Let's imagine that your local newspaper decides to set up an Onion Service (using SecureDrop) to receive anonymous tips.Īs the first step in the protocol, the Onion Service will contact a bunch of Tor relays and ask them to act as its introduction points by establishing long-term circuits to them. Here is a detailed breakdown of how this happens: Act 1: Where the Onion Service sets up its introduction points The Onion Service protocol uses the Tor network so that the client can introduce itself to the service, and then set up a rendezvous point with the service over the Tor network. That's one of the reasons we can achieve the security properties above. This looks weird and random because it's the identity public key of the Onion Service. In particular, an Onion Service's address looks like this: vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion Usually, people connect to an IP address and are done, but how can you connect to something that does not have an IP address? Now the question becomes what kind of protocol is needed to achieve all these properties? They only establish outgoing connections.

Onion services don't need open ports because they punch through NAT. This could happen if you are in a university campus, an office, an airport, or pretty much anywhere. Is your network filtered and you can't open ports on your firewall? This is like getting strong SSL/HTTPS for free. Onion service traffic is encrypted from the client to the onion host.

Usually, reaching a website does not mean that a man-in-the-middle did not reroute to some other location (e.g. No impersonation is possible, which is generally not the case. When a user visits a particular onion, they know that the content they are seeing can only come from that particular onion. Onion services are an overlay network on top of TCP/IP, so in some sense IP addresses are not even meaningful to Onion Services: they are not even used in the protocol. Location hidingĪn Onion Service's IP address is protected. Onion services offer various privacy and security benefits to their users. Running an Onion Service gives your users all the security of HTTPS with the added privacy benefits of Tor Browser. Onion services are services that can only be accessed over Tor.

Tor onion router.