mkp224o VS onionmx

mkp224o has worked fine for me. Older tools like Shallot and Eschalot don't support v3 addresses, and so are no longer usable.

I’m hosting a site on a Raspberry Pi 4B (8GB Ram) with Nginx. I wanted to make it accessible on tor with a custom vanity address so I used a program called mkp224o to generate an address.

I thought that it would be cool to have a vanity v3 domain of some kind, so I've used mkp224o to generate one (bitcoinABC...DEF.onion, from now on I'll refer to this as .onion

https://gitlab.torproject.org/tpo/onion-services/onionmine based on https://github.com/cathugger/mkp224o/

Yup, https://github.com/cathugger/mkp224o was used. I'll props https://gitlab.torproject.org/tpo/onion-services/onionmine as well which is a new project to consolidate the entire minting process.

So I realized that I could give a custom private key to get a custom .onion address. Then I used mkp224o to brute force some

mkp224o

This readme is quite insightful.

For anyone curious, onion to onion (and even non-onion to onion) works today if the involved SMTP servers know how to handle it. For example, the OnionMX project. https://github.com/ehloonion/onionmx

Great question! onion vhosts ([email protected] addresses) don't need that, as long as your client can resolve onion addresses (Gajim/Conversations have good tor integration, otherwise Tor's AutomapHostsOnResolve will do the trick systemwide but in that case your client may complain that the domain doesn't support TLS or with a wrong certificate).

"Advanced" connection settings is required when the vhost you are connecting to doesn't match the hostname you need to reach on the network. For example, if you're reaching your server over a VPN/SSH/IPSEC tunnel.

Another example is if you wish to login as [email protected] by reaching foobar.onion. This is useful if you want to be part of the broader Jabber federation, in which not every host supports federation over onion addresses (i'd be curious to make stats about that) but it still gives you the security guarantees of Tor when reaching your server (though not for server-to-server connections).

Onion name discovery for automatically upgrading to onion routing when Tor is available client-side is not yet specified within the XMPP ecosystem. Onion discovery in the HTTP ecosystem is usually done via Onion-Location HTTP header (HTTPS only), in the email ecosystem they use _onion-mx DNS SRV records: see https://gitweb.torproject.org/tor-browser-spec.git/tree/prop... and https://github.com/ehloonion/onionmx/blob/master/SRV.md respectively

Implementing something similar XMPP side would be easy. Prosody already has a community mod_onions, but currently only supports a static map of hosts to their onion addresses. It could use some love: https://modules.prosody.im/mod_onions.html

Another problem we face from a UX perspective for onion services is that currently XMPP server implementations are very strict about which node/resource messages are intended for, and to my knowledge none support aliasing systems as we have in the email world. In this specific example application of aliases, there's currently no way (that i know of) to have the same account across .org/.onion domains and having servers to know it's the same account in a federated manner, eg. to prevent you from adding the same person twice to your contact list.

All in all there's interesting challenges and none of them is really hard so if you'd like to get involved or just let us know about your ideas and expectations, feel free to drop by xmpp:[email protected]?join