Recommend making sites available over Tor Onion (Hidden) Services · Issue #93 · GSA/https · GitHub
Skip to content

Recommend making sites available over Tor Onion (Hidden) Services #93

Closed
#108
Closed
Recommend making sites available over Tor Onion (Hidden) Services#93
#108
Labels
Public Comment

Description

@tomrittervg
tomrittervg
opened on Mar 28, 2015

As you yourself state:

IP addresses and destination domain names are not encrypted during communication. Even encrypted traffic can reveal some information indirectly, such as time spent on site, or the size of requested resources or submitted information.

Tor enables users to browse sites anonymously, to keep secret the fact that they're browsing (as examples) health care, the GAO, OSHA Whistleblowers, or the SEC. Clearly browsing any one of these sites may be a telling act to (e.g.) an employer that should be treated as sensitive.

Making these sites available over Onion Services provides even stronger protection for users than merely using Tor, as their traffic is end-to-end authenticated and never leaves the Tor Network. (Onion services are also, more commonly, called 'Hidden Services' but in this case, the identity of the server is not intended to be hidden.) Facebook recently made a Onion Service available for example.

It would be a wonderful gesture, on top of this already excellent proposal, to recommend that agencies consider if the mere act of browsing their site may be sensitive information and make themselves accessible via a Tor Onion Service.

Activity

  1. alex commented on Mar 28, 2015

    @alex
    alex
    on Mar 28, 2015
    Contributor

    What is the distinction in protections offered between "native" Tor Hidden Services and browsing "normal" https:// resources using the Tor Browser Bundle?

  2. tomrittervg commented on Mar 28, 2015

    @tomrittervg
    tomrittervg
    on Mar 28, 2015
    Author

    Good question. Some of the ones off the top of my head:

    • An Onion Service gets you public-key-pinning for free. An attacker who has fully compromised a CA cannot attack a connection Hidden Services but can attack a normal connection to a https resource and a connection to the same through the Tor Browser Bundle.
    • An Onion Service is not vulnerable to a SSL-stripping attack. Even in the presence of HSTS, a first-connection stripping attack is possible on both an ordinary browser and the Tor Browser connection
    • An Onion Service does not allow someone who is monitoring the 'last-leg' connection (the connection between an exit node and the website in question) to get fine-grained information about how many users are visiting a site, or their traffic profiles
    • An Onion Service offers some protection against traffic fingerprinting attacks. While anything is possible when you wave your hand and say "statistics!", the difficulty is significantly raised due to the link-layer traffic characteristics and the open-world problem
    • An Onion Service is a clear and unambiguous statement to your users that you want to do everything you can to protect their privacy and security. :)

  3. alex commented on Mar 28, 2015

    @alex
    alex
    on Mar 28, 2015
    Contributor

    Thanks!

    On Fri, Mar 27, 2015 at 8:34 PM, Tom Ritter notifications@github.com
    wrote:

    Good question. Some of the ones off the top of my head:

    • An Onion Service gets you public-key-pinning for free. An attacker
      who has fully compromised a CA cannot attack a connection Hidden Services
      but can attack a normal connection to a https resource and a connection to
      the same through the Tor Browser Bundle.
    • An Onion Service is not vulnerable to a SSL-stripping attack. Even
      in the presence of HSTS, a first-connection stripping attack is possible on
      both an ordinary browser and the Tor Browser connection
    • An Onion Service does not allow someone who is monitoring the
      'last-leg' connection (the connection between an exit node and the website
      in question) to get fine-grained information about how many users are
      visiting a site, or their traffic profiles
    • An Onion Service offers some protection against traffic
      fingerprinting attacks. While anything is possible when you wave your hand
      and say "statistics!", the difficulty is significantly raised due to the
      link-layer traffic characteristics and the open-world problem
    • An Onion Service is a clear and unambiguous statement to your users
      that you want to do everything you can to protect their privacy and
      security. :)

    —
    Reply to this email directly or view it on GitHub
    https://github.com/WhiteHouse/https/issues/93#issuecomment-87131545.

    "I disapprove of what you say, but I will defend to the death your right to
    say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
    "The people's good is the highest law." -- Cicero
    GPG Key fingerprint: 125F 5C67 DFE9 4084

  4. konklone
    added
    Public Comment
    on May 13, 2015
  5. konklone
    closed this as completedin #108on Jun 8, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Public Comment

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions