tor2web esc2011
DESCRIPTION
Tor2web is a gate to Tor Hidden ServicesTRANSCRIPT
![Page 1: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/1.jpg)
tor2web
Past, Present and Future of Tor Hidden Services
Sunday, September 4, 2011
![Page 2: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/2.jpg)
What is tor2web?
• Gate to hidden services
• Allows people to access HTTP(s) Hidden Services without Tor
Sunday, September 4, 2011
![Page 3: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/3.jpg)
Tradeoff
• --Client Anonymity
• ++Usability
Sunday, September 4, 2011
![Page 4: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/4.jpg)
Tor Hidden Services
• am4wuhz3zifexz5u.onion
• Anonymity for the Server
• DoS protection
• End-To-End encryption
Sunday, September 4, 2011
![Page 5: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/5.jpg)
Sunday, September 4, 2011
![Page 6: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/6.jpg)
Sunday, September 4, 2011
![Page 7: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/7.jpg)
Sunday, September 4, 2011
![Page 8: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/8.jpg)
Sunday, September 4, 2011
![Page 9: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/9.jpg)
Sunday, September 4, 2011
![Page 10: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/10.jpg)
Sunday, September 4, 2011
![Page 11: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/11.jpg)
Why use HS
• Avoid retaliation for what you publish
• Securely host and serve content
• Stealth Hidden Service
Sunday, September 4, 2011
![Page 12: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/12.jpg)
Tor2web
• Works for HTTP(s) HS
• Promote Tor HS
• HS can impact the whole web!
Sunday, September 4, 2011
![Page 13: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/13.jpg)
Tor2web 1.0
• Started by Aaaron Swartz in 2008
• Now part of GlobaLeaks
Sunday, September 4, 2011
![Page 14: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/14.jpg)
Tor2web 1.0 Issues
• Exposed to abuse complaints
• Misuse of HS to spread illegal material
• No disclaimer
• This leads to Server Takedown
Sunday, September 4, 2011
![Page 15: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/15.jpg)
First iteration
Sunday, September 4, 2011
![Page 16: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/16.jpg)
Solved problems
• Tell the audience no content is hosted on the server
• Abuse and problem complaint form
• Dynamic URL rewriting
Sunday, September 4, 2011
![Page 17: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/17.jpg)
Kharon
• Complementary to tor2web
• Firefox and Chrome plugin
• https://github.com/hellais/kharon
• rewrites hidden services to tor2web and i2p
• Done by evilaliv3, hellais and vecna
Sunday, September 4, 2011
![Page 18: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/18.jpg)
Unsolved problems
• Responsibility not distributed
• Links directly serve the content
• High risk of takedown
Sunday, September 4, 2011
![Page 19: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/19.jpg)
Future tor2web 3.0
• Discussed with Paul Syverson
• Further reduce the risk of takedown
• Distribute responsibility across multiple actors
Sunday, September 4, 2011
![Page 20: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/20.jpg)
Scenarios
• Spammer links to *.tor2web.org site hosted on HS
• Illegal content hosting
Sunday, September 4, 2011
![Page 21: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/21.jpg)
Definitions
NodeA
NodeB
Hidden Service
User
Sunday, September 4, 2011
![Page 22: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/22.jpg)
Node A
• Landing page
• Accept disclaimer
• Does not serve content
• Generates a unique, temporary access URL for the User
Sunday, September 4, 2011
![Page 23: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/23.jpg)
Properties of the URL
• Usable once
• Only Node A’s can make them
• Usable only by who generated it
Sunday, September 4, 2011
![Page 24: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/24.jpg)
The unique URL
nonce
timestamp
the_user
onion_address
(maybe the IP)
H(
)
Sunday, September 4, 2011
![Page 25: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/25.jpg)
The unique URL
NodeA
NodeB
Signed nonce
verifies the signature
User
Hash
computes the H(...)Sunday, September 4, 2011
![Page 26: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/26.jpg)
Node B
NodeBUser
content
Node B is in different ISP and/or country
Sunday, September 4, 2011
![Page 27: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/27.jpg)
What have we achieved?
• Distribute responsibility across two actors in two different jurisdictions
• Avoid direct serving of content
• URL’s are unique per user
Sunday, September 4, 2011
![Page 28: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/28.jpg)
New problems
• How to handle caching?
• The issue is the delay in connecting to HS
• Cache is used only after connection has been established
• What are the flaws in this solution?
Sunday, September 4, 2011
![Page 29: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/29.jpg)
Questions?
• Wiki: http://wiki.tor2web.org
• Mailing list: [email protected]
• IRC: #tor2web on irc.oftc.net
Sunday, September 4, 2011
![Page 30: Tor2web ESC2011](https://reader033.vdocuments.us/reader033/viewer/2022060110/55621fd3d8b42af6668b470e/html5/thumbnails/30.jpg)
Thanks for listening!
Sunday, September 4, 2011