Tor Project Blog
blog.torproject.org · Company blog · on HN since 2009
The Tor Project's official blog covers the anonymity network, Tor Browser, security advisories, and privacy tools.
What HN saysCommenters link it for practical guides, like running an exit node, and for features such as the Tor Uplift project and Arti advice.
465HN people shared it
291linked it in comments
532stories submitted
20Kstory points
3 months agolast shared
2009people per year2026
Most-shared posts
- 1Tor security advisory: “relay early” traffic confirmation attack12 people · 239 points · first shared 2014 · 45 comments on HN
- 2Bittorrent over Tor isn't a good idea12 people · 81 points · first shared 2011 · 19 comments on HN
- 3Deterministic Builds Part One: Cyberwar and Global Compromise12 people · 28 points · first shared 2013 · discussion on HN
- 4Mission Impossible: Hardening Android for Security and Privacy11 people · 69 points · first shared 2014 · 14 comments on HN
- 5The Trouble with CloudFlare9 people · 620 points · first shared 2016 · 351 comments on HN
- 6Tor Deterministic Builds: Technical Details8 people · 2 points · first shared 2013 · discussion on HN
- 7Proof-of-Work Defense for Onion Services7 people · 20 points · first shared 2023 · 2 comments on HN
- 8BitTorrent over Tor isn't a good idea (2010)7 people · 2 points · first shared 2017 · discussion on HN
- 9Tips running exit node minimal harassment7 people · first shared 2009
- 10Trouble cloudflare7 people · first shared 2018
- 11Tips running exit node7 people · first shared 2019
- 12Facebook, hidden services, and https certs6 people · 24 points · first shared 2014 · 1 comments on HN
- 13Tor project refutes Black Hat talk a day before it happens6 people · 2 points · first shared 2009 · discussion on HN
- 14Running exit node6 people · first shared 2012
- 15How to handle millions of new Tor clients5 people · 129 points · first shared 2013 · 29 comments on HN
What HN people wrote when they linked it
ahmibrme · 2025-12-12
Tor provides a great blog about running an exit node: https://blog.torproject.org/tips-running-exit-node/
I remember reading that it’s better to register as an organization if you want to run an exit node.
If you want to help the network, you can run relays. That’s much safer. https://community.torproject.org/relay/
duskwuff · 2025-08-02
> That doesn't prove he'd never use AI, but it does mean it's not some random blogger trying to sell their reputation for cheap karma before anyone notices.
It wouldn't be the first time I've seen a formerly reputable web site start churning out AI slop, unfortunately. And, for what it's worth, this other article on the site, published a few days ago, doesn't fill me with confidence either:
https://www.linuxjournal.com/content/veil-vigilance-tails-60s-new-fron…
It's mostly a paraphrase of the official release notes (https://blog.torproject.org/new-release-tails-60/), and it's over a year late - Tails 6.0 was released in February 2024. Even if it's human-written, it's a weird topic to choose and an extremely lazy way to write about it.
mzajc · 2025-02-28
Worth noting is that many of these features come from the Tor Uplift project[0]. I'm not sure if they'd exist if it weren't for Tor's work.
[0]: https://blog.torproject.org/tor-browser-advancing-privacy-innovation/
medo-bear · 2024-05-01
I dont understand why my other comment was flagged. The Tor Project does not reccomend using Arti just yet. If you think that is outdated see the following article published on 04.03.24, which also states the following
There are still some rough edges and missing security features, so we don't (yet) recommend Arti onion services for production use, or for any purpose that requires privacy. https://blog.torproject.org/arti_1_2_0_released/
coppsilgold · 2023-12-24
In general, tunneling through HTTP2 turns out to be a great choice. There is an RPC protocol built on top of HTTP2: gRPC[1].
This is because HTTP2 is great at exploiting a TCP connection to transmit and receive multiple data structures concurrently - multiplexing.
There may not be a reason to use HTTP3 however, as QUIC already provides multiplexing.
I expect that in the future most communications will be over encrypted HTTP2 and QUIC simply because middlebox creators can not resist to discriminate. It may even be necessary to serve some random (perhaps AI generated) HTTP2/HTTP3 content to mitigate active probing[2].
[1] <https://grpc.io>
[2] <https://blog.torproject.org/learning-more-about-gfws-active-probing-sy…
LinuxBender · 2023-07-10
Others will add the technical reasons that doing so is best practice but I would just add that if one does not want skeptical visitors then HTTPS must be used to avoid browser warnings. Most browsers today will warn the visitor something is wrong if using unencrypted HTTP as a matter of covering the lowest common denominators and not trying to guess if a site has sensitive data. With exception of Tor hidden sites, the days of unencrypted HTTP are behind us and even that exception may get covered should LetsEncrypt decide to handle .onion similar to Harica [1]
[1] - https://blog.torproject.org/tls-certificate-for-onion-site/
Trouble_007 · 2022-11-25
The Tor Project - @torproject - Nov 15th
The changelog for our latest Tor Browser Alpha release is huge,
which means now's a great time to volunteer to become an alpha tester!
: https://blog.torproject.org/new-alpha-release-tor-browser-120a4/
: https://community.torproject.org/user-research/become-tester/
Here are some ideas for what to test. (see below)
The Tor Project - Twitter : https://twitter.com/torproject/status/1592660091119226881
The Tor Project - Nitter : https://nitter.net/torproject/status/1592660091119226881
makerofspoons · 2022-07-19
When you use a Tor hidden service you don't use an exit node, your connection ends within the Tor network. As for the internal communication attack there is no reason at the time of writing to believe one has occurred, and it's unclear if their statistical attack on Tor's crypto would work or if it is possible: https://blog.torproject.org/rumors-tors-compromise-are-greatly-exagger…
terramex · 2022-07-17
Tor Project recommends using Onion Browser in iOS: https://support.torproject.org/tormobile/tormobile-3/
> Can I run Tor Browser on an iOS device?
> We recommend an iOS app called Onion Browser, which is open source, uses Tor routing, and is developed by someone who works closely with the Tor Project. However, Apple requires browsers on iOS to use something called Webkit, which prevents Onion Browser from having the same privacy protections as Tor Browser.
And here is old post (2016) about it on Tor Project blog: https://blog.torproject.org/tor-heart-onion-browser-and-more-ios-tor/
WallyFunk · 2022-01-29
https://blog.torproject.org/tor-browser-advancing-privacy-innovation/s…
`Other reasons`. Would love to know other use-cases for Tor Browser Bundle besides the ones mentioned in the info-graphic. One other reason not mentioned is recon and intelligence gathering, or OSINT. I do little investigations on various topics, safe in the knowledge I'm anonymous doing so. Need to lookup about erectile dysfunction? (ED). Then Tor's perfect for that.
superkuh · 2021-12-21
Tor in 20202: We've succesfully killed off 90% of all actually used (as opposed to botnet) tor onion services and we're happy about it. We're protecting our end users from themselves by forcing the removal of Tor v2 protocol from the codebase. We don't care because onion services were never really something we cared about, just an add-on to trick people into thinking Tor was a real network worth building a community in. It isn't. Tor is only for people who want a pseudoanonymous clear web proxy. Forget .onion domains.
https://www.darkowl.com/blog-content/tor-v2-depreciation-shifts-darkne…
https://blog.torproject.org/v2-deprecation-timeline/
https://metrics.torproject.org/hidserv-dir-onions-seen.html
akadruid1 · 2021-05-10
Given the sizable investment of time and money required to run and independent exit node, it might be worth considering throwing your support behind one of the existing non-profits providing exit nodes
https://blog.torproject.org/support-tor-network-donate-exit-node-provi…
https://2019.www.torproject.org/docs/faq#RelayDonations
Bucephalus355 · 2021-01-09
I can't comment on all parts of Voice of America, but Ultrasurf and Dynamic Internet Technology have been a fraud for some time [1].
The Tor Project had a wonderful review some years ago where they showed how preposterous it was to expect to challenge "The Great Firewall" with these tools [2].
[1] - http://ultrasurf.us and http://dit-inc.us
[2] - https://blog.torproject.org/ultrasurf-definitive-review
class4behavior · 2019-10-24
>Like, how do I know any of those links aren't the NSA?
Well, I've only linked to communities listed by the Tor Project itself.
Otherwise, the same way you would check whether HN or your local tea store is the NSA. You do your own research, run your own risk analysis, and if you want to stay sane, by default you give people the benefit of the doubt.
Generally, it's best not to run Tor relays from home as services will start to blacklist your IP as a proxy.
If you are going to be an exit node, then you should inform yourself about he legal challenges you might face, since you don't know what people will access with your IP address.
https://blog.torproject.org/tips-running-exit-node
https://www.eff.org/torchallenge/faq.html
Being an entry or middle-level node is less of a problem but some uncertainties remain, so this depends on your local laws.
bureaucrat · 2019-09-23
Simple. Imagine you are using tor and one of the relay has problems(unstable, high latency or packet loss). You don’t know which of the 3 hops failed. We have no option but to build a new circuit and we don’t want that. That’s why tor needs stable, trustworthy relays.
From tor blog:
A new relay, assuming it is reliable and has plenty of bandwidth, goes through four phases: the unmeasured phase (days 0-3) where it gets roughly no use, the remote-measurement phase (days 3-8) where load starts to increase, the ramp-up guard phase (days 8-68) where load counterintuitively drops and then rises higher, and the steady-state guard phase (days 68+).
https://blog.torproject.org/lifecycle-new-relay
cmg · 2019-06-23
I believe that Onion Browser is the recommended app: https://apps.apple.com/us/app/onion-browser/id519296448
Some discussion and notes from the Tor Project blog: https://blog.torproject.org/tor-heart-onion-browser-and-more-ios-tor
tgragnato · 2019-05-30
I was looking for the name of the CAP theorem, thanks for posting this!
HN discussed (https://news.ycombinator.com/item?id=14038013) about the issue and the post (https://blog.torproject.org/cooking-onions-names-your-onions) outlines some of the ways in which you can mitigate right now.
Cloudflare is using the 'alt-svc' header (https://blog.cloudflare.com/cloudflare-onion-service/).. The CIA is not, I'd have loved it.
curl -I https://www.cia.gov/index.html
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/html
ETag: "<>"
Last-Modified: Tue, 28 May 2019 15:05:25 GMT
Content-Length: <>
ID: <>
SESSION: <>
Date: Thu, 30 May 2019 12:36<> GMT
Connection: keep-alive
Set-Cookie: _session_=<>; path=/; domain=cia.gov; secure; HttpOnly
ID: <>
SESSION: <>
kodablah · 2018-11-22
> At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki
30% is wrong, but there are other ways these metrics [0] are extrapolated [1]. You can see a dip in that first chart, didn't check dates to see if related.
0 - https://metrics.torproject.org/hidserv-dir-onions-seen.html
1 - https://blog.torproject.org/some-statistics-about-onions
bcaa7f3a8bbc · 2018-05-25
Thanks for running a Tor relay, even better, Tor relays! Please consider to check the right sidebar for new versions on https://blog.torproject.org/, add Debian repos from Tor Project instead of using default repo, and read [tor-relays]* mailing list routinely. It's a fun read comparable to Hacker News, well, sometimes.
* https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
jerheinze · 2017-10-27
It's in their works, see their proposal 279: https://gitweb.torproject.org/torspec.git/tree/proposals/279-naming-la…
As well as this blog post: https://blog.torproject.org/cooking-onions-names-your-onions
See also this ticket for following the progress: https://trac.torproject.org/projects/tor/ticket/10747
dublinben · 2017-05-16
I recommend reading the linked blog post about it. [0]
[0] https://blog.torproject.org/blog/selfrando-q-and-georg-koppen
There is also a research paper [1] and accompanying video [2].
