Comment by glenneroo | Hacker News Reader

Comment by glenneroo | Hacker News Reader

Parent Full thread

I'm not sure how relevant this is to running your website on the "darknet", but a potential warning for future Tor service operators: I ran a TOR relay for about a year, eventually even ordering a static IP for 5€/month. One random day, I was unable to log into my online banking, receiving some obscure error code. After digging around and finally contacting the bank, they referred me to some "IP protection service" in the UK, which had put me on a blacklist for unknown reasons (they don't tell you the reason for security reasons, but there was mention of something "proxy"). After submitting multiple requests to remove me from their blacklist (all automated online with no option to talk to a human), I finally caved in and shut down my relay. After doing that, combined with waiting a few days, while also continually resubmitting my removal request, they marked my IP as "clean", allowing me to login to my bank again. The whole process took about 6 weeks, and neither my bank nor the UK service provided any assistance along the way. Fun times.

I would love to run a TOR relay again but I'm a bit paranoid now.

I had a similar experience with my Xiaomi (robotic) vacuum cleaner. A few days after setting-up a tor relay (not an exit node!) on my home connection, my vacuum stopped working. The "Mi Home" app, which communicates with the vacuum via a server in China, was unable to find the vacuum.

A traceroute to the Xiaomi servers revealed that my packets were dropped somewhere in the ChinaNet AS. I stopped my relay and everything went back to the normal a few days later.

Is it really necessary for your vacuum to work, that it 1) connects to a server 2) on a different continent? Why would anyone willingly put something like this in their house?

It is the v1 of their vacuum which was not sold officially in Europe/America. The newer versions can work with servers located in Europe.

If you don't want to use the Xiaomi app there is an API to control the vacuum on the LAN. See also "34C3 - Unleash your smart-home devices: Vacuum Cleaning Robot Hacking" [1]

Privacy and security concerns aside, I find that pretty magical that you can control a device from the other side of the planet, with only a few hundred milliseconds of latency :-)

[1] https://www.youtube.com/watch?v=uhyM-bhzFsI.

(Relatively new) Tor developer here.

Yes, unfortunately some sites and such "protection" services block Tor IP addresses to mitigate abuse. While just blocking exit nodes would be sufficient (though still an overly blunt instrument), some carelessly block Tor relays as well.

In the case of Onion Services, unlike running a Tor relay or exit node, you are using Tor as a client, much the same as when you use the Tor Browser. Your IP is not on any such global list of "Tor IPs". Your ISP (or VPN, if applicable), can see that you're using Tor (unless you use a bridge), but this doesn't get you on these sort of block lists.

On a side-note, if you're thinking of running a Tor relay from home to help contribute to the Tor network, but don't want to risk getting your IP address blocked, consider running a bridge instead. https://community.torproject.org/relay/setup/bridge/

Never use your home IP address is the conventional wisdom I've heard from relay operators and be aware there is a significant industry building up around figuring out whether or not traffic is tor'd and allowing to block based on that.

It's basically an arms race all the time; you'll need to pick as side. It's sad but there's a touch of "we don't want to do business with people who have something to hide" that has to get weeded out before you're not guaranteed to suffer any inconvenience from running a for relay.

Well that seems like all the more reason for more individuals to run a Tor (relay) node instead of consolidating into a minimum number of easily blockable VPS services. I personally am once again highly motivated after reading all the comments here basically excusing the shoddy behavior by lazy sysadmins.

If my bank blocks me again, my solution will be to use a VPN instead of giving in.

I'm just letting you know as someone who has been on the inside and actually talked with Risk departments at financial institutions.

They do it with rooted phones, and they do it with Tor. If you're using those, you're an acceptable loss based on their metrics. Unless you can figure out a way to set up your friends and family to be Tor'd, and everyone else does too, that won't change. Also, no matter how much you point out that from the inside, you can't avoid the fact that a lot of fraud inevitably ends up using the same tools.

I'm not saying I agree with or like that state of affairs, I've just fought that fight and it really doesn't go much of anywhere. They have their reasons, and what they deem to be acceptable reasons to make the decisions they do. As long as that is the case, you just end up having to live with it, or not do business with those companies. By fighting that fight, I mean doing things like pushing against things like adoption of device fingerprinting, and picking apart under what conditions it works and doesn't. From the perspective of the business these measures make sense. From the perspective of a society at large and what even a modest understanding of what courts would do with some meta-info if they knew it existed/was collected on the other hand, that resilience to fraud is not a luxury we may reasonably be able to afford for long.

Why on earth would you run a Tor node on an IP that you use for any personal transactions? This isn't surprising in the least.

I think you're confusing a relay and an exit node here. Pretty much everyone using Tor runs a node and for virtually everyone it's on IP also used for personal transactions. There are silly services which take every tor node as suspicious. They're wrong, but it doesn't matter if you get banned.

I also considered bringing up that point, but then I actually looked it up[0]:

> Tor relays are also referred to as "routers" or "nodes." They receive traffic on the Tor network and pass it along. Check out the Tor website for a more detailed explanation of how Tor works.

[0]: https://www.eff.org/torchallenge/what-is-tor.html

How does that change anything? The point is that a relay isn't an exit node, so there's no reasonable reason to block them.

You don't seem to understand what the terminology is... exit relays are relays.

> There are three kinds of relays that you can run in order to help the Tor network: middle relays, exit relays, and bridges.

There's dictionary definition and there's typical usage. When people say relay node, they typically don't mean exit nodes. Not 100% correct, but the assumption is common.

Excuse my ignorance, but why should I not be allowed to run a Tor relay (not an exit node!) at home when I have sufficient bandwidth and purchased a static IP through my IP which they advertise even "to allow running of private servers"? I thought one of the points of the article was the propagation and subsequent democratization of Tor/Onion sites? If I have to rent a VPS to run a node, isn't half the point defeated?

IMO the real issue is that my bank is reckless for picking a shitty UK service (who don't even speak our local language - just imagine some poor soul getting blocked because someone else running a Tor node over DHCP).

You're allowed, but you will be blacklisted by many services...

I also agree that it shouldn't be a problem if you're not an exit node, but that's the way it works.

Many? What other services do you know of that will be blocked? You speak as if you have a lot of knowledge/experience in this area.

The list of tor nodes is public, and many sysadmins simply import it without thinking much about it. Even though they should only ban exit nodes.

Thanks for that info, I had no idea it was that bad. It's horrible yet understandable, with so many underpaid, overworked sysadmins out there (i can count myself as one of them).

I ran Tor relays from home for a while. The only site I couldn't access was the Apple support forms which are mostly useless anyway.

If my bank blindly blocked IPs like that I'd switch banks.

I wonder if you had just waited without turning it off the result would have been the same.

I sometimes wonder the same! The problem was at the time that I dread going to the bank to do anything (and I tend to do a lot of transactions, especially recently due to certain events).

I will definitely repeat the "experiment" in the near future, just as soon as it is feasible.

That's pretty scary

run it on a vps if you have one

I assume that isn't free? And more importantly, is that even supported/allowed by VPS services? I'm definitely open to suggestions!

EDIT: As I mentioned in another comment:

> I thought one of the points of the article was the propagation and subsequent democratization of Tor/Onion sites? If I have to rent a VPS to run a node, isn't half the point defeated?

hence 'if you have one'; you can also run it on your pc. internet connections are not free either but a basic vps is substantially cheaper. i am not any kind of specialist and i run a couple for hobby projects; one of them is $15/year. but nobody is stopping you from running a relay on your desktop.

Reply on news.ycombinator.com