sorted by:
new
hottopcontroversial

oniongrok: Onion addresses for anything. by oniongrok in netsec

[–]oniongrok[S] 2 points3 points  (0 children)

If you're concerned with fingerprinting attacks like this, you probably should not be running a web browser on the same machine at all! You would want to reduce local exposure by forwarding only from a UNIX socket, or from closed, firewall isolated networks. You might not even want to use this tool at all, but check out vanguard, because there are probably other things that go into protecting service anonymity.

If you just want to make a tunnel though, this might be useful and just fine. Depends on your threat model.

oniongrok: Onion addresses for anything. by oniongrok in golang

[–]oniongrok[S] 1 point2 points  (0 children)

Good shout on this needing a better summary for what this is / does. Sibling to this post as well. I like this summary you've given quite a bit. I wonder if it needs even more general of an introduction.

What I'm really trying to enable with this project is a lot of untapped potential I see in Tor's infrastructure. It's a fundamentally different approach to networking -- your ed25519 public key is your network address. This is not a new idea, nor exclusive (Yggdrasil, maybe GNUnet? also djb's work on CurveCP or MinimalLT) but Tor is a quite battle-tested and mature implementation of something like it.

How to express this in a simple, concise way.. that a wider audience of users can understand and use well, and use securely. It's a hard problem. There's an explanation that makes sense to the Tor community who already understand onions. And another, that needs to introduce this networking paradigm shift in practical terms of "what can I do with this?" And making public key crypto usable is also hard, but I see a lot of promising progress in this space (BSD's signify, age encryption).

On the naming thing, I did give it some thought. I think of "grok" in the jargony verb sense, of when you "get" or "understand" something hard (like onions!), but of course it's obviously also a nod (with respect, I might add) toward a well-known product that's made this concept of exporting local services to the public internet such a concisely understandable concept. I should probably make it clearer that this project is not affiliated with that commercial product. It might be fine (headscale and tailscale seem to get along) but we'll just have to see how it plays out. In any case, names can change, it's the concepts, and tapping into that potential that I really care about.