investigate and implement improvements to header-based tor2web detection for current active tor2web proxies #6293
Comments
Tor2Web mangles onion URLs to point to the proxy, but its implementation
is a buggy and we can use that for detection. In this case, it rewrites
a literal `href="fake.onion"` (inside a hidden form <input>) to something
like: `href="//{$address}.onion.ly/fake.onion.ly"`. On form submission,
we can detect that it doesn't roundtrip properly and flag the mangling as
Tor2Web usage.
Fixes #6293.
Tor2Web mangles onion URLs to point to the proxy, but its implementation
is a buggy and we can use that for detection. In this case, it rewrites
a literal `href="fake.onion"` (inside a hidden form <input>) to something
like: `href="//{$address}.onion.ly/fake.onion.ly"`. On form submission,
we can detect that it doesn't roundtrip properly and flag the mangling as
Tor2Web usage.
Fixes #6293.
|
From poking at it a bit and reviewing the tor2web source code, I came up with #6304, which relies on buggy URL mangling on the |
|
This is really neat - I'm trying to think of downsides to converting the Get Started button to a POSTed form but none spring to mind. Does it detect tor2web specifically tho, or any proxy that rewrites links? Both are bad, but we might need to make the language more general on the warning page in the latter case. It would still be good to detect tor2web via headers if possible. It has fewer UX implications and it could happen on the first connection. But this is a great extra defense. |
|
Oh my, I love this! I don't think there's downsides to a
Given that it's based on a |
|
The rewrites that tor2web do are pretty naive, it's entirely possible that it becomes more robust in the future (e.g. using a proper HTML parser) and we need some other detection mechanism. I think this should catch any similarly naive proxy that wants to make onion services accessible on the clearnet, because they have to hijack any *.onion URL. |
Tor2Web mangles onion URLs to point to the proxy, but its implementation
is a buggy and we can use that for detection. In this case, it rewrites
a literal `href="fake.onion"` (inside a hidden form <input>) to something
like: `href="//{$address}.onion.ly/fake.onion.ly"`. On form submission,
we can detect that it doesn't roundtrip properly and flag the mangling as
Tor2Web usage.
Fixes #6293.
Tor2Web mangles onion URLs to point to the proxy, but its implementation
is a buggy and we can use that for detection. In this case, it rewrites
a literal `href="fake.onion"` (inside a hidden form <input>) to
something like: `href="//{$address}.onion.ly/fake.onion.ly"`. On form
submission, we can detect that it doesn't roundtrip properly and flag
the mangling as Tor2Web usage.
Since we want to show users the error as soon as possible, we turn the
initial "Get started" button link into a <form> with this special hidden
<input> that POSTs to `/generate`, which will check if Tor2Web mangles
the field and display the warning accordingly.
Fixes #6293.
Tor2Web mangles onion URLs to point to the proxy, but its implementation
is a buggy and we can use that for detection. In this case, it rewrites
a literal `href="fake.onion"` (inside a hidden form <input>) to
something like: `href="//{$address}.onion.ly/fake.onion.ly"`. On form
submission, we can detect that it doesn't roundtrip properly and flag
the mangling as Tor2Web usage.
Since we want to show users the error as soon as possible, we turn the
initial "Get started" button link into a <form> with this special hidden
<input> that POSTs to `/generate`, which will check if Tor2Web mangles
the field and display the warning accordingly.
Fixes #6293.
Tor2Web mangles onion URLs to point to the proxy, but its implementation
is buggy and we can use that for detection. In this case, it rewrites
a literal `href="fake.onion"` (inside a hidden form <input>) to
something like: `href="//{$address}.onion.ly/fake.onion.ly"`. On form
submission, we can detect that it doesn't roundtrip properly and flag
the mangling as Tor2Web usage.
Since we want to show users the error as soon as possible, we turn the
initial "Get started" button link into a <form> with this special hidden
<input> that POSTs to `/generate`, which will check if Tor2Web mangles
the field and display the warning accordingly.
Fixes #6293.
No description provided.
The text was updated successfully, but these errors were encountered: