Hacker News Reader

Comment by Scoundreller | Hacker News Reader

Things I've used Tor for:

- Accessing BBC Liveplayer as if I'm in England (using lots of normally discouraged add-ons and defined exit-nodes)

- Bypassing paywalls (possibly still criminal?)

- Bypassing censorship (which is what it really is) on organizational wifi networks (in Canadian hospitals). The funniest block was to ginger.io, a big data smartphone data analysis play (but blocked by an over-aggressive filter for obvious reasons).

Does anyone else have some unexpected/interesting use cases?

View on HN

I use Tor hidden services to punch through NATs (mostly for SSH); it's also useful in that only you can access the service (since only you know its address), so a hidden service + random port is a cheap "port knocking" implementation.

I've also used Tor to debug firewalls. It's a good way of saying "put me in a random spot on the Internet."

Outside of that, I use Tor for whatever I can: downloading RSS feeds, instant messaging, downloading email, mostly. There's no reason not to have Tor on these things because they're all either batched or tolerant of bad latency, and it destroys a little bit of my personal information that would otherwise leak.

I find Hidden Services useful, too. It's a simple way to experiment without an IP address, etc.

I use it in a container, works great. https://registry.hub.docker.com/u/hsaito/torbox-hidden/

The onion addresses of hidden services are not themselves secret. The onion address is in fact well known, published in the directory. It's only your server's IP that a hidden service is hiding.

So please, don't treat knowledge of the onion address itself as a secret! You still have to authenticate to your service in some way.

Tor itself has a nice built-in method of authentication you can use. I don't know of a good howto, but it's documented in the man page. Search for "HiddenServiceAuthorizeClient": https://www.torproject.org/docs/tor-manual.html.en

Are you saying there is a complete directory of onion addresses?

There isn't a definitive/exhaustive directory, but see this post: http://donncha.is/2013/05/trawling-tor-hidden-services/

tl;dr it's possible, and you don't have to rely on crawling the web searching for .onion addresses. You can instead become a HS directory authority, and pick your place in the DHT. Eventually you'd be able to get every address that goes into the DHT.

It'd be pretty impossible to port-scan a .onion... I can't imagine one circuit lasting as long as you'd need to find some random SSH listener.

It's much harder to find than an IP on the Internet; I've never seen brute-force attacks coming from even a standard-port ssh hidden service.

Latency is a problem for me. Maybe for some users, who already have very slow internet, or who live in areas with more TOR relays, it is not so noticeable, but for me the speed difference is about 10 times. Mostly not because TOR would be unbearably slow (it is not slower than regular internet 8 years ago), but because regular internet is very fast where I live.

I mean, you'll notice my strategy is to never torify anything where I'd have to actually wait for it. Except IM, which is small enough that it doesn't matter, anything I've torified is downloaded in the background anyway.

Commenting on news site which shows IP address from work after some incident where IP got banned for a while for some comment. Problem is simple google search with IP and the site in question shows all the comments you wrote "anonymously" from work and it may cause problems.

Also TOR is heavily used by shills in same sites (namely Russian ones), so it's not too uncommon to stumble upon IP that is already banned.

:( on the bbc one. There are plenty of free proxies that you could use that wouldn't waste the tor network bandwith for something that doesn't really need 100% anonymity.

Reply on news.ycombinator.com