Introducing Proof-of-Work Defense for Onion Services | The Tor Project
Introducing Proof-of-Work Defense for Onion Services | The Tor Project
Today, we are officially introducing a proof-of-work (PoW) defense for onion services designed to prioritize verified network traffic as a deterrent against denial of service (DoS) attacks with the release of Tor 0.4.8.
You're viewing a single thread.
PoW? Really?
It’s not like it’s going to consume electricity like Bitcoin.
PoW was first conceptualized as an anti spam method. It’s just a little overhead to make it expensive to make DOS attacks. This makes perfect sense.
It will, but that's the point. Costing money
What do you think PoW was created for. This is exactly the use case of PoW -- to reduce malicious traffic. It works great!
Though if an attacker has an ASIC he can single-handedly dominate the whole pool of other users as ASICs are tremendously more efficient than CPUs
Depends on the hashing algorithm. Tor implements two, and neither are vulnerable to custom architectures like ASICs
Good
At least it appears to be something that gets triggered. In theory, if a node is not under attack or heavy usage, this isn't a consideration. Doesn't seem to be a perfect solution as it still slows the traffic of legitimate users in the event of an attack. I don't know the full details, but in the worse case it makes it easier to semi-DoS, maybe not by fully making a node unresponsive, but by making the service so painfully slow that users may give up on it.
Only for those users who do not have proof of work capability, they get put at the back of the line, but anybody with proof of work capability, which was released last August, will do the work and be put higher priority. I know some people who run seed nodes for Haveno-reto and they had major DDOS issues until they got PoW enabled. It was taking like 5 or 10 minutes to get connected to the network. And now it takes about 30 seconds.
What else would they do?
I bet that commenter got triggered because cyrpto bad!!! There
Anyway, ain't pow like the only practical solution to fight bots?
Share Some conputer to enter... Seems fair if you are good faith single actor but very expensive if you are running a botnet campaign
Either that or charging a micro transaction for loading the page. But yeah the goal is to make it cost a small amount that is insignificant to a regular user but adds up to a huge amount at the scale of a spam farm. And it's also the same rationale behind hashing passwords with multiple rounds. It adds a tiny lag when you log in correctly but adds an insane amount of work if you're checking every phrase in a password cracking dictionary using an offline attack because it adds up. (In the online scenario you just block them after a few attempts)
No, in my eyes PoW is just a waste of resources. At least let them do some useful computation for the node.