Introduce support for Single Onion Service

[fpietrosanti]

Tor is now supporting Single Onion Service as a way to enable: a. Secure transport using OR protocol in-place of TLS b. Denial of Service Resiliency c. Much better performance in terms of reachability, latency and troughput

but without the "Location Anonymity" of commonly known "Tor Hidden Services".

Ref: https://lists.torproject.org/pipermail/tor-dev/2016-October/011541.html

This ticket is to introduce support in GlobaLeaks for Single Onion Service as a configuration settings, enabling the Onion Service as a default transport along with HTTPS.

With this ticket the proposal is to have Single Onion Service by default, giving the option to increase the security enabling "Location Anonymity" from the web interface (and in the wizard) as a specific security improvement.

[evilaliv3]

Finally!

As by the changelog this i now included in the tor alpha version for 0.2.9 (https://blog.torproject.org/blog/tor-0293-alpha-released-important-fixes) the two settings to be applied are:

HiddenServiceSingleHopMode 1
HiddenServiceNonAnonymousMode 1

@meejah would this configuration being doable with txtorcon by using the TCPHiddenServiceEndpoint of version 0.14.2? we could use only this version because it is the only one included in ubuntu xenial / debian stretch

[fpietrosanti]

Imho the relevant point is to include by default Tor onion service transport because of the security/encryption property of OR protocol, making the "location anonymity" property an extended feature that an admin may wish to enable in a opt-in way.

Thinking generally that if we re-work a bit / communicate in a different way the different functionalities provided by Tor in a "security oriented" rather than an "anonymity oriented" way, it could be easier to push it as a standard technology also in institutional/enterprise environment.

[evilaliv3]

i agree.

this could be communicated in the wizard with some presets guiding the user on the differences.

[meejah]

You can't include arbitrary options in the endpoint-strings, but you can change any valid Tor option via a TorConfig instance either after the fact or before you call .listen on the endpoint.

If you're using TCPHiddenServiceEndpoint.global_tor(...) then you can get the corresponding config object (either before or after you've made the endpoint) via .get_global_tor() and then change any config options and call .save(). "Global" in this case means to the python process.

[meejah]

p.s. if you're using serverFromString("onion:...") you're using global_tor under the hood