Tor (anonymity network)

From Wikipedia, the free encyclopedia

Tor can also provide anonymity to websites and other servers. Servers configured to receive inbound connections only through Tor are called onion services (formerly, hidden services). Rather than revealing a server's IP address (and thus its network location), an onion service is accessed through its onion address, usually via the Tor Browser. The Tor network understands these addresses by looking up their corresponding public keys and introduction points from a distributed hash table within the network. It can route data to and from onion services, even those hosted behind firewalls or network address translators (NAT), while preserving the anonymity of both parties. Tor is necessary to access these onion services.

Onion services were first specified in 2003 and have been deployed on the Tor network since 2004. Other than the database that stores the onion service descriptors, Tor is decentralized by design; there is no direct readable list of all onion services, although a number of onion services catalog publicly known onion addresses.[citation needed] TorSearch is an internet search engine that indexes pages to help find content in websites located on the Tor network.

Because onion services route their traffic entirely through the Tor network, connection to an onion service is encrypted end-to-end and not subject to eavesdropping. There are, however, security issues involving Tor onion services. For example, services that are reachable through Tor onion services and the public Internet are susceptible to correlation attacks and thus not perfectly hidden. Other pitfalls include misconfigured services (e.g. identifying information included by default in web server error responses), uptime and downtime statistics, intersection attacks, and user error. The open source OnionScan program, written by independent security researcher Sarah Jamie Lewis, comprehensively examines onion services for numerous flaws and vulnerabilities. (Lewis has also pioneered the field of "Onion Dildonics", sex toys which make use of Tor through the Ricochet protocol)

Onion services can also be accessed from a standard web browser without client-side connection to the Tor network, using services like Tor2web. Popular sources of .onion links include Pastebin, Twitter, Reddit, and other Internet forums.