I think Tor has a bad reputation because a lot of bad people use it for a lot of bad things. Technically, it's true; from money laundering schemes to child pornography, illegal and morally wrong content is readily available for those that know where to look.
But just because that kind of content is made available through Tor doesn't mean that Tor is a horrible technology. Rather, it is quite the opposite. Tor enables a lot of people to avoid censorship in a lot of countries. Some Onion services even bring the Bible to countries in which it is illegal to own a copy.
In this post, I'm not going to talk about the social aspects of Tor though; I want to analyze it from a purely technical perspective. For a privacy-oriented, and self-hosting person like me, what advantages does Tor offer? And what are the costs?
First, I think the biggest advantage is that Tor is far more decentralized than the regular internet. Granted, it's not totally decentralized, perhaps not as much as I'd like, but it is so much easier for someone to run an Onion service than it is for him to run a normal website. The fact is, there's no DNS, which means that I don't have to pay yearly to maintain a domain name. Additionally, I don't need to deal with TLS certificates, because Tor is encrypted and anonymous at the network level. These features mean that the barrier for entry into the Tor network is pretty much non-existent. Just fire up your Tor client and a web server, and you've got yourself a hidden service.
Now, a lack of DNS and TLS make things cheaper, certainly, and to an extent less centralized, but I think what makes Tor really shine is the fact that it runs even through NAT. In fact it actually doesn't care about NAT at all. I can run a .onion web server on my laptop from behind my school's network, and people that connect to it won't be able to differentiate that from any other .onion. With Tor, I don't need a static IP address 1 or even a public IP address at all! As long as I have a gateway to the internet, I can run an Onion service.
That brings me to another advantage, which is that Tor is relatively anonymous. Even if you share information like your name and beliefs, which is what I'm doing on my website, my IP address is not exposed at all, or I might not even have a public IP address, making it so much harder to find out where my server is physically located, should someone want to physically locate it.
Now, the obvious disadvantages are that Tor is slow, and discoverability is pretty much non-existent by design. If I move to a Tor-only server, it'll pretty much be impossible for people to find me, unless I plaster my .onion all over the internet—something that if I can do safely, I might just do. Otherwise, my server then becomes just for my family and friends, because nobody else will be able to find it unless I tell them.
Realistically, what I'll do in the long-term is redirect my domain to a VPS out in the cloud somewhere (ideally a free one) and then have it show a static page instructing visitors that I moved to Tor. I'll provide download links for the Tor browser, as well as my .onion address. This way, I'm still discoverable from the internet, but no IP address can be traced back to me.
Eventually, when I no longer need an email address or a public Matrix server, I'll stop paying for my domain and then just use a free dynamic DNS provider and point that at the VPS. That way, I'll have no money in the centralized internet. Instead, I'll be investing my money in a high-bandwidth internet connection to run a Tor relay, something which should help speed up the Tor network a little bit.
Another disadvantage is that Tor relies on relatively few backbone nodes that, if compromised, would severely damage the security of the Tor network. However, given the advantages, I think this is a reasonable compromise to make, because it enables Tor to work behind NAT, and it's no worse than how the actual internet functions anyway. At the end of the day, Tor just depends on a different—hopefully more security-focused—group of servers and people to run it, and I'm okay with that. I really like the idea of a truly peer-to-peer internet, but that's hard to to properly and securely, and it also requirely publicly-routable IP addresses, something that is getting more and more scarce every day. Additionally, even if you can get your hands on a public IP address, you have to make sure it's static, and you're at the mercy of your ISP for both of those things. Tor doesn't care about what the ISP does at all. The ISP could NAT customers 5 times, and rotate their internal IP address every hour, and Tor wouldn't care, as long as there's a way to the internet.
That being said, Tor is easy to block, since all the nodes themselves are public information. My university, for example, could block all the Tor entry nodes, preventing me from connecting. If that happens, I could always run a bridge on my own personal network, provided I can get to it. If I can't, well, then I'll consider the internet totally collapsed, and not worth using anymore.
Tor is not easy to censor though. The regular internet can easily be censored. Google can stop showing search results, for example. But other than blocking Tor users completely, it is impossible to prevent Tor users from using the network as they please.
Because of the security and convenience features that Tor offers, it is my goal to eventually stop having to rely on my ISP to provide me a public IP address, my DNS provider to provide me with a DNS name, and LetsEncrypt to provide me with TLS certificates. If I can eliminate all of those things, I'll be a lot closer to being fully independent on the internet. The only things I will depend on is my ISP to let me connect to Tor, and Tor. That is very appealing to me, and it saves me money and effort as well.
I'm all about reducing my dependency on third-party services, so if I can drop my list of third-parties that I depend on down from this:
Down to this:
I see that as a step in the right direction. Tor doesn't have to be used only for illegal activity. From a technical perspective, Tor has a number of advantages for server administrators. Yes, it makes accessing my server a bit more difficult, but the convenience advantages I get from it, to me, are worth it, even setting the security advantages aside.
Something I don't even have as it is; I use a shell script running on a cron job to update my DNS records via my provider's API. That's pretty annoying and prone to break, so if I could get rid of that, I'd enjoy that. ↩
© 2019-2024 Jordan Bancino.