Re:Tor 0day: Finding IP Addresses
by londons_explore on Thursday September 17, 2020 @02:42AM
(#24501836)
That's why you split your drug empire into a server for images and static stuff, and another server to run the rest. The server for the rest can be proxied through the image server, and through another tor connection. That way the feds only find your image server...
[ Parent
| on HN ]
Most of them do that now - the better markets have gateways that are CAPTCHA'd and spread out over other providers that then proxy to the real hidden service (you can do this with a second step over Tor again)
Checkout this project which is now being more widely deployed to prevent a lot of these attacks:
Very cool. I clicked a bunch of links from there and got to here: https://github.com/mikeperry-tor/vanguards/blob/master/READM...
Good overview of threats.
Pretty cool, but you'd think they would just have a Dockerimage ready to be deployed and a network driver or something similar for these types of challenges.
Hope this password advice isn't taken seriously
> TORAUTHPASSWORD - Password which is used for your Tor Control Port Authentication with NGINX. Alphanumeric without spaces (example: passwordIcanremembertyping)
> KEY - Alphanumeric Key for the shared front session key. Random between 64-128 would do fine. (example: isthis64charactorsalreadyicantbelieveitwowsocoolwaitnotyetohdarn)