Tor/DarkNet Hidden Services Made Easy with OnionShare
One of the useful little applications that’s included with Tails OS is OnionShare, which enables the sharing of things on the .onion domain and the creation of hidden services. I think these are important options to have in a Tails-like setup.
Our freedom of expression, in practice, isn’t defined by laws or constitutions. It’s instead defined by what corporations’ terms of service and whatever arbitrary extra-legal pressures they’re subject to. And, unfortunately this applies to almost everything on the conventional Web, since almost everything is dependent on third party. Even if a site is hosted on a VPS, and mapped to a custom domain, it’s liable to get taken down for whatever reasons.
In the past, I have encouraged the use of various P2P systems - things like IPFS and I2P - but hardly anyone uses them. The next best thing is the DarkNet, which is a medium that’s evidently used even by people without a technical background, and more commonly than one might think. Anyone can install the Tor Browser, and access both the normal Web and hidden services anonymously without configuring anything. Often it’s much safer than using a VPN.
And, it transpires, it doesn’t take much effort to operate a hidden service either, with OnionShare. I’ve been giving this a try on Linux and Windows.
Running a Hidden Service
A ‘hidden service’ is typically just a Web site that happens to be running on a Web server configured to use a different addressing system and port number. Well, there are a few other things that need setting up also. This is what OnionShare provides. It can be installed on a Windows machine, but I strongly recommend running it on a Linux system instead, if the intention is to operate a hidden service anonymously.
OnionShare runs a basic Web server that’s limited to hosting a handful of HTML, CSS and image files - basically the elements of a static Web site. It’s not capable of hosting a Web application that uses server-side code or database - for that we’d need to configure something like Apache or nginx. Also, the site is taken offline and the address is lost when the server is stopped on the Tails version, but Tails was designed to prevent persistent session data.
With the Windows version, things are a little different. I restarted the server multiple times, and the server retained its .onion address. I also learned the server and its address can be made persistent by enabling the ‘Always open this tab when OnionShare is started’.
Hand-crafting an HTML page and a bit of CSS, I added the files to OnionShare’s Publish window and clicked ‘Start Sharing’.
When starting the Web server, OnionShare will generate an address for the site, which will be something like ‘http://3pbctm4wazs2dhsijczc36suvygtfbjh32rhdtcu5ln6qxsvqqjmalad.onion’ (not my hidden service’s actual address).
There are search engines for the DarkNet, and there are directory sites that link to hidden services worth visiting, so a given site can eventually be discoverable.
To get the .onion address, I had the persistent address option enabled in the settings (for the Linux version), and it took a few minutes for the routing system to associate my address with the server, but my site was accessible.
Configuration
There is a limited range of configuration options here, and they’re different for the Windows and Linux versions of the application.
To make the site publicly accessible using a proper .onion address, enable ‘Public mode’ and ‘Use persistent address’. It can take a few minutes for the site to become accessible in the Tor Browser, but that’s likely because the address needs to propagate through the routing system.
File Sharing
The other feature of OnionShare (and what it’s really designed for) is anonymous file sharing between two or more people. Basically we can use this as a drop box, of sorts.
Files can be shared relatively securely with the options to make them available only to people who have the server’s .onion address and private key, and the sharing can be discontinued after the file has been downloaded by the recipient.