Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I have understood literally nothing. ELI5 ?


Tor lets you share a URL with a domain name .onion[0]

That others can connect to securely. So long as you can connect to the tor network you don't need to worry about firewalls.

One criticism is that while onion addresses are secure and have authentication built in (it's kind of like if websites could be connected to by the public key of their SSL certificate) they are hard for humans to compare.

The problem is chicken and egg you have to connect over SSL using DNS to get the onion address if one is advertised.

So the first time you access it you just assume it's trust worthy. "Trust on first use" TOFU.

[0] the BBC for example advertises it's address https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6a... here https://www.bbc.com/news/technology-50150981.amp but getting it requires accessing the regular website first.


> The problem is chicken and egg ...

That's not an issue of Tor. The same thing happens in the clear web, how do you know www.bbc.com is the BBC you trust from the TV?.

That happens to any domain, in fact, that happens to any source of information.

How did you start trusting in your current religion or politics?. Chances are that you were convinced by a source(s) that for some reason you previously decided to relied and trust.

We build some kind of web-of-trust in our heads, and it's normal that we do not trust in any .onion address initially. Eventually we import trust from sources outside of Tor that we currently trust (like you did by getting bbc's .onion address from its website), and then we start adding some .onion addresses to our "trusted sources" list

I suppose your criticism is that last step of adding that .onion address to your trusted sources is really painful. It's easy to remember www.bbc.com, but not its .onion address. We eventually need to automate this, something like password managers but for trusted sources


To be clear I was just providing an ELI5 for the comment.

I do like that website can know advertise an onion address the browser can highlight.

People used to rely on Grams before it went out of business.

https://en.wikipedia.org/wiki/Grams_(search)

Or DeepDotNet

https://en.wikipedia.org/wiki/DeepDotWeb

Presumably once Reddit closed /r/darknetmarkets discussion moved to forums or probably Discord.

Back in the late 90s my local car boot sale (like a jumble sale), sometimes sold lists of websites. I never really knew what was on them but it feels a bit like what we're back to now.


The acronyms are googleable and a basic exposition on how Tor works is available on the Tor website.

That should get you to a point where you can at least ask for a particular clarification.


I actually did ! but still didn't understand !




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: