Global discovery server as Onion Service

It would improve the resilience of the network if our global discovery server would also be reachable as a Tor Onion Service. This would allow users to circumvent states from blocking access which already happened previously.

From the clients perspective there’s not much to do as the discovery server is already configurable and Syncthing supports Tors SOCKS5 proxy. It would be enough to create the service and document how to access it.

In the long run a decentralized approach would be the best solution:

But for now it would improve things without too much effort.

1 Like

This doesn’t make much sense to me, as discovery is there to find ip address you can connect to.

If you reach discovery via onion network, the discovery server will see some non-sense ip address, and advertise that.

This would also require listening on the tor network, whatever that even means.

Of course that doesn’t make sense for the announcement part. But strictly just for discovery, asking for other devices’ addresses, it would help. So only one device must be able to contact the discosrv directly.

As for the announced addresses, we also send LAN IPs to the discosrv and probably whatever STUN happened to find, so even that part would be helpful without having a usable source IP address on the Tor connection. Maybe we could add a flag in the announcement that the source IP should not be recorded, which gets set when the discosrv connection is made via Tor?

From my admittedly very limited understanding of Tor and Onions this seems like it would be a lethally dangerous thing to implement. Aren’t most unmasking attacks against Tor users about correlating traffic within the Tor network with traffic outside the Tor network? And aren’t Onion services about hiding the service provider, which we’re not particularly interested in?

Whereas if a user sends all their traffic through Tor, things should just work (apart from incoming connections of course).

The filtering for the announcement is pretty easy as the request would originate from the server itself Tor proxy -> discovery service. So it would be enough to drop announcements for and ::1

As for the security of the users: the requests never leaves the Onion network. This kind of attack would only work if an Exit Node is passed. e.g trying to open a public website via Tor.

Routing everything via Tor would certainly slow things down. Tor is not really suitable for that.

Others also offer onion services to bypass blocks:

I’m not sure I understand the point then. You talk to the discovery server via the onion network. It gives you an IP address to talk to. Then what?

Edit: I re-read the OP and understood that you’re after resilience against blocking. That’s … something, I guess. Not something I’m interested in spending any effort on, but it’s a point.