Re: [tor-onions] Connection to a hidden service with a RFC 6455 web-socket - advice on risks please

2018-03-07 Thread Michael Jonker
Thanks to all for the wealth of valuable information I have received. I am officially a onion service believer now, and my understanding has grown exponentially! On 06/03/18 19:38, Roger Dingledine wrote: On Tue, Mar 06, 2018 at 07:27:32PM +, Michael Jonker wrote: They have asked me to

Re: [tor-onions] Connection to a hidden service with a RFC 6455 web-socket - advice on risks please

2018-03-06 Thread Roger Dingledine
On Tue, Mar 06, 2018 at 07:27:32PM +, Michael Jonker wrote: > They have asked me to ask here also if, when connected to a hidden service, > the circuit becomes "dirty" after default 10 minutes and resets? No, onion services use the opposite logic: once you open a circuit to the onion service,

Re: [tor-onions] Connection to a hidden service with a RFC 6455 web-socket - advice on risks please

2018-03-06 Thread Michael Jonker
Thanks Alec, I am wrapping my head around alot at the moment, yesterday was the first day I had an onion service! I am passing the information and links you have provided back to the Bisq network engineers (this is unfortunately not where I am at). They have asked me to ask here also if, w

Re: [tor-onions] Connection to a hidden service with a RFC 6455 web-socket - advice on risks please

2018-03-06 Thread Alec Muffett
On 6 March 2018 at 17:54, Michael Jonker wrote: > 2) Bisq 's infrastructural backbone runs as a P2P network over TOR > network. Clients talk to each other and there are various hidden services > providing network resources. > At the risk of blowing my own trumpet, I tried writing up suggestion

Re: [tor-onions] Connection to a hidden service with a RFC 6455 web-socket - advice on risks please

2018-03-06 Thread Michael Jonker
Thanks Tom and Alec, I am working on a UX architecture for the Bisq Project [https://bisq.network/]. This is a decentralised P2P crypto / fiat exchange. The threat model is two-fold: 1) A real time event driven MVC for a GUI front-end to a remote API over TOR hidden service. The client own

Re: [tor-onions] Connection to a hidden service with a RFC 6455 web-socket - advice on risks please

2018-03-06 Thread Tom Ritter
On 6 March 2018 at 10:55, Michael Jonker wrote: > 2) Am I perpetrating a security anti-pattern by holding the connection open > indeterminately? Unless I'm missing something: no more so leaving a modern web application tab (Facebook, gmail) open indefinitely. Which is to say, WebSockets, Faceboo

Re: [tor-onions] Connection to a hidden service with a RFC 6455 web-socket - advice on risks please

2018-03-06 Thread Alec Muffett
On 6 March 2018 at 16:55, Michael Jonker wrote: > I have connected to my hidden service with RFC 6455 web-socket and feel > like a kid in a candy store streaming API requests and return data back and > forth at good, reliable speeds. Yay! Good to hear news of new successes. I found websockets