Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The onion addresses of hidden services are not themselves secret. The onion address is in fact well known, published in the directory. It's only your server's IP that a hidden service is hiding.

So please, don't treat knowledge of the onion address itself as a secret! You still have to authenticate to your service in some way.



Tor itself has a nice built-in method of authentication you can use. I don't know of a good howto, but it's documented in the man page. Search for "HiddenServiceAuthorizeClient": https://www.torproject.org/docs/tor-manual.html.en


It'd be pretty impossible to port-scan a .onion... I can't imagine one circuit lasting as long as you'd need to find some random SSH listener.

It's much harder to find than an IP on the Internet; I've never seen brute-force attacks coming from even a standard-port ssh hidden service.


Are you saying there is a complete directory of onion addresses?


There isn't a definitive/exhaustive directory, but see this post: http://donncha.is/2013/05/trawling-tor-hidden-services/

tl;dr it's possible, and you don't have to rely on crawling the web searching for .onion addresses. You can instead become a HS directory authority, and pick your place in the DHT. Eventually you'd be able to get every address that goes into the DHT.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: