Onion v2 addresses are deprecated, I’m not mad
July 2, 2024
It finally happened. The Tor Project, Inc. finally pulled the plug on onion v2
services. This means that my original super–epic vanity address gets replaced
by a boring only–slightly–vanity onion v3 one.
Origin
16 character onion v2 addresses were just the right length to enable
bruteforcing vanity looking addresses. Finding an address starting with a
defined 8 character string is relatively easy with
eschalot. Some entities
have gone as far as to keep brute-forcing until they get an address with their
name and pronouncable,
backronymizable remaining
characters. Some examples would be facebookcorewwwi.onion and
rutrackerripnext.onion. Existing companies/organizations are however challenged
with a disadvantage of having to include their existing name in the address.
That is what makes those addresses impressive.
For entities that haven’t decided on a name vanity address hunting becomes much
easier. They can pull entire dictionaries and compare bruteforced addresses
with them to find good looking domains. That’s how I got my first address for
this website - lightingtexfqcor.onion. In this case eschalot returned a match
for ”lighting” and I further recognised ”tex”. Deciding feature was ”fqcor”
which sounds like it means something.
I was looking for a way to punch through NAT at my dormitory (network
administrators didn’t provide port forwarding for students, duh!). Using an
onion hidden service is great for that. It makes your website independent from
internet service providers and domain registrars. For those reasons my server
was only accessible through tor. It would be fine if every browser was
distributed with a copy of tor router, but that is not the case. To have my
server accessible by more people I decided to forward connections through a VPS
and purchased a domain - fqcor.com. I chose it to make my original
lightingtexfqcor.onion address look completely non-random. I’m not sure if it
raised any brows without me pointing it out. Maybe people just don’t look at
onions that closely.
/WWWW\
V |, , ,|
/ \ | ‘|
\_/ \ o ,
\ |
Author of this article looking very closely at an onion
Onion v3
The whole origin story of my domain name becomes irrelevant in the context of a
new onion v3 addresses. Getting an 8 character string at the beginning is much
harder with them, and the worst part is that they are 57 characters long! There
is simply no way to make them look nice.
For a long time I ignored the deprecation announcements. Recently one of my
systems stopped connecting to my services after update. I quickly launched
mkp224o to bruteforce something
suitable. I went with
fqcoretoclxwqpy3dwktkskmwywrcktgnpviesveq6vrjhqhdc6y4fid.onion.
I don’t plan on rolling something better, v3 services are ugly no matter what.
Despite all my whining I support the change - it introduces a much better
ed25519 cryptography and avoids some of the
vulnerabilities
that previous version had.
One complaint that I still have is how user can set up a private hidden
service. Previous version had just simple secret cookie setting that you would
have to copy between devices. New version has full asymmetric cryptography,
again with magic Curve25519. This allows administrator to accept public keys
from different users separately without risk of leaking one secret cookie. I’m
sure the codebase behind that is cleaner too, but for now the procedure of
setting it up is
not
great.
Hopefully in the future tor will ship with official tools for generating keys
for hidden service authentication.
Title
I removed all occurrences of ”lightingtex” from my website (except articles). From now on title will be a backronym of ”fqcor” - different after every page reload. Title is handled by menu.html server side inclusion. I used hhvn’s suggestion to use inotify to look at accesses to this file and then change it randomly. This way I don’t need to dig into nginx CGI. I used dictionary from Electrum because I didn’t want NSFW titles.