consistent with my anger? Is Microsoft now “good” or “bad”?
Every action needs to be evaluated on its own. Our evolutionary social adaptation just doesn’t work in this case.
In the end all Cloudflare did is expose how centralized the Internet has become. The immediate emotion is anger because that is how you react when you’re suddenly awakened out of blissful ignorance and forced to face reality.
Just as your Tor browsing experience was becoming faster, it was becoming a more and more viable tool for DoS attackers. Someone has to protect the sites enough that they can stay up for traffic, Tor or otherwise.
And who was it that worked with researchers on Privacy Pass to provide anonymous access for web users? Oh. Cloudflare. [1]
And who was it that changed their algorithm for handling TorBrowser traffic so that there's no need to show those CAPTCHAs? Oh. Cloudflare.
And who was it that gave our customers control over how Tor traffic is handled? Oh. Cloudflare. [2]
[1] https://blog.cloudflare.com/cloudflare-supports-privacy-pass... [2] https://support.cloudflare.com/hc/en-us/articles/203306930-D...
(For those of you who missed it. parent poster @jgrahamc is CTO of Cloudflare. )
Don’t get too snarky, John. Thanks for working with the Tor community, but haters gonna hate.
Thank you, it looks like you have your moral compass pointed to the right direction :-)
While I applaud the things above I'm concerned about Cludflare's (growing) size. If it handles so many websites' traffic it's an interesting target for NSA, hackers and other malicious actors. I assume that most of your users use the free SSL certs, meaning Cloudflare possesses their private keys.
The more Cloudflare grows, the faster and the more encrypted "the internet" becoems. But the more Cloudflare grows, the bigger the single point to attack gets (I'm even assuming Cloudflare is and always will be a good actor).
What's your stance on this? Could you comment on this?
> And who was it that changed their algorithm for handling TorBrowser traffic so that there's no need to show those CAPTCHAs? Oh. Cloudflare.
Thanks, that'd be great news! I couldn't find any information about that, any chance you could pull out a link like for your other points?
have to give props for that, using Tor for daily browsing was annyoing and horrible a few years back, it got a lot better
Hey, that's pretty cool, glad you sorted the second one out. Never heard about the first one and the third, well, double edged sword.
> And who was it that changed their algorithm for handling TorBrowser traffic so that there's no need to show those CAPTCHAs? Oh. Cloudflare.
If you're checking for a custom user agent, you're doing it wrong. Not all people using Tor to try and browse the web limit their browser choice like that.
I still have the terrible experience of having to train Google's ANNs every 5 minutes when using regular Firefox and Chromium over a Tor SOCKS proxy and I blame CloudFlare for single-handedly destroying web browsing over Tor.
dnscrypt-proxy is compatible with Cloudflare and now has built-in support for Tor.
Just add `proxy = "socks5://127.0.0.1:9050"` to the configuration file.
I just wanted to thank you for dnscrypt-proxy. I had seen it mentioned in another post so I had it saved in an open tab for later. Seeing it mentioned here again prompted me to actually install it. Very much worth the ~5 minutes it took to get it up and running!
Also thanks from me, pretty awesome piece of software!
I... get the idea, and support it. I don't understand the implementation.
What is the point of creating an onion address and then publicizing it? Why not just use Tor to get to 1.1.1.1 in the first place? Onion URLs are for services that don't want to reveal themselves.
Basically, what does this enable that generic Tor does not?
Just because they're called hidden services doesn't mean they have to be hidden. Tor hidden services offer a lot that the clear web and normal domain system does not. For one, you own your domain rather than lease it on the whims of some institution that can be easily pressured to kick you off (like cloudflare and registrars did against stormfront, for example). And of course going completely within Tor is a great speed-bump for preventing massive surveillance.
I run all of my clear web sites as tor hidden services too and publish the domains for both publicly on both.
But I wouldn't trust Cloudflare to not censor anything controversial. They're already proven themselves an enemy of free speech and an enemy of tor by their behavior. Words mean little.
> But I wouldn't trust Cloudflare to not censor anything controversial. They're already proven themselves an enemy of free speech and an enemy of tor by their behavior. Words mean little.
Preferably you wouldn’t have to trust any single provider at all, regardless if you deem them trustworthy.
Why can’t we have Alt-Svc for DNS that points to blockchain?
> Basically, what does this enable that generic Tor does not?
End-to-end encryption. If you query 1.1.1.1 over Tor then exit nodes can diddle with your traffic.
If you're using DNSSEC then they can't mess with your DNS either. However, it is very readable by the exit node - just like Host header in HTTP or server_name in TLS.
But DNS over TLS already provides that even without Tor.
Your circuit presumably terminates at CloudFlare infrastructure and not at a random exit node where the packets need to be routed again over the open internet to CloudFlare.
I wonder if latency is better.
In order to use this, you no longer need to go via the regular internet, and use an exit node. Many people don't like running exit nodes, but would run a relay nodew.
Strange to see a company which deems a bunch of unpopular idiot white supremacist trolls to be too extreme of speech supporting a network which has allowed child pornography to flourish online at a scale never before seen. Bold move.
Is the log policy for this onion and 1.1.1.1 exactly the same?
First sentence of the second paragraph: "As it was mentioned in the original blog post, our policy is to never, ever write client IP addresses to disk and wipe all logs within 24 hours. "
So, yes.
Thanks for confirming, suspicion is a must when it comes to onions. I'm already testing it, works like a charm.
socat TCP4-LISTEN:853,bind=localhost,reuseaddr,fork SOCKS4A:localhost:dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:853,socksport=9050
openssl s_client -showcerts -crlf -connect localhost:853
getdns_query 1dot1dot1dot1.cloudflare-dns.com 127.0.0.1@853
forward-addr: 127.0.0.1@853#tor.cloudflare-dns.com
Why is the URL so long? Weren't .onion domains about 16 characters long? Compare with Facebook's hidden service:
facebookcorewwwi.onion
dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion
Tor moved to a longer address space because the short one is 1024 bit RSA
To be even clearer, v2 service names are just a part of the RSA key hash whereas v3 service names are a full ed25519 pub key and a couple of other bytes.
> Are there Certificate Authorities that can supply certificates for .onion domains now
Yes, DigiCert does (maybe others too, haven't checked). Facebook was famously the first to have such a certificate. Currently needs to be an EV certificate though.
Getting a certificate for an IP also isn't a "trick", it's generally available, although I believe it needs to be in your IP space, so you can't just get it for any random IP you got from your provider.
They have an intermediary CA. I wasn't sure too when they launched, but IP addresses as common names aren't against spec / Mozilla CA guidelines.
Facebook also have that domain over SSL. CAB allow EV certificate to be issued for onion domains.
https://cabforum.org/2015/02/18/ballot-144-validation-rules-...
Any update on some distributed names resolution for tor? At some point there seemed to be a chance for namecoin to handle this.
Could someone explain the rainbow theme? And why that onion URL has is a psychedelic gif?
We used the same theme on the underlying 1.1.1.1 resolver: https://blog.cloudflare.com/announcing-1111/ I'll ask the designers why.
EDIT: and she said: "We had this very mysterious 1.1.1.1 white on black theme when we were just sort of trying to build hype guerilla-style and then once the announcement was made we flipped it into the colorful "here it is, it's great!" Sort of thing"