Hacker News Reader

Comment by belzebalex | Hacker News Reader

An esoteric alternative is to host a Tor hidden service. Tor hidden services don't require you open ports, and you don't need a static IP address. Your residential IP is protected by the onion router, and the .onion domain name is free!

View on HN

This is actually a cool idea and an example of thinking outside the box.

You run a Tor proxy (bind to 127.0.0.1:9050) on a server on the Internet, and then run a Tor hidden service inside your LAN.

Then, you acquire an .onion domain for the hidden service (running inside LAN), and configure the Tor proxy (running on a server on the Internet) to access the hidden service via the .onion domain (for example, use Nginx to reverse proxy the hidden service).

This should work. However, I imagine it could be quite a bit slower compare to "normal access", and requires extra steps to secure the transport connection between the hidden service and the proxy as you might not want to have everybody on Tor to be able to access that hidden service.

I was more thinking of directly accessing the hidden service through the tor network (without a proxy on a VPS), which is acceptable if you're the only user.

This is what I've always done when I was a poor student and didn't have a public IP.

The latency can be painful but it's way better than nothing.

I will say you should probably be careful about running a webserver on TOR. Almost all my machines have a basic web server just for copying static files to windows hosts I don't want to give my password to. People would find these on TOR and then find my resume, I got plenty of emails asking to set up "hidden sites on the dark web for sharing pictures."

If it's just for personal use, you can and should use client certificates to ensure that you're the only person who even can connect.

Then I would have to generate certificates and leave them on random people's machines. Plus when I'm sharing things with other people I can't just send them a link, I have to explain how to install the certificate into their browser (or OS in some cases.) On top of all that openssl is very complex and has had serious CVEs before, I'd feel a lot less comfortable exposing that to TOR than a smaller web server.

I don't mean HTTP client cert in the web server/browser, I mean the TOR built-in option that you enable with `HiddenServiceAuthorizeClient stealth list,of,client,names`. Granted, this does mean that you have to distribute keys (but you were already distributing an onion address) and there's more setup complexity (although you already have to run TOR, so we're not in "normal user" territory anyways).

> the .onion domain name is free!

I mean, you’re technically correct, but isn’t this kind of like saying that the .local TLD is free of charge? It’s “free” because it’s not a part of the “normal” internet.

But .local aren't resolved by any public DNS server, so when outside your bubble you won't have them pointing where you expect while Tor names resolve whenever you can get connected to Tor Network

Yeah, my point was just that if your host name is not a part of any “normal” or public DNS resolution, the point of it being free is kind of moot.

.local isn't part of a global namespace, it's part of a local namespace.

Sure you don't get an interesting name but you do get one.

.local isn’t the best comparison to .onion

.oarsinsync is probably a better comparison. It’s not explicitly scoped anywhere, and it works nicely in my oarsinsync bubble, much like .onion works nicely in the ToR bubble.

In both cases, you need to connect using some kind of tunnelling protocol to connect into another network.

What I’m trying to say is that if you’re going to have to install additional software, or make additional configuration on the requesting node, it doesn’t really matter if it’s .local or .tor or whatever, because the only reason it works is because you did that extra work: and when you’re in that situation, it doesn’t really make sense to compare it to “paid” domains because the reason you pay for a domain is just that, you want it to work everywhere without additional configuration.

I think we're thinking of different use cases.

For me, all my personal machines have TOR installed anyway and I mostly want public address for gluing things together or being able to access things remotely. It's definitely not usable for everything you normally use domain names for (like showing people the menu at a restaurant.)

I will point out that you don't need to do any extra work to access web servers on TOR at least. I think cloudfront (and I know others) run a proxy that lets you access them with just a normal URL via a web browser. Most OSes need no extra configuration for .local.

Tor onion services are very underrated! They provide resilient access to any service and with built-in encryption and certificate!

The daemon takes very little memory and CPU.

Reply on news.ycombinator.com