Hacker News Reader

Comment by samwillis | Hacker News Reader

DDG have a tor hidden service for search [1] and so you can search annonamusly through that, even if someone has access to the ssl privet key.

[1] http://www.gabrielweinberg.com/blog/2010/08/duckduckgo-now-o...

View on HN

This almost makes no sense. Hidden Services exist to hide the location/identity of the server. You gain the same anonymity by visiting ddg.com via Tor. It's cool that they're running a relay though.

I think that connections to hidden services on the Tor network are encrypted end-to-end.

They are not encrypted at all. Tor provides anonymity (nobody can say where the captured traffic comes from), not encryption (nobody can read my trafic). You should use independent encryption inside Tor.

I2P is similar to Tor, but encrypted AFAIK.

Tor traffic is encrypted all the way through the network until the exit node. However, your point still stands: Use end-to-end encryption (SSL/TLS) to prevent someone at the exit from seeing your traffic.

Yes, they are encrypted, but it's not end-to-end. I should have made my post more clear. If you need end-to-end encyption, participants must explicitly arrange for it independent of Tor.

Tor absolutely does provide encryption, except for the last link (unless it's a hidden service) just like the parent poster said. More information is available here:

https://ssd.eff.org/tech/tor

https://www.torproject.org/docs/hidden-services.html.en

EDIT: To be clear, I am saying that tor DOES provide end-to-end encryption, but only when you're using a tor hidden service -- which is also what the parent poster said.

The parent said end-to-end encryption, which Tor does not do. Yes, information through a tor circuit is encrypted. No, it's not enough if you need end-to-end encyption, the participants must arrange independent of tor for that.

But with a hidden service, the last unencrypted bit is all within the same server. It's a very different scenario from accessing the general internet: There's no exit server to worry about, except for the service you're connecting to.

You're right, connections to Tor hidden nodes are encrypted end-to-end ...but so are SSL sessions over Tor e.g. https://ddg.com

hidden services also exist to hide the location/identity of the client. hence, the user is guaranteed anonymity/privacy in his searches.

Eh, the clients anonymity is protected when they use a Tor exit node via a normal Tor session to ddg.com as well.

Reply on news.ycombinator.com