Author Topic: Hosting a .onion server and staying anonymous?  (Read 2981 times)

0 Members and 5 Guests are viewing this topic.

Offline datorcrawler

  • /dev/null
  • *
  • Posts: 6
  • Cookies: 0
    • View Profile
Hosting a .onion server and staying anonymous?
« on: January 18, 2014, 12:51:48 pm »
I am interesting in running a standard LAMP server to host some basic php sites, perhaps running a bitcoin daemon while im at it to manage wallets and so on.

What are the risks of setting this up? How would you do it?

Are there any free alternatives for hosting a basic .onion site?

Offline Inquisitor Sasha

  • /dev/null
  • *
  • Posts: 7
  • Cookies: 0
    • View Profile
Re: Hosting a .onion server and staying anonymous?
« Reply #1 on: January 18, 2014, 04:46:25 pm »
Hosting a .onion site is not going to make you anonymous.  Not in the slightest.  I believe that the .onion TLD is part of a DNS root hosted by Tor and only accessible through Tor or maybe though using their DNS server.  I don't know what the process for registering a .onion domain is.  There might be less requirements to turn over information for .onion than with other TLDs, but that's not going to make you anonymous.


Use of a specific TLD will not make you anonymous.  Where you're going to run into trouble staying anonymous is with the server.  You're going to need to have a server hosted somewhere that people won't be able to hunt for you.  In most cases, a hosting provider's privacy policy will be enough, as long as you don't host sites with domains that are known to be owned by you or anything like that.  If you're trying to evade the law, which I do not support, you're going to need to host the server in a country that won't cooperate with your country's law enforcement agencies.  Even then, the NSA might try to do things like hack your server to install spyware and catch you that way, depending on how popular your server is.  Staying anonymous from governments is very difficult.

Domain names go to IP addresses.  These IP addresses identify the device connected to the internet.  If you host a server for publishing a drug market website, it doesn't matter if you use .onion for your domain name; it will lead to your IP address if you host the server in your house, which will lead to the police breaking down your door.
« Last Edit: January 18, 2014, 05:53:49 pm by Inquisitor Sasha »
I'm here to read about hacking and security.  Main goal is to learn about security and to learn to find vulnerabilities to get better with security.

Offline datorcrawler

  • /dev/null
  • *
  • Posts: 6
  • Cookies: 0
    • View Profile
Re: Hosting a .onion server and staying anonymous?
« Reply #2 on: January 18, 2014, 09:09:55 pm »
Thanks for the feedback!

Hmm, I believe the .onion domains are free when you use Tor. By running Tor on the box I would be able to get the .onion domain which would then only be accessible from other Tor users as .onion is not an actual TLD.

So with Tor running I figured it would never show my actual IP or location? perhaps I would be pretty safe?

Or if I run Tor on a dedicated box which is not hosted where I stay.

The other alternative would be to acquire som bitcoins and just pay for hosting from one of the .onion hosters out there.
« Last Edit: January 18, 2014, 09:10:16 pm by datorcrawler »

Offline Thor

  • Serf
  • *
  • Posts: 29
  • Cookies: 15
  • whoami?
    • View Profile
Re: Hosting a .onion server and staying anonymous?
« Reply #3 on: January 20, 2014, 08:29:25 am »
Hosting a .onion site is not going to make you anonymous.  Not in the slightest.  I believe that the .onion TLD is part of a DNS root hosted by Tor and only accessible through Tor or maybe though using their DNS server.  I don't know what the process for registering a .onion domain is.  There might be less requirements to turn over information for .onion than with other TLDs, but that's not going to make you anonymous.


Use of a specific TLD will not make you anonymous.  Where you're going to run into trouble staying anonymous is with the server.  You're going to need to have a server hosted somewhere that people won't be able to hunt for you.  In most cases, a hosting provider's privacy policy will be enough, as long as you don't host sites with domains that are known to be owned by you or anything like that.  If you're trying to evade the law, which I do not support, you're going to need to host the server in a country that won't cooperate with your country's law enforcement agencies.  Even then, the NSA might try to do things like hack your server to install spyware and catch you that way, depending on how popular your server is.  Staying anonymous from governments is very difficult.

Domain names go to IP addresses.  These IP addresses identify the device connected to the internet.  If you host a server for publishing a drug market website, it doesn't matter if you use .onion for your domain name; it will lead to your IP address if you host the server in your house, which will lead to the police breaking down your door.

Not true.
Domain names used for tor hidden services aren't actually domain names. You don't register them the way you would with a normal domain name. It works using key pairs, just like bitcoin. When you are creating a hidden service (a .onion service), you generate a key pair (private key + public key). The public key his hashed and halved, and this is the "domain name" for the hidden service. That's why they are generally random looking strings and hard to remember. Having the private key is what gives you ownership of that "domain".

As for finding the ip address of the server, that isn't as simple as you think it is. With tor hidden services, domains don't map back to server ip addresses. You cannot find a servers ip address when only given the hidden service url. The whole point of the hidden service is to mask the location of the server hosting the content. However, it is still possible for the server to be hacked over tor, and this could expose the servers real ip address.

The risks associated depend on what your plans are. You mentioned bitcoin wallets, if you plan on starting up and wallet service or marketplace over tor I would refrain from doing so. In order to safely run either of those services securely a great deal of technological skill and experience is required. With bitcoins being so valuable right now, anything which stores them is a huge target. So unless you are confident in your ability to protect your server from a hoard of cyber criminals looking for bitcoins, and potentially law enforcement depending on what it is you're setting up I'd stay away.

But to answer your question, it is extremely hard to trace a .onion domain to a person, unless you hack the server.
They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety.

Offline datorcrawler

  • /dev/null
  • *
  • Posts: 6
  • Cookies: 0
    • View Profile
Re: Hosting a .onion server and staying anonymous?
« Reply #4 on: January 21, 2014, 05:49:17 pm »
Thanks for the feedback.

I am not looking to start a drug market or anything with that much risk. I consider what I do to be in a gray area, could be legal depending on how you look at it.

I am experienced with servers so I am aware of the security risks in regards to being hacked and whatnot.

The bitcoin daemon would mostly be used to handle payments to the websites wallet and not much else.