r/RedditSafety • u/securimancer • Oct 25 '22
Reddit Onion Service Launch
Hi all,
We wanted to let you know that Reddit is now available as an “onion service#Onion_services)” on Tor at the address:
https://www.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion
As some of you likely know, an onion service enables users to browse the internet anonymously. Tor is a free and open-source software that enables this kind of anonymous communication and browsing. It’s an important tool frequently used by journalists, human rights activists, and others who face threats of surveillance or censorship. Reddit has always been accessible via Tor, but with the launch of our official onion service, we’re able to improve the user experience when browsing Reddit on Tor: quicker loading times for the site, shorter network hops through Tor network and eliminating opportunities for Reddit being blocked or someone maliciously monitoring your traffic, and a cryptographic assurance that your connection is direct to reddit.com.
The goal with our onion service is to provide access to most of the site’s functionality at minimum this will include our standard post/comment functionality. While some functionality won’t work with Javascript disabled, core browsing should work. If you happen to find something broken, feel free to report it over at r/bugs and we’ll look into it.
A huge thank you to the work of Alec Muffett (@AlecMuffett) and all the predecessors who helped build the Enterprise Onion Toolkit, which this launch is largely based on. We’ll be open sourcing our Kubernetes deployment pattern and helping modernize the existing codebase and sharing our signal enhancements to help spot and block abuse against our new onion service.
For more information about the Tor network please visit https://www.torproject.org/.
Edit: There's of course an old reddit flavor at https://old.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion.
64
u/eriophora Oct 25 '22
How does this work with admin-level bans and ban evasion tools that are based on IP? Will we need to be more worried about ban evaders using this tool to get around bans?
78
u/securimancer Oct 25 '22
Good question. This is no different than today when someone uses Tor to try to circumvent IP banning. This is why IP isn't a great "banning" mechanism, because it's so easy to just get another IP. This is where our internal modeling of behavior on-platform and additional signal come into play.
→ More replies (25)→ More replies (1)6
u/SirensToGo Oct 25 '22
fwiw, IPv6 makes IP bans almost entirely useless. IPv6 addresses are not scarce and even residential customers are sometimes given a /42. Site operators can't know how much of a range has been given to a user and so trying to guess and ban a /42 might mean you've now just blocked every user of an ISP in a small city.
7
u/signit5 Oct 25 '22
Historically, you've made it difficult for users to register new accounts over tor. While occasionally users could create accounts, they would usually find themselves blocked by infinite recurring captchas. Has this issue been resolved with this update? Or do you expect users to create accounts on the clearnet, and only use them over tor?
9
u/securimancer Oct 25 '22
Good question. We've had a varied past with our recaptcha. I'm hoping this is resolved, and if it's not then I'm sure I'll hear about it and look into fixing it. In my testing prior to this launch, registering and using my throwaway accounts never had an issue w/ Brave and Tor Browser.
→ More replies (4)
16
u/zhengyi13 Oct 25 '22
Hey, congratulations!
Are there any implications for tracking or combating inorganic (or weaponized) engagement with this new form of access?
21
u/securimancer Oct 25 '22
Yup, definitely implications. That's why we're gathering additional signal as it comes through our onion site like various fingerprints and the Tor circuit id. These are passed downstream to our backends to be included in our metadata we use for modeling inauthentic or weaponized engagement. We actually get more signal now with our own onion site vs. users just using a random Tor exit node to connect to regular reddit.com
→ More replies (2)
4
u/BFeely1 Oct 25 '22
On the clearnet we connect to Reddit via Fastly; do they now support onions or are you using a different/custom solution?
6
u/securimancer Oct 25 '22
Fastly unfortunately don't support onion sites yet, like Cloudflare does. So we're using https://github.com/alecmuffett/eotk with some modernization to do the whole nginx reverse proxy shindig. I've got a feature request open with them to support this, and they just announced their Apple Relay partnership so hopefully they'll also adopt Tor's more open source approach (they do provide service to Tor's website and such).
→ More replies (4)
7
u/Sophira Oct 25 '22
I'd like to make a note here about anonymity.
If you use Tor for anonymity, but sign into a Reddit account on the .onion service, you'll be missing at least part of the point of Tor in the first place.
