Tor servers

Does tor hide the IPs of .onion servers? or can a threat actor easily find the real IP of onion server host? of course, i can buy an "anonymous vps"[1] from a provider (over tor) and ssh into it (again, over tor). [1]: https://crippled.media/free-speech-vps-providers-put-to-the-test but the companies that provide anonymity ( (well, they dont really provide anything, they just dont require personal info) for VPSes are considerably more expensive than other popular providers for example, for $30/mo, i can get a BuyVM server w/ 8G ram & 2 cores, while contabo offers 10 Cores and 60G ram for almost the same price (31.5/mo)...

>>22460 Here's a summary of how onion services work: https://community.torproject.org/onion-services/overview/ Pretty much, both ends make a 3 hop onion circuit to make 6 total hops, so neither end knows the others IP. There's also a non-anonymous mode for hosting, where only the visitor has anonymity (3 hops), while the host has only 1 hop - although the IP corresponding with an onion service isn't published. If threat actors manage to exploit the software that hosts an onion service, they could potentially run commands that retrieves the public IP. One attack that's been pulled off before is when there was a onion service that ran forum software that fetches profile images from URLs, but the host forget to make it so all connections are made over Tor, so you could upload an image under a domain controlled by you and see which IP visits such link to find out the servers IP. There's also the possibility of a confirmation attack, where a threat actor checks to see if an .onion is reachable, cuts the internet connection of what is the expected host and then tries to reconnect to the .onion. Onion clouds is an attempt to mitigate the confirmation attack, as ideally with 2 or more hosts of different computers and networks, close to 100% uptime will result and if one computer goes down, the onion will still work.

>Does tor hide the IPs of .onion servers? Of course. It would be a bit pointless otherwise. You can host an hidden service from home (it's actually easier than hosting a clearnet service, since you don't have to worry about port-forwarding and soykaf), but it can be risky depending on your threat model (as >>22461 said)

>>22461 > Onion clouds is an attempt to mitigate the confirmation attack, as ideally with 2 or more hosts of different computers and networks, close to 100% uptime will result and if one computer goes down, the onion will still work. any docs/resources/info on this? cant find anything when i search "onion clouds" or "distributed tor"

>>22460 >>22462 You can put the onion service behind any VPN without need open ports, reducing risk of the ip leak.

>>22460 Tor does hide IPs. However, note that it cannot protect against global traffic analysis (no "low-latency" network can). And companies that can see the majority of global network traffic do exist. Only a concern if you're hiding from glowies, of course. >for example, for $30/mo, i can get a BuyVM server w/ 8G ram & 2 cores I'm confident you can run a node with much lower specs unless you expect a lot of traffic (or use very poorly optimized software).

>Does tor hide the IPs of .onion servers? Yes. >or can a threat actor easily find the real IP of onion server host? No. >of course, i can buy an "anonymous vps"[1] from a provider (over tor) and ssh into it (again, over tor). Unnecessary and probably much less secure. In general, creating onion services is almost stupidly easy, and amazingly secure unless you give yourself away with poor opsec or vulnerable server software.

>>23506 >In general, creating onion services is almost stupidly easy, and amazingly secure unless you give yourself away with poor opsec or vulnerable server software I wish I could agree with you, but look up the Tor Vanguard extension. There are potential attacks for finding the guard node associated with an onion service through denial of service. If you are the government, you can find out who is connecting to that guard, and from there you can examine the traffic more closely to find out what traffic is associated with the onion service. From there, you can get the clearnet IP. I would agree that opsec failures and application server vulnerabilities are likely to give away the server as well. I will put it this way: I trust that nobody can find an onion service with secret keys enabled and an unindexed URL. But I wouldn't bet my freedom on hosting an illegal public onion service. They all get v& eventually.