Protecting Onion Service Users Against Phishing
Benjamin Güldenring, Volker Roth
TL;DR
This paper addresses phishing threats targeting Tor onion services by proposing privacy-preserving recognizers that avoid leaving traces of visited sites. Building on hash visualization and PAKE, the authors formalize recognizers, prove security notions for collisions and disclosure, and implement a prototype browser extension for the Tor Browser that uses short, human-memorable fingerprints. They show that existing protections either leak traces or rely on centralized trust, and demonstrate how recognizers can provide phishing detection without compromising user privacy. The work suggests practical directions for usable, trace-free phishing protection with future work on dynamic sets, user studies, and more compact visual representations. The approach has potential to improve user safety in privacy-focused environments while reducing reliance on centralized infrastructure.
Abstract
Phishing websites are a common phenomenon among Tor onion services, and phishers exploit that it is tremendously difficult to distinguish phishing from authentic onion domain names. Operators of onion services devised several strategies to protect their users against phishing. But as we show in this work, none protect users against phishing without producing traces about visited services - something that particularly vulnerable users might want to avoid. In search of a solution we review prior research addressing this problem, and find that only two known approaches, hash visualization and PAKE, are capable of solving this problem. Hash visualization requires users to recognize large hash values. In order to make hash visualization more practical we design a novel mechanism called recognizer, which substantially reduces the amount of information that users must recognize. We analyze the security and privacy properties of our system formally, and report on our prototype implementation as a browser extension for the Tor web browser.