[1] https://people.torproject.org/~gk/misc/Selfrando-Tor-Browser.pdf
[2] https://www.youtube.com/watch?v=IikpczzNyas
cmdrfred · 2017-02-06
Obfsproxy can get around the great firewall of China's DPI. I assume it would work for this use case.
I imagine this would work in the same manner as long distance cards back in the day. The VPN provider would buy "fast lane" access and sell connections to it's users.
https://blog.torproject.org/blog/obfsproxy-next-step-censorship-arms-r…
zmanian · 2016-10-07
Netflow is a great example of the dual use aspects of tech between surveillance and defense. Making Netflow data more widely available looks like it is going to be essential for defending that Internet but at the same time Netflow data can threaten the anonymity of Tor users.[0][1]
[0] https://blog.torproject.org/blog/traffic-correlation-using-netflows
[1] https://gitweb.torproject.org/torspec.git/tree/proposals/251-netflow-p…
pfg · 2016-10-02
> And btw you shouldn't let your extensions auto-update on Firefox anyway, specially if you use Tor, as it's vulnerable to MITM as someone posted here a few days ago.
This was fixed in Tor Browser 6.0.5[1] and Firefox 49[2]. Worth noting that the attack required a publicly-trusted certificate for addons.mozilla.org, which makes this a bit harder than just a run-of-the-mill MitM attack, though certainly possible for nation-state actors and the likes.
[1]: https://blog.torproject.org/blog/tor-browser-605-released
[2]: https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/
mapgrep · 2016-04-22
Interestingly, since Onion addresses are derived from the public key of the host server, Facebook had to basically brute force this address.
The process is described in "Part three" here: https://blog.torproject.org/blog/facebook-hidden-services-and-https-ce…
"The short answer is that for the first half of it ('facebook'), which is only 40 bits, they generated keys over and over until they got some keys whose first 40 bits of the hash matched the string they wanted."
"Then they had some keys whose name started with 'facebook', and they looked at the second half of each of them to pick out the ones with pronouncable and thus memorable syllables. The 'corewwwi' one looked best to them — meaning they could come up with a story about why that's a reasonable name for Facebook to use — so they went with it."
(Corrected: Hash of public key not private key per itsbenweeks below)
lazyjones · 2016-03-23
I'm not an expert on Tor code, so I can only speculate and agree partly with you: it matters where it is used. But temporary keys do not necessarily help against an attacker who has access to all/most past Tor traffic. RSA-1024 is used in node identification and hidden services, the weaknesses are known:
https://blog.torproject.org/blog/prism-vs-tor
https://blog.torproject.org/blog/hidden-services-need-some-love
(note: current state of affairs unknown to me since Tor doesn't seem to update these documents)
ijktdot · 2015-09-21
Torblog has a recent (Sep 2015) write up on how the great firewall detects and kills Tor connections/bridges hence the need for using Obfsproxy4 as a pluggable transport https://blog.torproject.org/blog/learning-more-about-gfws-active-probi…
mirimir · 2015-05-01
Best practice here is using a WiFi-only device with a separate cell modem. So you have hardware baseband isolation. See <https://blog.torproject.org/blog/mission-impossible-hardening-android-…
ChrisAntaki · 2014-09-29
Tor has been exploited in the past in ways which only affected those who kept JavaScript enabled [1]. I actually love JavaScript, and the doors it can open for trustworthy developers, but I don't think a deep cover journalist or whistleblower should be browsing with it.
[1] https://blog.torproject.org/blog/tor-security-advisory-old-tor-browser…
taeric · 2014-07-11
I'm curious on the theoretical basis of this effort. I'm reminded of "On Trusting Trust." Simply put, not at all an easy problem to try and tackle.
No, I'm not against trying. Just going from your thing, I'm not sure what is being aimed at. Specifically, would a "deterministic" build really help much?
edit: I am perusing https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwa… and https://blog.torproject.org/blog/deterministic-builds-part-two-technic… Good reads so far.