Use authenticated hidden services to prevent enumeration about onionshare HOT 2 CLOSED

I did consider this, but it does make the UX way worse. Rather than just "open this link in Tor Browser" it's "edit some cryptic text file that may be in /etc/tor/torrc or maybe be in the directory structure of your TBB and some cryptic line, and then open this link in Tor Browser". I'm fine with this blocking on https://trac.torproject.org/projects/tor/ticket/8000.

In either case, I think it makes sense to make this feature optional. If you pass the flag --hidservauth then it can automatically make the hidden service authenticated, and output the URL as well as the line to add to torrc. We can do that right now, so more tech savvy users with more paranoid use-cases can use it.

from onionshare.

The awesome thing about OnionShare is how simple it is to use, and this would decrease the usability a whole lot, without providing much (or in most cases any) more defense in depth.

Maybe we can revisit in the future if stealth hidden services get quicker and easier to use (like, if you can include the hidservauth value in the URL and Tor Browser understands that it needs to add that to the tor config or something).

from onionshare.