Re: SoC Project: Improving Hidden Service Security and Usability

[Ringo <2600denver@xxxxxxxxx>]

This is actually something that I thought about but I decided to go for
Linux for a few reasons. The first one being my own experience in Linux
is much greater than that in Windows and the second one being that
installing Ubuntu has become easy enough that I suggest it to
non-techies. If somebody is serious about running a forum for Chinese
dissidents, for example, then they're probably willing to install Linux
on a machine dedicated to it. I think that windows-only clients might be
more likely for personal hidden sites than sites that require constant
uptime. Since sites that require constant uptime usually require a
separate machine, it seems to me that encouraging people to run Linux is
probably a good choice especially given the risks that individual might
be taking by running a hidden service. I would rather have somebody use
Linux instead of Windows because there's no guide for Windows than the
other way around. I agree with you though that somebody needs to do the
same thing I'm doing but for Windows.

I haven't ever done any fingerprinting of hidden services but it would
be interesting to see how many/if any run Windows. As far as I can tell,
most of onionland is run by some dedicated techies who mainly use Linux,
but I could be wrong.

Ringo

Scott Bennett wrote:
>      On Sun, 24 May 2009 21:59:28 -0400 Ringo <2600denver@xxxxxxxxx> wrote:
>> I'll be working on improving hidden service security and usability this
>> summer (starting in about three weeks). I'm currently attending the
>> Evergreen State College in Olympia, WA and am working on an 'independent
>> contract' which is basically designing a program/class for myself. This
>> isn't a GSoC project but it's similar.
>>
>> Tor's client interface is easy to use and well documented, but the same
>> can't be said for hidden services. Many of the people who need these
>> services the most like human rights organization and our beloved Chinese
>> dissidents probably aren't able to set up a hidden service due to the
>> level of technical expertise it requires. As far as I have been able to
>> find, there is no guide to setting up secure hidden services nor is
>> there any program that helps facilitate it. So that's what I'll be
>> working on.
>>
>> Specifically, I will be creating a how-to guide for securing standard
>> LAMP servers as well as a script that will help Linux users set them up.
>> I have a few ideas for locking down apache, php, etc. but I would
>> appreciate any other ideas admins of hidden services have as well as
>> suggestions on how to implement them.
>>
>      It looks like a project that ought to be done.  However, it does seem
> to me that, in the service of the interest you expressed in your second
> paragraph above, a higher priority project should be a project to set up
> hidden services on Windows systems.  Although it does appear that the largest
> number of relays by host operating system is some distribution of LINUX, the
> largest number of users worldwide remains, unfortunately, Windows users.
> Noting that hidden services can be provided by client-only tor instances,
> a type of configuration that reduces still further the chances of investigating
> agencies tracking down the sources of those services, those Chinese dissidents
> and human rights organizations/activists would be better served by an easy way
> to set their services up under Windows without the need for running tor in
> relay mode.
>      Since your project has already been approved as proposed, I wish you
> the best of results.  But I do hope that someone's project someday will address
> the most numerous category of people needing to offer hidden services.
> 
> 
>                                   Scott Bennett, Comm. ASMELG, CFIAG
> **********************************************************************
> * Internet:       bennett at cs.niu.edu                              *
> *--------------------------------------------------------------------*
> * "A well regulated and disciplined militia, is at all times a good  *
> * objection to the introduction of that bane of all free governments *
> * -- a standing army."                                               *
> *    -- Gov. John Hancock, New York Journal, 28 January 1790         *
> **********************************************************************
>