18

Plain and simple. Should we have a .onion address?

I'm thinking that it would be a great idea if/when we graduate to be able to reach a stack exchange about tor using the tor network, although I feel the SE sysadmins may shoot me in the foot for this (or worse).

4
  • 7
    I would love for SE to become Tor-enabled. But I feel the chance of this actually happening are close to 0.
    – Megan Walker
    Sep 25, 2013 at 20:39
  • 2
    @SamuelWalker I'm going to ask a dev in the mod-room and see if they shoot me
    – Amelia
    Sep 25, 2013 at 20:41
  • 3
    I think most of us agree that the answer is "yes", and the better question is how we can get Stack Exchange to implement it.
    – flamsmark
    Sep 26, 2013 at 0:58
  • Absolutely yes! It would be nice to have less traffic through the exit nodes.
    – David
    Sep 26, 2013 at 3:45

2 Answers 2

Reset to default
12

It would be irrelevant: at the moment loading a tor.stackexchange.com page loads resources from a number of different non-tor services:

  • google, for e.g. jquery, analytics
  • quantcast, analytics
  • cloudflare, static content
  • other parts of the stack exchange network
  • imgur for images included in posts via our uploader
  • gravatar images
  • any other embedded content, e.g. personal images or other files that we may allow

So, you would be scarcely be anonymous here.

On top of this, clearly you need to be logged in to make the best use of the site, like having reputation and privileges.

3
  • So in other words, a significant, not-cheap amount of work would need to go into making tor.stackexchange.com secure, so it's probably best to just treat it like any other site on the Stack Exchange network so folks don't get the impression that they can come here with their "Anonymous" hacker identity and think they're safe. :D)
    – jmort253
    Sep 26, 2013 at 18:12
  • Well, we would need to make our own onion CDN, onion analytics, etc, etc. Not really feasible :-)
    – Sklivvz
    Sep 26, 2013 at 19:26
  • actually there're some analytics scripts that are as good as google ones, so making an onion version will be laborious - yes, but it's not a big problem, actually.
    – Alexey Vesnin Mod
    Jan 24, 2017 at 16:17
7

I'm going to go out on a limb and suggest that Tor isn't a browser we should be using everyday but instead only in very specialized cases where one needs to hide or obscure activities.

Most services out there that we login to would instantly expose our identities just simply because they don't have the level of security to really protect our information. Hence, if I'm going to go check my email, my bank account balances, my Facebook feed, or anything else that personally identifies me, I'm going to use my everyday, normal browser. Thus, if I'm going to participate in Stack Exchange, I'm going to use Google Chrome.

The Tor browser has some pretty specific guidelines for best results: Don't use Flash. Don't use other insecure network resources when using Tor. Don't login to services where your identity is now associated with your browser, browsing session, or IP address. Therefore, it seems reasonable to assume that, since this is a public Q&A site just like any other Stack Exchange Q&A site that must scale with the rest of the network, that such a request would consume resources unnecessarily for very little gain.

In short, I won't be using this site with Tor as that's not really the goal, at least not from my perspective. Hope this helps!

7
  • I mentioned this beta in the blue room, then went "what if it was on tor?!" and made this question. I don't think the sysadmins would be willing to stick part of their network in the tor network on a whim, though.
    – Amelia
    Sep 25, 2013 at 22:12
  • Sure, and it's not a bad question. I'm actually interested to hear what people with way more experience than me have to say, but from my own experience and from what I've seen, most websites out there, even ones you don't login to, will try to give you up right away. Hope this helps clarify.
    – jmort253
    Sep 25, 2013 at 22:15
  • 2
    I disagree with your premise that one should only use tor for things one would want hidden. While I agree that most sites that you could log into would compromise your identity, if you are a careful (enough) Tor user, you could use SE, check your Facebook and email, and then get a new identity when you no longer want to be associated with your identity. Having a lot of people using Tor for things like this would make the entire network more anonymizing in my opinion improving it's functionality for everybody and making global surveillance more difficult.
    – IceyEC
    Sep 26, 2013 at 0:16
  • 2
    I also disagree with the premise. Stack Exchange has no business knowing where I am today, or whether I'm in a different location tomorrow. Even if I want them to know who I am. There are many types of adversaries out there, and just thinking that Tor is for hiding "from" the website is not thinking big enough.
    – Roger Dingledine
    Sep 26, 2013 at 0:27
  • @RogerDingledine - Thanks for weighing in. I just wonder how many people might feel a false sense of security that they can continue to login to all of the normal, everyday services that hold their real identities, such as Facebook, the Gmail account he or she has had for 9 years, and other services tied directly to that persons real, actual identity. I don't believe Tor will hide me on SE, for instance, as I've had this SE account for 2 1/2 years and it's tied to a Google account I've had since 2004. Hope this help clarify.
    – jmort253
    Sep 26, 2013 at 1:07
  • Also, if you operate on that premise, it means no one can know who you are. What's stopping Stack Exchange from hiring a hacker or private investigator to correlate your information here with your personal information somewhere else, should you slip and let something out of the network that exposes your location on some other service?
    – jmort253
    Sep 26, 2013 at 2:19
  • I'm with @RogerDingledine on this one. I talk to the SE devs on a daily basis, so it's not like I think they're likely to go rogue any time soon. The issue I have is with practically every government in the world intercepting all communications for the purposes of "security". Also, SE has uses your oauth identifier, so unless SE itself is targeted, in everyday communications you only deal with an oauth token, not your email address. Also, SE is working on TLS everywhere in the meantime. With your argument, there's never an actual usecase for tor unless you're in China or a whistleblower
    – Amelia
    Sep 26, 2013 at 6:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .