onion services are vulnerable to a resource exhaustion attack that Tor can't patch

Comments · 303

• CH

  @chawrx3 · 7 months ago · pinned

  couldnt end rush be solved by:<br>1) validating the difficulty of puzzles that are being solved. why are clients solving high difficulty puzzles when im only asking for easy ones? <br>2) poll more frequently and take the average. check the queue every 10 sec for example, and determine if the server is <b>sustaining</b> high load.<br><br>for temp-turmoil:<br>correct me if im wrong. the server receives a request with a lower difficulty that the server set. why is it not simply ignored? and wouldnt a calculation change from &quot;total difficulty of ALL requests&quot; &gt; &quot;total difficulty of requests processed&quot; solve this?

  231

• SY

  @Sypaka · 6 months ago

  Alternate title of video: &quot;How I turned TOR nodes into Pseudo-Bitcoin miners.&quot;

  140

• TH

  @THATCANADIANDUDE682 · 6 months ago

  This feels like a pipeline leak detection issue in digital form.

  40

• TH

  @TheCriticalCanary · 7 months ago

  Love your videos man. I got into cyber sec late, wasted my 20s doing nothing useful. and although i have learned a lot in the past 4 years, i still have a long way to go to catch up to you guys and having in-depth videos like this really helps me.

  88

• MI

  @milk-it · 6 months ago

  When I ask myself who would commit such an attack on the Tor network, government authorities are first to come to mind. They don&apos;t want privacy. Governments are forcing age and ID verification on the clearweb. Thus, if the darkweb is rendered unusable, then nobody has privacy anymore.

  78

• 7E

  @7eis · 6 months ago

  There&apos;s a teacher hidden in you somewhere, excellent job explaining!

  18

• US

  @user-wk1rn1yy4z · 6 months ago

  I keep imagining the devs at the tor project chucking their laptops out the window &amp; walking down to the bar on the corner.

  34

• L0

  @L0615T1C · 6 months ago

  this makes me want to host my own relay

  90

• 5T

  @5TheWinMC · 6 months ago

  This needs to be more known by the general public! Our privacy is globally disappearing before our very eyes!!

  101

• _Z

  @_zproxy · 6 months ago

  attacker has a data center and has no issues with proof of work

  11

• DA

  @Dark_Dante-Phreaker · 2 months ago

  Wooow man. You have the best tor content I have seen. Keep the technical videos coming. Kudos.

• UF

  @ufdoublee · 7 months ago

  a lot of this went over my head, but keep up the good work!

  7