How to Access 0xacab Over Tor and Verify Its SSH Fingerprints

Updated

0xacab is a code hosting service for "friendly people," and it publishes both a clearnet address and a Tor onion address. To reach it over Tor, use the onion URL http://wmj5kiic7b6kjplpbvwadnht2nh2qnkbnqtcv3dyvpqtz7ssbssftxid.onion in a Tor-capable browser. To confirm you are connecting to the official server over SSH, compare the host key fingerprints shown by your client against the ed25519 and RSA values published by the project (listed below).

Accessing 0xacab over Tor

The project lists two web addresses:

Access method Address
Clearnet https://0xacab.org
Tor onion service http://wmj5kiic7b6kjplpbvwadnht2nh2qnkbnqtcv3dyvpqtz7ssbssftxid.onion

To use the onion address:

  1. Install and start the Tor Browser (or another Tor-enabled client).
  2. Enter the .onion URL above into the address bar.
  3. The site loads over the Tor network, so your connection to the service is routed through Tor rather than the public internet.

The onion address is only reachable through Tor. If you paste it into a normal browser without Tor, it will not resolve.

Verifying the SSH fingerprints

When you connect to 0xacab over SSH (for example, to push or pull Git repositories), your SSH client will show a host key fingerprint the first time you connect. You should compare that fingerprint against the published values before accepting it.

The published fingerprints are:

ed25519

Hash Value
MD5 e0:42:d2:20:b5:29:b8:f8:2c:f0:97:a2:c9:e9:c3:6b
SHA256 2D8lksRpOJ8ypmQE5I4Qq3JqYRHIvnlg6tJaFJv5Nbg

RSA

Hash Value
MD5 ec:f1:8f:6c:c3:2e:21:b6:a6:3d:6b:38:69:31:ae:28
SHA256 4oOr4sH8tA6lu6kzggkZo8Ockmenu7mlmojXnkUyLts

How to compare

  • Expected result: the fingerprint your SSH client displays matches one of the values above exactly (character for character, including the hash type).
  • If it does not match: do not accept the key. A mismatch means you may be connecting to a different or impersonated server.
  • Which one to check: your client will show the fingerprint for the key type it negotiated (ed25519 or RSA). Match it against the corresponding row above.

For example, when connecting for the first time, SSH typically prints something like The authenticity of host ... can't be established. ED25519 key fingerprint is SHA256:.... Compare that SHA256 string to 2D8lksRpOJ8ypmQE5I4Qq3JqYRHIvnlg6tJaFJv5Nbg.

Other ways to reach the project

  • Public projects: browse at https://0xacab.org/explore.
  • Support / issues: the project asks that support tickets be left at its issue tracker.
  • Contact: email collective at riseup.net, or IRC #riseup on irc.indymedia.org.

Common snags

  • New account limits: new users can create or fork only one repository. This is intentional to limit spam and uncontrolled growth; contact the team or open a support ticket if you need more.
  • Onion address not loading: confirm Tor is actually running and that you used the full .onion string.
  • Fingerprint mismatch: stop and re-check the published values rather than clicking through the warning.