8 ms·

Onion names reserved by the IETF

161 points by finnn 11y ago

duskwuff 11y ago
It's the sensible, pragmatic thing for them to do. Allowing .onion to be allocated as a "real" TLD would just be disruptive and confusing at this point. The implications with regard to SSL certificates are interesting, though, and I'm curious how long it'll take for SSL providers to start supporting that. :)
- finnn 11y ago
  Digicert has already issued at least one certificate to a .onion address[0]. See [1] for additional info [0]: https://blog.digicert.com/anonymous-facebook-via-tor/ https://blog.digicert.com/anonymous-facebook-via-tor/ [1]: https://blog.digicert.com/the-current-state-of-onion-certificates-and-what-happens-next/ https://blog.digicert.com/the-current-state-of-onion-certifi...
  - celticninja 11y ago
    blockchain.info also has an SSL cert on their .onion site
    - buu700 11y ago
      Fun fact: Cyph's certificate from DigiCert is the first EV cert ever deployed to a .onion address (https://cyphdbyhiddenbhs.onion https://cyphdbyhiddenbhs.onion).
- jlgaddis 11y ago
  What are the benefits to using SSL/TLS certificates on a hidden service? Perhaps a better question is: are there any benefits other than just providing an additional layer of encryption that a potential attacker would have to defeat -- there's already end-to-end encryption when using hidden services (even if there isn't any encryption at the application layer)? ETA: I just remembered that hidden services use 1024-bit RSA keys and there's been some arguments lately that that may not be enough bits. For some sites, using (at least) a 2048-bit key may be necessary.
  - jandrese 11y ago
    Well, it would encrypt the traffic from your TOR endpoint to the application. Usually this is on the same box so it's not a big deal, but not always.
    - dogma1138 11y ago
      All traffic to TOR hidden services is encrypted end to end, SSL can add additional level of authentication tho. If it's not a hidden service then you can't really use an .onion address anyhow.
      - jlgaddis 11y ago
        You're correct, but I think his point was that the Tor endpoint (i.e. the host connected to the Tor network) and, e.g., the host actually serving up the content aren't necessarily one and the same (although they usually are). In those instances, an SSL certificate would provide encryption all the way from the "Tor client", through the Tor network, the rendevous point, Tor endpoint, and to the actual application server. Without additional encryption in use at the application layer, the link from the Tor (hidden service) endpoint and the actual server would not be encrypted and, thus, vulnerable. To (perhaps) explain better, this would be similar to how Cloudflare offers SSL for all sites and while the path from the end user to Cloudflare is (can be) encrypted, the link from Cloudflare back to the origin server isn't necessarily encrypted. Alternatively, think of the link from an SSL terminating device to the backend web servers. Again, in most cases, this is a non-issue but there certainly are some instances in which it would apply (and this is probably more likely the bigger a site (hidden service) is).
    - deleted 11y ago
      [deleted]
  - vbezhenar 11y ago
    EV certificates add green buttons with company names. Registrar checked that this company indeed exists and legal. So you can be sure, that you didn't mistype URL. And may be some users are comfortable with HTTPS scheme. Another concern is that major browsers might obsolete HTTP scheme, so their UI will warn user about insecure connection. I'm not sure whether browsers will be able to distinct between onion sites and regular sites in that aspect.
vegabook 11y ago
Tor gets an upvote from the establishment. Is that furthering the cause of privacy? So we'll now get more exit nodes? Personally believe that nothing less than a wholesale transport-layer alternative to the internet is necessary to maintain communications freedom. Not far fetched to suggest that rooftop antennae running peer-to-peer mesh networks will gather momentum in coming years. Not to replace the internet, just as backup, to keep centralised government interests and moneymen at bay.
- DasIch 11y ago
  It's not far fetched to suggest people start seriously running peer-to-peer mesh networks, it's ridiculous. You won't be able to convince the people who know about them to run them and you'd need to convince far more people than that to actually get mesh networks to run reasonably well. This is ignoring the technical and legal challenges not to mention the fact that people have tried this for a very long time now and they've failed to get anywhere significant for just as long.
  - vegabook 11y ago
    If your criteria for "getting anywhere significant" is to be even within two orders of magnitude as performant as the current internet, then you are correct. If however the aim is to build a distributed, no single point of failure/control, kbps-class, backup communications system, that's primarily community-based, and that is NOT controlled by any corporation, ISP, or government, then there are many such networks already in existence. They're based on wifi, and completely legal. Clearly they're hobby projects but that doesn't make them uninteresting or indeed, potentially extremely useful in low-delta scenarios of societal breakdown and/or centralised oppression.
