Load Balancing
Distributing incoming traffic across multiple servers prevents any single node from becoming overwhelmed, ensuring better uptime and performance for users.
Educational Overview
Understanding Hidden Services and Verification
This page provides an educational overview of how Tor hidden services operate, the technical reasons for using mirror sites, and how cryptographic methods like PGP are employed to verify service authenticity and protect against phishing attacks.
Tor Hidden Services (.onion)
The Tor network allows for the hosting of hidden services, which are accessed via .onion addresses. Unlike traditional websites that resolve via DNS to a public IP address, hidden services operate entirely within the Tor network, utilizing a system of entry guards, relays, and rendezvous points to obscure the location of the server.
Modern Version 3 (v3) .onion addresses are 56 characters long and incorporate advanced cryptography. The address itself is derived from the service's public key. This means that if a user connects to the correct .onion address, the Tor protocol mathematically guarantees they are communicating with the entity holding the corresponding private key, providing inherent end-to-end encryption and authentication.
The Role of Mirror Sites
Hidden services often utilize multiple URLs, known as mirrors. This architecture serves several technical and operational purposes.
DDoS Mitigation
Hidden services are frequently targeted by Distributed Denial of Service (DDoS) attacks. Multiple mirrors allow administrators to cycle addresses and maintain availability during an attack.
Redundancy
If one server fails or is taken offline, users can seamlessly transition to an alternative mirror, maintaining access to the service.
Verifying Authenticity with PGP
- 1
The Threat of Phishing
Because .onion addresses are long and difficult to memorize, users often rely on directories or links. This creates a significant risk of phishing, where malicious actors create clone sites to steal credentials or cryptocurrency (e.g., Monero or Bitcoin).
- 2
Obtaining the Canonical Key
To defend against this, legitimate services publish a canonical PGP (Pretty Good Privacy) public key. Users must obtain this key from a trusted source during their initial, verified interaction with the service.
- 3
Verifying Signatures
When accessing a new mirror, the service should provide a PGP-signed message containing the current .onion address. Users verify this signature using the canonical public key. If the signature matches, the mirror is authentic; if it fails, the site is likely a phishing clone.
Security Notice: Relying solely on visual inspection of a .onion address or trusting unverified link directories is insufficient for security. Cryptographic verification using PGP is the standard method for confirming the authenticity of a hidden service mirror.
Frequently Asked Questions
Why is JavaScript often disabled when accessing hidden services?
Disabling JavaScript (often done by setting the Tor Browser to 'Safest' mode) reduces the attack surface. Malicious scripts can potentially be used to de-anonymize users or exploit browser vulnerabilities.
What is the difference between a v2 and v3 onion address?
Version 2 addresses (16 characters) used older cryptography and are no longer supported by the Tor network. Version 3 addresses (56 characters) use stronger ECC cryptography, offer better security, and leak less information to directory nodes.
How do entry guards protect users?
An entry guard is the first node in a Tor circuit. By using a consistent entry guard for a period of time, Tor reduces the risk of profiling and certain types of deanonymization attacks compared to picking random entry nodes for every connection.