I have a theoretical question. Imagine we have a person Bob that is hosting a website on IP X and port Y. Bob advertises his website on the TOR network so that nobody can find out his original IP (assuming that the messages cannot be traced of course).

Question: What would happen if I did a HTTP request to IP X on port Y without using TOR. Would I be able to access the website normally or is there some special encryption / authentication being done to prevent people from outside TOR to access the website?

Thanks in advance!

  • I honestly don't know much about TOR but saw that Wikileaks has some basic instructions on how to begin using it. See wikileaks.org/#submit Sep 18 '16 at 16:22

This all had to do with how well the person running the site has it secured. Generally you would want to run a site bind only to localhost. The environment should firewall it from making outbound or inbound connections except over tor. This is to mitigate any kind of attacks either network or application level - if the server is compromised it shouldn't be able to be dialed directly or dial home directly.

Note that this is only to protect the server, and does not necessarily keep the client unknown and secure. There are plenty of gateway services like http://onion.to available to let a layperson use tor sites. much of today's ransomware depends on such services.

  • Thanks!:P This is what I wanted to know. If you bind something to localhost it can only be accessed by TOR? Or do I misunderstand something? Sep 18 '16 at 21:20

No. It's bound to localhost. Through Tor your basically connecting to it like a VPN.

From the configuration window, you’ll need to set the “Server DNS Entry” box to >“localhost” to bind Savant to localhost. This ensures your website is only >accessible from your local computer, so people can’t access it over the normal >Web and see you’re hosting the hidden service Tor site.

From how to create a tor hidden service

Not the answer you're looking for? Browse other questions tagged or ask your own question.