    - DasIch 11y ago
      I'm not talking about bandwidth, I'm talking about coverage alone. Berlin for example are many people that are into Freifunk and such networks. There are many more people into technology and the culture and politics associated with it. Nevertheless they can't even get decent coverage. The network is worthless not because it works badly, they fail to create an accessible one to begin with.
splitdisk 11y ago
Now we just need to find a Tor user with enough money to buy EV certificates...
- detaro 11y ago
  like facebook? https://facebookcorewwwi.onion/ https://facebookcorewwwi.onion/
banthar 11y ago
Isn't SSL on .onion domains redundant? It makes sense for onion -> open web, but shouldn't onion -> onion connections be already both authenticated and encrypted?
- johnmaguire2013 11y ago
  I believe the exit node may still be able to view traffic in plaintext. This is part of the reason that running an exit node is so "dangerous" in the US. edit: Though with a quick Google, I'm led to believe that an exit node is only important when you are leaving the onion network (i.e. when entering into the Internet), and thus it sounds like SSL on a hidden service would indeed be superfluous to me. However, SSL also proves authenticity, not just encryption. It would let you know that the hidden service you are accessing is indeed who you think it is.
  - banthar 11y ago
    That's onion -> web. If you are connecting to onion address, your packets do not enter plain text internet. Unless you are using some sort of "enter node".
    - johnmaguire2013 11y ago
      I edited my comment a minute after posting to reflect that. Thanks.
  - noondip 11y ago
    Exit nodes are not involved when making connections to Hidden Services. See https://www.torproject.org/docs/hidden-services.html.en https://www.torproject.org/docs/hidden-services.html.en
    - johnmaguire2013 11y ago
      I edited my comment a minute after posting to reflect that. Thanks.
  - 11y ago
ape4 11y ago
What's Facebook (privacy enemy) doing in there.
- elros 11y ago
  They're not the enemy of privacy in general. They're the enemy of privacy between you and them. If they can make sure that not only they can get your data, but also that noone else can get it too, that's a win in their book.
- deleted 11y ago
  [deleted]
- jlgaddis 11y ago
  Damage control?
- shpx 11y ago
  facebookcorewwwi.onion You can use fb from tor, so they have an interest in that staying the case. The reason was that their fraud detection was going off on tor users, so they just made a service https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237 https://www.facebook.com/notes/protect-the-graph/making-conn...
- Natanael_L 11y ago
  A leaky data silo isn't a silo anymore
pcl 11y ago
I've always thought that these addresses should have a different scheme, not a different TLD. For example, onion://aoeusnth instead of http://aoeusnth.onion http://aoeusnth.onion Is there any reason in particular why the TLD approach was settled upon instead of a scheme-based approach?
- AndyMcConachie 11y ago
  I think the simple answer is that they started doing it a certain way and then didn't want to change it.
- HeavenFox 11y ago
  Because xxx.onion is essentially hostname. One can conceivably have https://example.onion https://example.onion, ftp://example.onion, telnet://example.onion, and so on.
- rys 11y ago
  The reason it has to be done at the DNS level, rather than at the URI scheme level, is because any protocol can be routed over TOR.
  - pcl 11y ago
    Well, there's nothing keeping a well-defined tor scheme from including the protocol information in it, is there? For example, I could imagine specifying a tor URI in my git config: onion:ssh:pcl@aoeusnth or onion:http:aoeusnth
    - vodik 11y ago
      The point is its still http. Think of TOR as acting like a VPN or point-to-point tunnel. You can conceptually think of it as another network interface plugged into your network. The policy you choose what to route over it is your own. It doesn't affect how any other protocols function. I can still access regular sites over TOR. I can also access regular websites over a VPN. openvpn+http:// http:// isn't exactly useful either for the same reason. And there are other special tld. Your multicast domain group (e.g. .local) is also special. Your dns resolver sees the TLD and resolves it specially. But once again, doing multicast DNS doesn't impact http, git, ssh, etc. So it be silly to have to write mdns+http://.. http://... as well. And if you where to join them, then you have to describe what kind of behaviour should happen if, for example, on openvpn+http://foobar.tld http://foobar.tld you hit a hyperlink to http://baz.tld http://baz.tld. Do I rewrite this to prepend openvpn+? Fail? etc.
deleted 11y ago
[deleted]
- deleted 11y ago
  [deleted]
telescope7 11y ago
Measuring the Leakage of Onion at the Root “A measurement of Tor’s .onion pseudo-top-level domain in the global domain name system” [https://www.petsymposium.org/2014/papers/Thomas.pdf https://www.petsymposium.org/2014/papers/Thomas.pdf]
deleted 11y ago
[deleted]

