Hacker News Reader

Comment by pierat | Hacker News Reader

I use Tor hidden services. All incoming Tor connections come from "localhost". Every single one of them.

In order to propey secure, say, a Tor hidden services sshd, you can't use fail2ban. You must use 2fa. Fail2ban would just nearly immediately ban you from ever logging in.

I also turn down the login delay to a few seconds, just to make bruting harder.

View on HN

I've never set up a Tor server, but I would have assumed incoming traffic could only be sent out to the internet, and that it would be blocked from accessing anything on your LAN, anything in 198.0.1.x. Is that not the case?

Otherwise how could anyone even have a printer connected to their network without people constantly printing junk pages as a prank?

If you've got a setup where Tor traffic can send a packet to your NAS in the first place, you're a far braver soul than I... I trust a firewall far more than I'll trust 2FA.

Yes all onion service connections appear from 127.0.0.1 but the current v3 onions are not guess or enumerateable. If you don't publish your address you get 0 attacks ever. Have you put your onion address all over the Internet to get attacked?

That's not true.

When you make a HS, it is announced in the Tor's dHT. Now, it is true that the scope of the v3 dHT is limited, it is not 0.

(And more specifically, Tor is a 6-4 mixing network overlay with dHT DNS.)

>However, clients still need to ask the directory for information about a specific onion address, which would again allow mass collection of onion addresses. With V3 onion services, this is prevented by using key derivation to derive a daily-rotated identifier ("blinded public key"). [0]

This is the information I have. It's not possible for a relay to know an .onion address like it was with v2. Could you please link to something that proofs the contrary?

[0] https://blog.torproject.org/v3-onion-services-usage/

Reply on news.ycombinator.com