Hacker News Reader

Comment by na85 | Hacker News Reader

Keep one bookmark to a community directory? The plausible deniability is that you just visit for the catpicures1685isbis.onion, and not for cocainehookerz3288uiop.onion

View on HN

But now you have to trust that community directory not to give you the wrong onions...

Unless the bookmark entries in your directory are encrypted with a passphrase only you know.

So... it sounds like what you're looking for is a password manager.

Doesn't protect from rubber hose side channel attacks.

Yeah, ideally you'd want plausible deniability.

In theory, you could achieve this by only storing the password DB in a cloud service you access through the Tor browser, but then you run into two other problems. First, how do you remember the address of the service you're using to store your password DB? If you store that address on your device, you've lost your plausible deniability. I guess you'd have to use a well-known clearnet site you access through Tor (Dropbox, Google Drive, etc).

That leaves another problem though. If you have a password manager installed on your PC, that implies the existence of a password database, which might also cause you to lose your plausible deniability.

Maybe if there was a profiles/password manager feature built into the Tor browser that lets you decrypt and load a profile from a service provider, then destroys all local evidence of that profile when you close the browser? Seems like a feature that could be useful in all browsers actually. A cross-browser password manager and bookmarks sync feature? That'd be really convenient.

Indeed, an encrypted bookmark manager in Tor browser would be cool.

Also see this blog post: https://blog.torproject.org/cooking-onions-names-your-onions

IPFS over Tor?

Which is why information like that should be stored in the blockchain where it can't be modified.

This is a remarkably good idea. You can store an onion hash in a blockchain transaction and then use the signature of the key which sent that transaction to verify it.

Or just use IPFS.

That does seem more secure compared to the way people often talk about onion link lists and search engines.

But the blockchain can still be flooded with fraudulent onions and at some point you're still putting all of your trust into a form of authority.

I assume this is already done, and if not why not?

The practical implementation would be the bookmarking service would authenticate their links against this blockchain, and the user would either have an agent on their system to validate the claims, or another 3rd party who they trusted to validate the claims?

Reply on news.ycombinator.com