3

Another theoretical question about Tor: Imagine I am running a dissident web site as a hidden service. How can I reduce the chances that I get caught?

Assume I am running the server from home, over a large ISP. Going to a small ISP seems too suspicious, and giving the server out of hand is way to dangerous.

I'm especially worried about the following: The spies figure out (though the content of my site, idiosyncrasies of my writing, the times I post updates) in which country I am living. The major ISPs here are all in cahoots with the spies. One call - or a secret secret court order - and the ISP starts bisecting all connections. They disconnect half of the connections for a split second, and the spies look whether my site went down. If not, they try the other half. But if so, they continue bisecting the half I am in. In roughly log2(number of customers) steps they have identified me.

This is a very simple approach, I'm sure there are much more sophisticated attacks, like traffic correlation analyses. Are there things one can do to remain anonymous? Is there something like DNS round-robin for Tor? Are there documented best practices for running hidden services?

  • 2
    You just buy a VPS in the US and run your Tor service from there. – Lucas Kauffman Jan 26 '14 at 17:35
  • 2
    @LucasKauffman: NSA to VPS company: "Would you please do a quick grep "Welcome to my dissident homepage!" on all your customers' servers? Thanks!". Even if that doesn't happen, traffic analysis can identify my server in this case just as well. – jdm Jan 26 '14 at 17:41
  • Not really, it would depend on where you are running the VPS. How are you going to preform the traffic analysis? – Lucas Kauffman Jan 26 '14 at 17:54
  • 3
    Well posting here about your 'dissident website' probably wasn't the best idea – cutrightjm Jan 26 '14 at 19:48
  • @ekaj: Well, either I'm pretty stupid, or I'm obviously not running such a site. I don't even have enought time to maintain a blog, let alone someting like that :-D But that's already one good tip - don't talk about your plans using your clear name. I believe the Silk Road guy made that mistake and posted on Stack Overflow IIRC. – jdm Jan 26 '14 at 21:28
5

There is no way to securely host Tor hidden services from anywhere that can be linked to you. Hosted servers are vulnerable, of course, because you can't monitor or control their physical security. But it's a good trade-off, because losing a server is better than losing your freedom.

But don't use VPS, because (as you note) that's too readily monitored by hosting providers, who might be concerned about their liability. Use dedicated servers, with hosting providers that (1) expressly permit Tor hidden services, and (2) accept anonymous rental and payment.

Use thoroughly anonymized Bitcoins for payment. Before use, check your payment wallet at blockchain.info for taint from your initial-funding wallet.

Only access the server via key-authenticated ssh via Tor. Start with a basic static HTML site. In order to securely manage user login credentials, you'll need an authentication server, which only connects with the content server via Tor.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.