From the point of view of an ISP, if I have a hidden service running on a server, does it look any different than a tor relay?
Both are seen as Tor traffic but there is some key differences an ISP can use to determine if they are either. Public relays have their IP's listed in the public tor consensus. Whereas a hidden service's IP is not published, meaning on the side of the ISP your server is just connecting to other relays rather than just accepting incoming connections like a public node. Hope this helps!
I thought there must be something...Thanks for the info. So I guess it would be pretty easy for an ISP to guess there is a large DNM running simply based on bandwidth? I wonder how the big markets deal with that, since there isn't a lot of them it must mean LE should have a pretty good idea what to pay attention to. So I wonder how they manage to stay in business for years...
It looks different only in regards of bandwidth and connection time. An onion service is connected 24/7, a regular user isn't.
Anyways, it's best to use a VPN, rather than just telling your ISP that you're using tor
Anyways, it's best to use a VPN, rather than just telling your ISP that you're using tor
This depends on a few things, your country (and what laws they have on tor use or hosting) and how much bandwidth you're even working with. Also consider what is a "large marketplace". Tor websites are designed to be lighter due to the speed of tor itself & cutting out javascript for privacy, so hosting on say a 1 gig network bandwidth wouldn't be hard if you utilize rate limiting, auto-timeouts, CAPTCHas, etc. If you're in the US, keep in mind that law enforcement can't use simply "hosting" or "use of tor" as a reason to search you or your residence hosting the servers. Even pulling records requires subpoena or court orders unless the ISP just hands them over. Even if they do, all they're receiving is blobs of data.