161 points by finnn 11y ago

It's the sensible, pragmatic thing for them to do. Allowing .onion to be allocated as a "real" TLD would just be disruptive and confusing at this point. The implications with regard to SSL certificates are interesting, though, and I'm curious how long it'll take for SSL providers to start supporting that. :)

finnn 11y ago
Digicert has already issued at least one certificate to a .onion address[0]. See [1] for additional info [0]: https://blog.digicert.com/anonymous-facebook-via-tor/ https://blog.digicert.com/anonymous-facebook-via-tor/ [1]: https://blog.digicert.com/the-current-state-of-onion-certificates-and-what-happens-next/ https://blog.digicert.com/the-current-state-of-onion-certifi...
- celticninja 11y ago
  blockchain.info also has an SSL cert on their .onion site
  - buu700 11y ago
    Fun fact: Cyph's certificate from DigiCert is the first EV cert ever deployed to a .onion address (https://cyphdbyhiddenbhs.onion https://cyphdbyhiddenbhs.onion).
jlgaddis 11y ago
What are the benefits to using SSL/TLS certificates on a hidden service? Perhaps a better question is: are there any benefits other than just providing an additional layer of encryption that a potential attacker would have to defeat -- there's already end-to-end encryption when using hidden services (even if there isn't any encryption at the application layer)? ETA: I just remembered that hidden services use 1024-bit RSA keys and there's been some arguments lately that that may not be enough bits. For some sites, using (at least) a 2048-bit key may be necessary.
- jandrese 11y ago
  Well, it would encrypt the traffic from your TOR endpoint to the application. Usually this is on the same box so it's not a big deal, but not always.
  - dogma1138 11y ago
    All traffic to TOR hidden services is encrypted end to end, SSL can add additional level of authentication tho. If it's not a hidden service then you can't really use an .onion address anyhow.
    - jlgaddis 11y ago
      You're correct, but I think his point was that the Tor endpoint (i.e. the host connected to the Tor network) and, e.g., the host actually serving up the content aren't necessarily one and the same (although they usually are). In those instances, an SSL certificate would provide encryption all the way from the "Tor client", through the Tor network, the rendevous point, Tor endpoint, and to the actual application server. Without additional encryption in use at the application layer, the link from the Tor (hidden service) endpoint and the actual server would not be encrypted and, thus, vulnerable. To (perhaps) explain better, this would be similar to how Cloudflare offers SSL for all sites and while the path from the end user to Cloudflare is (can be) encrypted, the link from Cloudflare back to the origin server isn't necessarily encrypted. Alternatively, think of the link from an SSL terminating device to the backend web servers. Again, in most cases, this is a non-issue but there certainly are some instances in which it would apply (and this is probably more likely the bigger a site (hidden service) is).
  - deleted 11y ago
    [deleted]
- vbezhenar 11y ago
  EV certificates add green buttons with company names. Registrar checked that this company indeed exists and legal. So you can be sure, that you didn't mistype URL. And may be some users are comfortable with HTTPS scheme. Another concern is that major browsers might obsolete HTTP scheme, so their UI will warn user about insecure connection. I'm not sure whether browsers will be able to distinct between onion sites and regular sites in that aspect.

vegabook 11y ago

Tor gets an upvote from the establishment. Is that furthering the cause of privacy? So we'll now get more exit nodes? Personally believe that nothing less than a wholesale transport-layer alternative to the internet is necessary to maintain communications freedom. Not far fetched to suggest that rooftop antennae running peer-to-peer mesh networks will gather momentum in coming years. Not to replace the internet, just as backup, to keep centralised government interests and moneymen at bay.

