3

I building a Tor hidden service for educational purposes, and I'm trying to make it as secure as I can. The main app is in Rails, and I'll communicate with multiple micro-services.

Due to bandwidth and server performance problems, and a desire to separate essential components from the larger–more vulnerable–mass, I may host the micro-services on different remote locations, far from the main app. Since the data will go out of my local network, should I encrypt the connection to my micro-services? Is this architecture reasonable anyway?

Improve this question

2 Answers 2

Reset to default
1

If the main service connects to the micro service via Tor hidden service, you don't really need to do additional encryption, Tor hidden service already encrypts and authenticates the connection.

If your main service connects to the microservices using regular internet, then you really should encrypt this connection. There's really no reason not to, as you can use self signed certificate for this purpose which you can create for free, and when setup correctly, without reducing your user's experience or security.

If you don't encrypt the connections to these helper microservices, a well positioned adversary would be able to see what your service is doing, what your users are doing, and potentially deanonymize them.

Improve this answer
0

Let me answer your question with a question:

What is the point of having a Tor hidden service, if you let ISPs and state agencies see what your service is doing anyway? You may as well not bother with Tor.

You should assume that anything you send that is not over SSL can be viewed and can be tampered with.

Suppose you were writing an online store for illegal items (as Tor is famous for). If you sent out an unencrypted message saying "John Doe would like a shipment of drugs to 123 Fake St" every time someone bought something, you wouldn't have any customers for long, because they'd all be in jail.

Improve this answer
1
  • There are many reasons you might want to use a hidden service in that case. The first example that comes to my mind is self-authenticating domain names. You have to design a threat model before you declare a given decision not worth bothering with. If your threat model is such that confidential data is handled on the HS (like the drug market example you gave), then of course it would be a bad idea. Not that I'm disagreeing with the idea that it's still good to encrypt it, though.
    – forest
    Dec 24, 2017 at 5:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .