ZeroNet: Decentralized Censorship-resistant Network
About this ZeroNet Page | |
---|---|
Support Status | unmaintained |
Difficulty | unknown |
Contributor | none |
Support | none |
Deprecated Wiki Page[edit]
The original developer of ZeroNet disappeared approximately February 2021. [1] There may or may not be a continuation of the ZeroNet project in form of a software fork. [2] These are undocumented.
Introduction[edit]
The ZeroNet wiki describes the software design: [3]
ZeroNet
uses Bitcoin cryptography and BitTorrent technology to build a decentralized censorship-resistant network. Users can publish static or dynamic websites in ZeroNet and visitors can choose to also serve the website. Websites will remain online even if it is being served by only one peer.
This means users are not identified or reachable by an IP address, since they are identified by a public key - specifically a public Bitcoin address. The private key owner can sign and publish changes, which are propagated through the network. Sites are accessed through an ordinary browser in combination with the Zeronet application. [4] The BitTorrent technology refers to the use of trackers to negotiate peer connections. [5] ZeroNet can be optionally configured to use Tor for anonymity. [6]
The Zeronet wiki describes various features and benefits, including: [3]
- Password-less authorization - the user account is protected by the same cryptography that applies to Bitcoin wallets.
- Easy setup. [7]
- Immediate updating of sites in real time.
- Works with any browser.
- Full Tor network support, including onion services.
- Content cannot be censored (removed) after publication.
- It is impossible to shut down content, since content is served by any user who wishes to.
- ZeroNet is fast and works offline.
Connecting to Tor before ZeroNet[edit]
These instructions lead to the following connection scheme in Whonix ™:
User
→ Tor
→ ZeroNet
→ Internet
Installation[edit]
This application requires incoming connections through a Tor onion service. Supported Whonix-Gateway ™ modifications are therefore necessary for full functionality; see instructions below.
For better security, consider using Multiple Whonix-Gateway ™ and Multiple Whonix-Workstation ™. In any case, Whonix ™ is the safest choice for running it. [8]
onion-grater Adjustments[edit]
Complete the following steps in Whonix-Gateway ™ (sys-whonix
).
Extend the onion-grater whitelist in Whonix-Gateway ™ (sys-whonix
).
Modify Firewall Settings[edit]
Modify the Whonix-Workstation ™ (anon-whonix
) user firewall settings and reload them.
1. Modify Whonix-Workstation ™ User Firewall Settings
Note: If no changes have yet been made to Whonix ™ Firewall Settings, then the Whonix ™ User Firewall Settings File /etc/whonix_firewall.d/50_user.conf
appears empty (because it does not exist). This is expected.
If using Qubes-Whonix ™, complete these steps.
In Whonix-Workstation ™ App Qube. Make sure folder /usr/local/etc/whonix_firewall.d
exists.
Qubes App Launcher (blue/grey "Q")
→ Whonix-Workstation ™ App Qube (commonly called anon-whonix)
→ Whonix ™ User Firewall Settings
If using a graphical Whonix-Workstation ™, complete these steps.
Start Menu
→ Applications
→ System
→ User Firewall Settings
If using a terminal-only Whonix-Workstation ™, complete these steps.
Open file /usr/local/etc/whonix_firewall.d/50_user.conf
with root rights.
For more help, press on Expand on the right.
Note: This is for informational purposes only! Do not edit /etc/whonix_firewall.d/30_whonix_workstation_default.conf
.
The Whonix ™ Global Firewall Settings File /etc/whonix_firewall.d/30_whonix_workstation_default.conf
contains default settings and explanatory comments about their purpose. By default, the file is opened read-only and is not meant to be directly edited. Below, it is recommended to open the file without root rights. The file contains an explanatory comment on how to change firewall settings.
## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration, ## which will override the defaults found here. When {{project_name_long}} is updated, this ## file may be overwritten.
Also see: Whonix modular flexible .d style configuration folders.
To view the file, follow these instructions.
If using Qubes-Whonix ™, complete these steps.
Qubes App Launcher (blue/grey "Q")
→ Template:
whonix-ws-16
→ Whonix Global Firewall Settings
If using a graphical Whonix-Workstation ™, complete these steps.
Start Menu
→ Applications
→ Settings
→ Global Firewall Settings
If using a terminal-only Whonix-Workstation ™, complete these steps.
In Whonix-Workstation ™, open the whonix_firewall configuration file in an editor.
2. Open required external ports.
Add.
Save the file.
3. Reload Whonix-Workstation ™ Firewall.
If you are using Qubes-Whonix ™, complete the following steps.
Qubes App Launcher (blue/grey "Q")
→ Whonix-Workstation ™ App Qube (commonly named anon-whonix)
→ Reload Whonix ™ Firewall
If you are using a graphical Whonix-Workstation ™, complete the following steps.
Start Menu
→ Applications
→ System
→ Reload Whonix ™ Firewall
If you are using a terminal-only Whonix-Workstation ™, run.
Install Dependencies[edit]
Run the following commands in Whonix-Workstation ™ terminal (Qubes-Whonix ™: whonix-ws-16
Template).
Update the package lists.
Install dependencies. [11]
Retrieve the Signing Key[edit]
Run the following command in Whonix-Workstation ™ terminal (Qubes-Whonix ™: anon-whonix
AppVM).
Retrieve the ZeroNet signing key. [12]
Digital software signatures can increase security but this requires knowledge. Learn more about digital software signature verification.
Securely download the signing key.
Display the key's fingerprint.
Verify the fingerprint. It should show.
Key fingerprint = 960F FF2D 6C14 5AA6 13E8 491B 5B63 BAE6 CB96 13AE
The most important check is confirming the key fingerprint exactly matches the output above. [13]
Do not continue if the fingerprint does not match! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity.
Add the signing key.
Install ZeroNet[edit]
Run the following commands in Whonix-Workstation ™ terminal (Qubes-Whonix ™: anon-whonix
AppVM).
ZeroNet is not yet packaged for Debian, so it must be manually installed. [14] [15]
Download ZeroNet.
Navigate to the ZeroNet folder.
Check the ZeroNet signature.
Install dependencies of ZeroNet. There is currently no better way than using a third party repository and third party package manager pip
. [16]
Security warning: Adding a third party repository allows the vendor to replace any package on your system. Proceed at your own risk! See Foreign Sources for further information. For greater safety, users adding third party repositories should always use Multiple Whonix-Workstation ™ to compartmentalize VMs with additional software.
Launch ZeroNet[edit]
1. Launch the ZeroNet process.
2. Launch Tor Browser.
Start Tor Browser.
If you are using Qubes-Whonix ™.
Qubes Start Menu
→ Whonix-Workstation ™ AppVM (commonly called anon-whonix)
→ Tor Browser
If you are using Non-Qubes-Whonix ™.
Start Menu
→ Tor Browser
If you are using a terminal (Konsole).
3. Adjust Tor Browser's configuration.
Note: The following steps will no longer be required once Whonix ™ releases a custom Tor Browser for connecting to alternative networks. [17]
Configure Tor Browser to connect to localhost.
- This step changes the web fingerprint of Tor Browser!
- Leave all other settings as is!
In Tor Browser:
- Type
about:config
into the URL bar. - Press
Enter
- Search for
network.proxy.no_proxies_on
- Set to
0
- Search for
network.proxy.allow_hijacking_localhost
- Set to
false
4. Navigate to the ZeroNet web interface.
Paste http://127.0.0.1:43110
into Tor Browser's URL field and press Enter
. For additional tips on visiting sites, see: How does it work?
The process is now complete and ZeroNet should be fully functional in Whonix ™. [18]
Figure: ZeroNet Homepage in Whonix ™
Popular ZeroNet Sites[edit]
Some popular ZeroNet sites include: [19]
ZeroHello: http://127.0.0.1:43110/1HeLLo4uzjaLetFx6NH3PMwFP3qbRbTf3D
The homepage of ZeroNet.
ZeroMail: http://127.0.0.1:43110/1MaiL5gfBM1cyb4a8e3iiL8L5gXmoAJu27
End-to-end encrypted, distributed, P2P messaging site. To improve privacy it uses a BitMessage-like solution and will not expose the message recipient.
ZeroBlog: http://127.0.0.1:43110/1BLogC9LN4oPDcruNz3qo1ysa133E9AGg8
Self publishing blog demo.
ZeroTalk: http://127.0.0.1:43110/1TaLkFrMwvbNsooF4ioKAY9EuxTBTjipT
Decentralized, P2P forum demo.