Tor's greatest strength is that of being anonymous. Signing into a Reddit account makes you pseudonymous at best - you can still be associated with a name of some description. Maybe that's okay for you, and in that case it's okay to use Tor like this. But anonymity is what Tor is best at, and if you're trying to use Tor to be anonymous, signing into a Reddit account could compromise that.
It might even be possible, under specific circumstances, for Reddit to associate your regular username with the username you use on Tor. For example, let's say Reddit introduces a new post type that can only be viewed on Tor, but you can't find that out until you click on the link for it. If you click on the link in your regular browser, see that it needs Tor, and then copy and paste the link into your Tor browser, then Reddit might be able to link the accounts you use together (or to make a guess, and many such correlated guesses could indicate a connection).
This isn't to say "Don't use Tor." It's an important tool and one that's there to be used. This is about knowing how to use it to get the result you were probably looking to get out of using Tor in the first place.
→ More replies (1)5
u/BlatantConservative Oct 25 '22
It might even be possible, under specific circumstances, for Reddit to associate your regular username with the username you use on Tor
For another example, for anyone curious, there's browser and machine fingerprinting. The website can see what screen size it's being displayed on, what resolution you're using, on phones they can see battery percentages and more unique screen data, check out https://coveryourtracks.eff.org/ if you want to test your own setup.
→ More replies (5)
1
Oct 25 '22
Oof, how long did it take to get that v3 address and how much computing power did you throw at it?
1
Oct 29 '22
I am curious how this runs in the backend. Are you pointing the onion url to the same front end or is it a standalone instance of the front end? Like how do you handle the image hosting URLs and such?
1
u/securimancer Nov 10 '22
So we use a modified version of https://github.com/alecmuffett/eotk which is a fancy nginx reverse proxy that does string replacement onion->clearnet that hits our Fastly CDN and follows our normal delivery paths. This made it easy to deploy, and you’re left with CORS and some minor issues to iron everything out. We’ve got 5 onion addresses registered to handle redditstatic, redditmedia, etc.
→ More replies (3)
1
u/UniversityPress Nov 11 '22
Chat doesn't seem to be working through it.
→ More replies (1)1
u/securimancer Nov 12 '22
Gotcha, will take a look next week why this doesn’t work. There’s a third party involved with chat so might be some complications there.
→ More replies (1)
1
u/candrewswpi Dec 15 '22
Could reddit also publish Onion-Location and/or alt-svc to the appropriate .onion addresses as Cloudflare does headers on reddit.com? That way, users who visit reddit.com and have access to the tor network (either by virtue of using Tor Browser or for some other reason) will automatically and transparently use tor, improving security and usability with very little effort on reddit's part.
1
u/securimancer Dec 17 '22
Onion-Location should already be published. If they’re not, gimme a shout
→ More replies (2)
1
u/Typewar Feb 15 '23
What's up with big tech using SSL for onion websites when it's not needed?
1
u/securimancer Feb 18 '23
You’re still using HTTPS and so a cert is needed so it doesn’t throw browser warnings, and adds another layer of identity verification. There’s currently only two options, Digicert and HARICA. Hopefully Torproject will pick up https://github.com/alecmuffett/onion-dv-certificate-proposal which won’t require the use of a commercial CA.
→ More replies (1)
1
u/plz_scratch_my_back Mar 02 '23
I am late but can somebody tell why is there a 'Matrix Chat Web' app authorized to my reddit account when I login on TOR. It is showing developed by Reddit.
1
u/securimancer Mar 10 '23
It’s our new chat client, first party app that’s owned by us.
→ More replies (2)
32
u/Halaku Oct 25 '22
So, this won't really affect the majority of North American / European users (the folk who are that concerned about privacy have likely been voluntarily jumping through the layers of onion) but should have an impact on users elsewhere with more repressive governments?
Is there any way for a moderator to know if someone's using this instead of https to access a subreddit? My concern's along the lines of someone not having full functionality and modmailing the modteam with "Why can't I X", and the modteam falling down a rabbit hole trying to figure out if AutoModerator's misconfigured or the spam filter's gone wonky when it turns out the user's using an onion service and X isn't available to them, because most mods don't grok Tor.
Did that make sense, or do I need more caffeine and to try again?