Onion service interaction

Overview

The Tor anonymity network is primarily known as a tool that enables client anonymity. Users can download Tor Browser to browse the web anonymously, making it harder for governments, corporations, and individuals to monitor their browsing activity. In addition to client anonymity, the Tor network provides server anonymity in the form of onion services (a.k.a. hidden services) which allow operators to expose a TCP service while hiding its IP address. Several popular web sites have now set up corresponding onion services, including DuckDuckGo, ProPublica, The New York Times, and Facebook.

Onion services differ from normal web services in several aspects; for example in their unusual domain format (an example is expyuzz4wqqyqhjn.onion, The Tor Project's onion site) and in the way users discover new onion services. In this research project, we are trying to understand how users deal with these differences by administering a survey to Tor users and by conducting a series of semi-structured interviews. A sound understanding of how users interact with onion services will allow privacy engineers to both improve onion service usability and better protect Tor users from surveillance, censorship, and other attacks.

Writing

• How Do Tor Users Interact With Onion Services?
  P. Winter, A. Edmundson, L. M. Roberts, A. Dutkowska-Żuk, M. Chetty, and N. Feamster
  In Proc. of USENIX Security Symposium, August 2018
• Presentation given at the DPRIVE'18 workshop.
• Relevant discussions on the tor-dev@ mailing list:
  • Oct 2017: Perceived safety of Tor Browser and onion services
  • Oct 2017: User perception of onion service discovery
  • Sep 2017: User perception of the prop224 domain format

Code and data

You can find more information about our project and some code in our GitHub repository:

git clone https://github.com/citp/onion-service-usability.git

Data complementary to our work is available below.

• Survey questions that were part of our online survey.
• Pre-interview survey that allowed us to screen interview participants.
• Interview checklist that we used as guide for our semi-structured interviews.
• Adult consent form that we asked our participants to sign before the interview.
• Mental models for Tor and onion services

Contact

We are a team of computer scientists from Princeton University. If you have any questions please send an email to Philipp: phw@nymity.ch

• Marshini Chetty
• Agnieszka Dutkowska-Żuk
• Annie Edmundson
• Nick Feamster
• Laura M. Roberts
• Philipp Winter

Acknowledgements

This research was supported by the Center for Information Technology Policy at Princeton University and by the National Science Foundation Awards CNS-1540066, CNS-1602399, CNS-1664786, and

Last update: 2018-07-10