22

Are there any implications if whilst running a non-exit relay, I also use the same machine to host a Hidden Service?

Specifically:

  1. How will this affect the anonymity of the Hidden Service (in terms of its location being obscured)?
  2. What effect would it have on the anonymity of clients using my relay as a middle node, or a guard node?
  3. Are there any other side-effects I should be aware of?
Megan Walker
  • 2,640
  • 1
  • 22
  • 30

1 Answers1

14

I believe that all of your questions can be answered by explaining the underlying threat when running any relay on the same Tor as a hidden service:

Relays publish bandwidth information about their usage and availability to enable the Tor network to efficiently route traffic and provide bandwidth where it is needed. Given that I see bandwidth information about your relay, I can potentially link your hidden service to your relay by tracking the popularity of your hidden service over time) and watching your relay's available bandwidth fluctuate.

I can track your popularity over time by setting up a relay and getting it the HSDir flag which allows it to become a location where service descriptors can be retrieved from for a hidden service.

By modifying my relay's Tor to log hidden service descriptor requests, I can extrapolate how popular your hidden service at a given time.

After I have managed to correlate your hidden service with your relay, if I decide to use your relay as my entry to Tor, I now have your IP address, allowing me to correlate your IP address with your hidden service.

Long story short: Don't run a relay on the same instance of Tor as you run your hidden service.

Example of tracking hidden services

In addition to being able to be tracked generally by a HSDir relay, you can be targeted more directly by a determined and powerful opponent because they can maintain the connection to your hidden service and they can pull a lot of bandwidth through the network separately to observe where things slow down when they are hitting your hidden service hard.

IceyEC
  • 1,495
  • 1
  • 14
  • 22