To be more precise, we should distinguish between PoW algorithms and the hash functions they use.

E.g. when people say Bitcoin's PoW is SHA256, what they mean is that it uses the Hashcash PoW with the SHA256 hash function (iterated twice).

Equi-X is the Equihash PoW algorithm using HashX as underlying hash function.
The latter is derived from the RandomX hash function used in Monero's Hashcash PoW algorithm.

Naor & Dwork invented the concept of PoW, while Adam invented Hashcash, the first practical PoW algorithm [1].

[1] https://en.wikipedia.org/wiki/Proof_of_work

Context: scammer Craig Wright pays people to spread that line because: (1) He has some narcissistic rivalry with everyone who understands technology better than him (which is  lot of people!), (2) he doesn't understand proof of work well enough to realize that a version with a trap-door is fundamentally unsuitable for almost every application people talk about using proof of work.  It's just pathetic.

Unfortunately, the whole thing about history being written by the victors only applies to stuff like warfare where the losers are literally killed.  Lots of people who don't know better end up picking up and repeating his narratives-- he stands to gain from spending to spread his bullshit and invests heavily in it.  Other people don't care to stop him.  Thanks for speaking up for the truth.

I assume this is only an option for hidden services (so only .onion sites).

Although facebook is not very privacy friendly to most (all?) of their users (based on the amount of data they collect on them), they do have a tor version of their site, and I can see them implementing this as a means to help others to implement this to prevent DoS attacks on hidden services.

Don't worry about "Green Peace", their people at the top don't actually care. Tin-foil hats on, but just like the World Economic Forum, it's merely one of the organizations created to help achieve the elite's Globalist Agenda.


It will, just like how miners could be hired and be a threat against nascent altcoins, BUT it's not without a cost which is the point of POW. Want to attack it? Pay the price because sometimes it won't be cheap.

but they still have to take requests and check if the appropriate amount of work has been done. that takes resources just doing that. you could overload a server with that type of bogus request and what are they going to do?  i'm not an expert on tor.

There is a good layout of the various attack surfaces for this approach, and how they can be mitigated against, starting here: https://github.com/torproject/torspec/blob/main/proposals/327-pow-over-intro.txt#L631

Thanks for the info but:

A few comments on this proposal: https://github.com/torproject/torspec/blob/main/proposals/327-pow-over-intro.txt

The Service seems like it could be still subject to ddos attacks anyway as it has to provide POW parameters in step 1 and then verify the PoW in step 4. So it has to first communicate to the client, providing some information, then it has to perform processing to verify the PoW is correct. if all of those requests by the client are fake then that's wasting bandwidth of the server and its computing power.


I'm not going to pretend like I understand the reasons for all of these steps but if any of them fails then the introduction request must be denied. That means all of them have to be checked to make sure none of them fail, in the worst case scenario you would find yourself going through all of them until you hit step f. For every bogus request, it might have to go rhgouh steps a,b,c,d,e and then maybe it fails on step f for whatever reason. maybe all those steps are extremely fast and efficient, well they better be!  


This seems like a better idea to separate the PoW component of things completely. Then you could add on PoW protection to all kinds of different services too.

After looking at this thing for a few minutes, the only real question that comes to mind is why they didn't come up with an idea like this sooner. Presumably DDOS attacks are not a new thing for Tor...and it's not really anything new. I think they did it with email way back in the day. Where to stop spam, they required some PoW be done that took a few seconds. Simple way to stop spam...

strange thing is how they can turn off the PoW when it's not needed. But clients can still do the PoW anyway to get a higher priority in the "Queue". So people with more powerful machines (modern ones), well they can be expedited while poorer people with lower end machines can get ignored. Ignored means treated with lower priority. means more waiting. 

In the more extreme case, a TOR relay's proxy server could theoretically cache this information on a CDN such as Akamai, which would then transform the problem into a DDoS attack on said CDNs, which could cause them to sinkhole the IP addresses involved. Or perhaps the sinkholing can be done by the relays themselves with the proper network infrastructure, since I don't know if it's even practical for CDNs to get involved, even if it is in the very early stages before the bridges/guard nodes do anything else.

I really hope people who run Tor hidden service wouldn't resort to 3rd party CDN. Even OnionBalance and Endgame which created for Tor hidden service isn't recommended by Tor project (as stated by article shared by OP).


I don't know since when I2P add Hashcash. But PoW proposal for Tor has been around since 2020[1] and the idea itself seems to be few years older. And FYI, I2P isn't exactly new since it was created on 2003[2].


Yes, some of them mentioned on their documentation[3].

[1] https://lists.torproject.org/pipermail/tor-dev/2020-June/014381.html
[2] https://www.geti2p.net/en/blog/post/2021/08/28/History-of-I2P
[3] https://community.torproject.org/onion-services/advanced/dos/