What is the dark web?

Networks emerging inside the network

In the introduction to volume 1 of our white paper, we described the dark web and its content without going into the technical side. Volume 2 largely continues that description of what can be found on the dark web; we do, however, want to add a more technical note about the network itself. So what is the dark web? And how do you reach it?

The need for technologies offering some form of anonymity online emerged in the early 2000s. A handful of pioneers set to work, and the approach they settled on was to build a ‘network within the network’.

Ian Clark went first, releasing the initial version of Freenet, a fully distributed network for storing information anonymously. In 2003, the developer zzz released the first version of I2P (Invisible Internet Project), a decentralised network for anonymous communications. Tor followed: born of research carried out in the 1990s, its first public version appeared in 2004.

Freenet, I2P and Tor: the three pillars of the dark web

Figure 1 – https://freenetproject.org

Figure 2 – https://geti2p.net

Figure 3 – https://www.torproject.org

The dark web grew out of these three technologies. What set it apart from the standard web, technically, was anonymisation by design. Each of the three offers a different set of capabilities.

« Whether they follow a ransomware attack or plain negligence, whether they are put up for sale by cybercriminals or exposed as part of information operations tied to ideological or political claims, data disclosures are an opportunity for attackers to act. » 2022 Cyber Threat Overview – ANSSI

According to CESIN’s 8th annual barometer, published in 2023, 74% of companies name phishing as the main entry vector for the attacks they suffered.

In this ocean of web data, the essential thing to grasp is that people are on the front line. Every employee needs to understand the effect they can have on their organisation through the data they handle day to day.

Analyst and security teams have to be put in place and equipped to map the company data circulating outside the company — and, as with any risk, to plan the response to an attack so that services stay resilient. Just as you fit detectors, sprinklers and extinguishers against fire risk, you have trained teams to qualify the alert when the smoke detector goes off. These cross-cutting teams have to ignore the organisation’s internal silos in order to protect it, because in cyber every department holds the key to a door through which an attacker can bring the building down from the inside.

Freenet: the strongest anonymity

Highly resilient, and almost certainly offering the strongest anonymity of the three, Freenet stores information anonymously using both a distributed network and distributed data storage. It gave rise to a dark web whose sites are files and nothing else. It also supports communication through forums and a social network. Being fully distributed makes it very resilient — and decidedly slow.

How do you reach Freenet’s dark web?

A few entry points are available straight from the Freenet home page.

Freenet interface for reaching the dark web

I2P: anonymity with flexibility

I2P’s strength is its flexibility: it can anonymise other technologies, such as the torrent download protocol. It can therefore keep torrent-based download tools discreet.

Like Tor and Freenet, I2P has a dark web of its own, made up of micro-websites hosted on your own computer, with addresses ending in b32.i2p. They can only be reached from inside the anonymous I2P network.

How do you reach I2P’s dark web?

A number of I2P dark web sites are reachable from the interface.

I2P interface for reaching the dark web

Tor: the most widely used network

As with I2P, Tor is made up of websites whose addresses end in .onion. It is almost certainly the largest of the three by volume of content, and Tor sites are built to the same standard as those on the clear web. What made its success, though, is its use for anonymising access to the web.

Tor may have taken up nearly all the ground in terms of use, but each of these technologies retains properties worth noting:

• Tor: anonymous access to the standard web
• Freenet: resilient, anonymous storage
• I2P: multi-protocol anonymisation

It is precisely because Tor made anonymous access to the standard web possible — through the Tor Browser in particular — that the dark web was able to grow as a set of hidden sites ending in .onion, reachable with that same browser.

How do you reach Tor’s dark web?

Installing the Tor Browser is necessary, but it will only get you as far as the browser’s home page. That page offers to search through DuckDuckGo, whose results will send you back to clear web sites. You will therefore need to find an entry point through a directory of onion sites, or through a search engine dedicated to the Tor network.

And the web?

… the webs, rather. As the web spread and grew, search engines became central to how it is reached. Some sites, however, are poorly indexed by those engines, or not indexed at all: either they are ‘lost’ somewhere in the web — turning up on the last pages of results, which nobody ever opens — or their administrator has deliberately configured them not to be indexed, for the sake of discretion. That barely reachable zone of the web became the deep web, as opposed to the clear web that most people use. Unlike the dark web, clear and deep web sites share the same centralised, non-anonymous technology by design.