On Tue, 30 Jun 2009 13:34:45 -0700 (PDT) Martin Fick <mogulguy@xxxxxxxxx> wrote: > In my scenario, the point of hard coding the path is to > obfuscate the final URL, how could this be done > differently? In this scenario, it requires all 3 nodes > to decrypt the final URL, one node by itself cannot, > this should provide the same protection that you get > today by surfing with tor, should it not? It should. But hidden services provide this functionality already. I do understand the potential difficulties in setting up a hidden service. But I think it would be easier to automate this aspect of Tor then to write a new protocol. (some more thoughts on this below) > I don't see why this is more open to abuse than the > general tor network, could you explain your reasoning? Agreed.. I'm a security minded IT guy and since drive-by-downloads are the top vector for computer infection any time I hear "obvascated URL" and "Untraceable" in the same paragraph the is a knee jerk reaction to see the security implications. > > As for use cases, I envision that as a simple whistle > blower or reporter, I would post my content on various [snip] OK I now have a clearer idea of what you are wanting to do: 1). Simple anonymous publishing 2). Remove the single point of failure that a a hidden service may represent 3). Plausable deniability by not having the information hosting tied to you. I think that this could be solved in a couple of different ways. 1). Someone sets up a hidden service that automatically re-directs to the content hosted on non-Hidden sites the URL would probably end up looking like: http://blahblahblah.onion?3gYzX2(url_part)&egrtyebefrs(hashed password part) one could argue that there is still a single point of failure but if it was popular enough I'm sure it could be hidden mirrored. 2.) GnuNet may be much better suited to what you are looking to do. It already has a lot of these features (see http://gnunet.org ) Once you inserted the information into GnuNet you could share the hash for it in as many open sites as you wanted. As for making the content password protected GnuPG would work wonders for this (prior to insertion of course) Regards, Freemor -- freemor@xxxxxxxxx freemor@xxxxxxxx This e-mail has been digitally signed with GnuPG - ( http://gnupg.org/ )
Attachment:
signature.asc
Description: PGP signature