ZeroMe: http://127.0.0.1:43110/1MeFqFfFFGQfa1J3gJyYYUvb5Lksczq7nH
Decentralized, Twitter-like P2P social network.
ZeroChat: http://127.0.0.1:43110/1AvF5TpcaamRNtqvN1cnDEWzNmUtD47Npg
The finished site for the tutorial of creating a server-less, SQL backed, real-time updated P2P chat application using ZeroNet in less than 100 lines of code.
ZeroNet Gateway[edit]
Visit a read-only portal to view zites for people who don't have it installed.
Footnotes[edit]
- ↑
- ↑
- ↑ 3.0 3.1 https://zeronet.readthedocs.io/en/latest/
- ↑ ZeroNet acts as a local web server for these pages.
- ↑ https://en.wikipedia.org/wiki/ZeroNet
- ↑ https://zeronet.io/docs/faq/#how-to-use-zeronet-with-tor
- ↑ Although the Chinese government has blocked the ZeroNet website and bittorrent tracker.
- ↑
Security considerations:
- By using Whonix ™, additional protections are in place for greater security.
- This application requires access to Tor's control protocol.
- In the Whonix ™ context, Tor's control protocol has dangerous features. The Tor control command GETINFO address reveals the real, external IP of the Tor client.
- Whonix ™ provides onion-grater, a Tor Control Port Filter Proxy - filtering dangerous Tor Control Port commands.
- When this application is run inside Whonix ™ with an onion-grater whitelist extension, this will limit application rights to Tor control protocol access only. Non-whitelisted Tor control commands such as GETINFO address are rejected by onion-grater in these circumstances.
- During the application's normal operations it should not attempt to use dangerous Tor control commands such as GETINFO address. In the event the application or Whonix-Workstation ™ are compromised, this command would be rejected.
- In comparison, if the application is run on a non-Tor focused operating system like Debian, it will have unlimited access to Tor's control protocol (a less secure configuration).
- If the (non-)Whonix platform is used to host onion services, then running applications are more vulnerable to attacks against the Tor network compared to when Tor is solely used as a client; see also Onion Services Security.
- ↑
Using
/usr/local/etc/onion-grater-merger.d/
because that onion-grater settings folder is persistent in Qubes-Whonix ™ TemplateBased ProxyVMs i.e. Whonix-Gateway ™ (commonly calledsys-whonix
). Non-Qubes-Whonix ™ users could also utilize/etc/onion-grater-merger.d/
. Qubes-Whonix ™ users could also utilize/etc/onion-grater-merger.d/
but then/etc/onion-grater-merger.d/
must be made persistent, which means doing this procedure inside the Whonix-Gateway ™ Template (commonly calledwhonix-gw-16
) and then restarting the Whonix-Gateway ™ ProxyVM or using bind-dirs. Both techniques are more complicated than simply using
/usr/local/etc/onion-grater-merger.d/
, since it is persistent either way. Further, it even allows multiple Whonix-Gateway ™ ProxyVMs based on the same Whonix-Gateway ™ Template; for example, one Whonix-Gateway ™ ProxyVM extending and relaxing onion-grater's whitelist and the other Whonix-Gateway ™ ProxyVM having the default onion-grater whitelist which is more restrictive. - ↑
Previously manual instructions. No longer needed.
onion-grater-add
automates that.
1. Create folder/usr/local/etc/onion-grater-merger.d
.sudo mkdir -p /usr/local/etc/onion-grater-merger.d2. Symlink the onion-grater profile to the onion-grater settings folder.sudo ln -s {{{filename_new}}}.yml /usr/local/etc/onion-grater-merger.d/3. Restart onion-grater.sudo service onion-grater restart - ↑ Is python3-msgpack still reuqired?
- ↑
- https://github.com/HelloZeroNet/ZeroNet/issues/759
- ZeroNet feature request: upload ZeroNet gpg signing key
- https://github.com/HelloZeroNet/ZeroNet/issues/759
- ↑ Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
- ↑ https://github.com/HelloZeroNet/ZeroNet/issues/241
- ↑ http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850474
- ↑ ZeroNet dependencies are not available in Debian.
- ↑ Except in the case of YaCy, which needs internet access.
- ↑ Functionality was last confirmed in mid-2020.
- ↑ https://zeronet.readthedocs.io/en/latest/using_zeronet/sample_sites/