Hacker News Reader

Comment by neilalexander | Hacker News Reader

The main downside to this is that performance will generally be quite bad. Tor trades performance for anonymity. Unless you specifically need anonymity — which is highly unlikely when you are just trying to reach back to a host of your own behind a NAT — there probably isn't any benefit in using Tor.

View on HN

Suppose I've got an RPI and I want to ssh into it from anywhere in the world.

If I ssh into it through a hidden service then the hidden service address IS its canonical address, regardless of whether I'm sitting in the living room or on the international space station.

As it turns out I don't need to log in to my RPI from the ISS. But if I did need that, good luck explaining to me how to do that with impunity using a pile of brittle Linux configurations. Tell me how to do it and I bet I'll fuck it up.

$ ssh 123.45.67.8

Assuming there's internet on the ISS

There is. They look like they're coming from a ground station to geoip.

I guess it would be a hassle updating geoip databases every few seconds with a new location :D

I didn't write it explicitly, but I was describing ssh'ing to an RPI behind a NAT as most residential U.S. internet is. In that case 123.45.67.8 won't help you.

In fact, I think the comment I was responding to understood my meaning and retroactively edited their comment to include the part between the dashes about accessing a compy behind a NAT. GP-- did you do that or am I imagining things?

Anyway, I agree with that comment as written-- if you don't ever need to care about breaking through NATs, Tor isn't a big benefit. (But there are, however, a large number of situations where users do care about NATs. GP only mentioned the one I had in mind. So I don't agree with the greater upshot of anonymity being the determining factor in Tor use.)

And IPv6?

You may underestimate how many US ISPs are behind NAT and don't give out IPv6

That use-case is exactly what I use https://www.zerotier.com/ for — SSHing into my NAS from anywhere in the world. And there's less configuration involved than setting up a Tor hidden service.

> And there's less configuration involved than setting up a Tor hidden service.

Is there really? IIRC zerotier saves you having to fiddle around with keys, which is a pain, but you still need to set up the daemon, and zerotier requires you to go make an account instead of just generating keys and copying them to your client, which feels like rather more friction.

You can't say there "isn't any benefit" in using Tor without saying what you're comparing against.

OP had a problem, and solved it using Tor. Suggesting there isn't any benefit in using Tor, without offering an alternative, is to suggest that you just shouldn't solve the problem.

Of course there's a benefit in using Tor: it gets you through NAT for free! It also gets you end-to-end encryption for free.

I am not saying you shouldn't solve the problem. I am saying that Tor is probably not the best tool available for the task if you don't specifically care about anonymity and there are more efficient tools available.

Zerotier is one example, Cloudflare Argo is another, tinc is another, Yggdrasil is another, Tailscale is another. Some VPN providers (like Mullvad) will happily forward ports to you from their VPN servers. As the author linked to at the very beginning of their post, you could even set up something similar by hand with a VPS (free-tier would suffice) and off-the-shelf VPN software like Wireguard.

I'd still recommend trying it - performance is good enough for my needs.

Is there still an onion service config option to use 3 hops instead of 6? I can't find the documentation on the current tor project website.

edit: found it in the manpage: HiddenServiceSingleHopMode

Disable the SocksPort, then set two options to really convince tor that you know what you're doing, then configure your onion service as usual.

    SocksPort 0
    HiddenServiceSingleHopMode 1
    HiddenServiceNonAnonymousMode 1
    HiddenServiceDir /var/lib/tor/ssh_service
    HiddenServicePort 22
    HiddenServiceDir /var/lib/tor/http_service
    HiddenServicePort 80

why disable SocksPort?

By default it is six hops for complete circuit between client and hidden service. Three hops from client to rendezvous point, then three hops from rendezvous point to the hidden service. If you go below that you might as well host on the public internet.

If the main goal is not anonymity this should not be a problem?

hasn't Tor performance improved over the years? i mean, it still doesn't make sense to use torrents over it, but for ssh and maybe some light file transfer it should be enough, no?

Tor performance is really not that bad. Hidden services are worse because they effectively go through the network twice, but even then it's generally acceptable. People have the impression that it's like going back to a modem, but it's more like going to a laggy DSL connection.

I use Tor and it's fast.

Reply on news.ycombinator.com