I think most people here fail to realize how correct your comment is. The only security you get from visiting a TOR hidden service is from knowing exactly what is its URL.

You can't trust the URL you see from a web engine.

The reason is that the onion address of a TOR hidden service is actually a hash of its public key. The TLS connection you have with the TOR service is only verified by you knowing the exact URL you've typed in your TOR browser.

Without this you could be visiting a fake onion address which would be man-in-the-middling you and the real onion address you're trying to visit.

Probably this is the real purpose of the advertised search engine.

> I think most people here fail to realize how correct your comment is.

I think you are assuming a lot about what people here thinks.

The author of the comment you are referring to thought that the GA scripts were set up by the search engine, which is not the case. The gateway actually includes GA scripts, and if people want real privacy they don't use a gateway they can't trust (or they would be accessing it over Tor anyway, thus hiding who they really are for the gateway and for GA).

> The only security you get from visiting a TOR hidden service is from knowing exactly what is its URL.

Well, no, that's not the only security you get. There is also encryption and hidden IP address for example. Depending on your threat model it could be totally okay not to know who you are visiting. "Random" example: if you are using a search engine to discover new hidden services, you can't know their names in advance anyway…

> The TLS connection you have with the TOR service

It doesn't really work like that (and it's written "Tor" not "TOR" btw).

> Probably this is the real purpose of the advertised search engine.

Now you are accusing this service of trying to MITM its users based on nothing. Especially since you didn't seem to bother verifying if the GA scripts were actually set up by the search engine (which they aren't).

> Depending on your threat model it could be totally okay not to know who you are visiting. "Random" example: if you are using a search engine to discover new hidden services, you can't know their names in advance anyway…

That's all technically true, but I doubt even HN readers really understand what that means. So let's compare...

If you open up a Google Chromebook and discover new sites by going to the default page which is a search engine also owned by Google, who a) because of the sorry state of CAs has implemented its own open source tool to watch the set of known certificates for any funny business that would signal a break somewhere in all that overly-complicated brittle technology, and b) is Google's bread and butter such that if they started mapping site titles/descriptions (which you've probably heard of out of band) to different URLs would lose their stranglehold on the industry, not to mention such an attempt would be reported widely in the news media... you can't know their names in advance anyway.

vs. an expanded version of the original:

If you are discovering new services via a new search engine released from an entity you've never heard of that maps page titles/descriptions of hidden services you've never heard of to human unreadable strings on an anonymity overlay for which phishing scams, covert site takeovers, and drive-by malware attacks don't make the front page of most news media... you can't know their names in advance anyway.

Edit: remove redundant adjective, clean up confusing sentence

True, but keep in mind that just because these hidden services' true identities aren't known, doesn't mean they can't have a reputation.

If this search engine becomes popular among Tor users for example, and you follow a few news sites which focus on stories related to the dark web, you'll end up in basically the same situation as you are now with Google. (With the search engine losing the trust of its users if it starts behaving maliciously.) Same goes for other hidden services.

> I think you are assuming a lot about what people here thinks.

Or you are

> Well, no > It doesn't really work like that

Don't be pedantic. You got my point.

> Now you are accusing this service of trying to MITM its users based on nothing

I said probably.

It's not about being pedantic, it's about not being plainly incorrect.

Everybody knows the security of TOR doesn't only come from the URL you type on your keyboard. This is called exaggeration not being incorrect.

The claim that Tor hidden services use TLS in order to encrypt their communication seems incorrect to me.

I actually imagined they always would since you would use the url to verify the pubkey. Why would they build hidden services without it?

Public-key cryptography is used by Tor hidden services but it's not based on TLS/SSL certificates. There are a lot of detailed explanations of how this works on the web, but if you just want a quick overview I recently wrote about in the introduction of an article for 2600 (summer 2017 issue https://store.2600.com/collections/2010-2015/products/summer...). You can find a copy of my article here: https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidd...

How are you expected to look for stuff on Tor? How do you get the exact URL if not from a search engine?

Edit: I see I have been down voted. It was a genuine question.

In normal Tor usage, you just visit ordinary web pages. The Tor network hides the user from the server, but it still requires the server to have a known DNS name and IP address to be reachable. Hidden services (which are not a built-in idea, they are an ugly hack and not super secure) let both sides act like a user and connect through a publicly-known intermediary. https://www.torproject.org/docs/hidden-services.html.en

I think the only problem called out here is having Google Analytics scripts running on the page, which try to fingerprint the user's browser even when you're trying to search anonymously.

OK so if I want to search for a newer equivalent of Silk Road, how do I go about it?

Thats stuff isn't going to show up in Google searches is it?

It does, you will find a few websites talking about it and you will have to choose to trust the URL they give you.

It's kind of like real life though, how did you get the URL of your bank? You either trust Google.com to give you the right one because you trust them as a search engine, or you pay a visit to your bank and ask them.

You are ranting about a clear-web gateway, not the search engine in question.

Edit: Downvote me as far as you want, what I said is true.

You're right, the title is misleading. This is a gateway, not a search engine.

Oops, I was wrong. You type in a word and you get search results.

Seems pretty dangerous, though. I mean, people use tor so that their ISP and others can't find out what websites they are visiting, so what is the point of using a proxy to visit a tor search engine, and then have your ISP see which links you click on. In fact, it wouldn't suprise me if the whole thing is a blackmail scheme.

I guess the GA script is attached by onion.casa, not by the search engine itself.

I can confirm that. The GA scripts are installed by the gateway, I don't have them when directly connecting to the .onion.

Even so, this may get people in trouble. I've just tattooed some nonsense over keyboard and got search results related to CP. Thanks God it haven't shown me image previews!

They better show a warning about gateways.

Hopefully, users who care about Tor's privacy benefits will have ensured that their client environment lacks connectivity to anything but the Tor network.

if you expect flawless anonymity from Tor then js should be deactivated in the first place.