nihilist@mainpc - 2024-08-03

Introduction to Self-Hosting Hidden Services

Clearnet Services: Centralized, but can be used anonymously

Today's clearnet web is hugely centralised, you have businesses out there (meaning potential and very likely governmental proxies) that are letting you rent servers (VPSes / dedicated servers / etc) and domain names to be able to have a clearnet service.

If you want to have clearnet services but to keep your anonymity regardless, you'll need to go through KYC-free resellers (you can find them here)

To find out how to run Anonymous Clearnet Services, you can check out this tutorial.

If you don't want to give in to that centralization, but remain on the clearnet, you'd have to run a service from home, using only the public IP you're getting from your ISP.

Problem is that your ISP knows who you are, is actively spying on what you do with your internet connection, and from there he knows that you are running the website. No anonymity whatsoever.

Tor Hidden Services: Decentralized and Anonymous

One solution to that situation if your goal is to have a website hosted at home, as a Tor hidden service. Meaning your service can only be accessed through the Tor network, anonymous by default. Like so, your ISP can only see that you are using the tor network, but he can't tell what you're doing with it.

if your ISP does not allow Tor traffic, you'll need to run a VPN on the server that's running the Tor hidden service, that way, you'll be able hide to your ISP that there is tor traffic at your house, while still being able to have a Hidden service reachable.

To find out how to run Hidden Services, you can check out this tutorial.

Warning, do not host anything sensitive at Home!

Note that Tor has had 0days in the past, and it could still have some. Therefore be aware hosting Anonymous services at home is not suitable for Sensitive use. As all it takes is for Tor to have one 0day for an adversary to be able to find out where the service truly is. Therefore keep in mind that you should only self-host services that are not going to get you in trouble if an adversary ever finds out that it is you who's the administrator.