Re: SoC Project: Improving Hidden Service Security and Usability

[Scott Bennett <bennett@xxxxxxxxxx>]

     On Sun, 24 May 2009 21:59:28 -0400 Ringo <2600denver@xxxxxxxxx> wrote:
>I'll be working on improving hidden service security and usability this
>summer (starting in about three weeks). I'm currently attending the
>Evergreen State College in Olympia, WA and am working on an 'independent
> contract' which is basically designing a program/class for myself. This
>isn't a GSoC project but it's similar.
>
>Tor's client interface is easy to use and well documented, but the same
>can't be said for hidden services. Many of the people who need these
>services the most like human rights organization and our beloved Chinese
>dissidents probably aren't able to set up a hidden service due to the
>level of technical expertise it requires. As far as I have been able to
>find, there is no guide to setting up secure hidden services nor is
>there any program that helps facilitate it. So that's what I'll be
>working on.
>
>Specifically, I will be creating a how-to guide for securing standard
>LAMP servers as well as a script that will help Linux users set them up.
>I have a few ideas for locking down apache, php, etc. but I would
>appreciate any other ideas admins of hidden services have as well as
>suggestions on how to implement them.
>
     It looks like a project that ought to be done.  However, it does seem
to me that, in the service of the interest you expressed in your second
paragraph above, a higher priority project should be a project to set up
hidden services on Windows systems.  Although it does appear that the largest
number of relays by host operating system is some distribution of LINUX, the
largest number of users worldwide remains, unfortunately, Windows users.
Noting that hidden services can be provided by client-only tor instances,
a type of configuration that reduces still further the chances of investigating
agencies tracking down the sources of those services, those Chinese dissidents
and human rights organizations/activists would be better served by an easy way
to set their services up under Windows without the need for running tor in
relay mode.
     Since your project has already been approved as proposed, I wish you
the best of results.  But I do hope that someone's project someday will address
the most numerous category of people needing to offer hidden services.


                                  Scott Bennett, Comm. ASMELG, CFIAG
**********************************************************************
* Internet:       bennett at cs.niu.edu                              *
*--------------------------------------------------------------------*
* "A well regulated and disciplined militia, is at all times a good  *
* objection to the introduction of that bane of all free governments *
* -- a standing army."                                               *
*    -- Gov. John Hancock, New York Journal, 28 January 1790         *
**********************************************************************