DasIch 11y ago
It's not far fetched to suggest people start seriously running peer-to-peer mesh networks, it's ridiculous. You won't be able to convince the people who know about them to run them and you'd need to convince far more people than that to actually get mesh networks to run reasonably well. This is ignoring the technical and legal challenges not to mention the fact that people have tried this for a very long time now and they've failed to get anywhere significant for just as long.
- vegabook 11y ago
  If your criteria for "getting anywhere significant" is to be even within two orders of magnitude as performant as the current internet, then you are correct. If however the aim is to build a distributed, no single point of failure/control, kbps-class, backup communications system, that's primarily community-based, and that is NOT controlled by any corporation, ISP, or government, then there are many such networks already in existence. They're based on wifi, and completely legal. Clearly they're hobby projects but that doesn't make them uninteresting or indeed, potentially extremely useful in low-delta scenarios of societal breakdown and/or centralised oppression.
  - DasIch 11y ago
    I'm not talking about bandwidth, I'm talking about coverage alone. Berlin for example are many people that are into Freifunk and such networks. There are many more people into technology and the culture and politics associated with it. Nevertheless they can't even get decent coverage. The network is worthless not because it works badly, they fail to create an accessible one to begin with.

splitdisk 11y ago

Now we just need to find a Tor user with enough money to buy EV certificates...

detaro 11y ago
like facebook? https://facebookcorewwwi.onion/ https://facebookcorewwwi.onion/

banthar 11y ago

Isn't SSL on .onion domains redundant? It makes sense for onion -> open web, but shouldn't onion -> onion connections be already both authenticated and encrypted?

johnmaguire2013 11y ago
I believe the exit node may still be able to view traffic in plaintext. This is part of the reason that running an exit node is so "dangerous" in the US. edit: Though with a quick Google, I'm led to believe that an exit node is only important when you are leaving the onion network (i.e. when entering into the Internet), and thus it sounds like SSL on a hidden service would indeed be superfluous to me. However, SSL also proves authenticity, not just encryption. It would let you know that the hidden service you are accessing is indeed who you think it is.
- banthar 11y ago
  That's onion -> web. If you are connecting to onion address, your packets do not enter plain text internet. Unless you are using some sort of "enter node".
  - johnmaguire2013 11y ago
    I edited my comment a minute after posting to reflect that. Thanks.
- noondip 11y ago
  Exit nodes are not involved when making connections to Hidden Services. See https://www.torproject.org/docs/hidden-services.html.en https://www.torproject.org/docs/hidden-services.html.en
  - johnmaguire2013 11y ago
    I edited my comment a minute after posting to reflect that. Thanks.
- 11y ago

ape4 11y ago

What's Facebook (privacy enemy) doing in there.

elros 11y ago
They're not the enemy of privacy in general. They're the enemy of privacy between you and them. If they can make sure that not only they can get your data, but also that noone else can get it too, that's a win in their book.
deleted 11y ago
[deleted]
jlgaddis 11y ago
Damage control?
shpx 11y ago
facebookcorewwwi.onion You can use fb from tor, so they have an interest in that staying the case. The reason was that their fraud detection was going off on tor users, so they just made a service https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237 https://www.facebook.com/notes/protect-the-graph/making-conn...
Natanael_L 11y ago
A leaky data silo isn't a silo anymore

pcl 11y ago

I've always thought that these addresses should have a different scheme, not a different TLD. For example, onion://aoeusnth instead of http://aoeusnth.onion http://aoeusnth.onion Is there any reason in particular why the TLD approach was settled upon instead of a scheme-based approach?

AndyMcConachie 11y ago
I think the simple answer is that they started doing it a certain way and then didn't want to change it.
HeavenFox 11y ago
Because xxx.onion is essentially hostname. One can conceivably have https://example.onion https://example.onion, ftp://example.onion, telnet://example.onion, and so on.
rys 11y ago
The reason it has to be done at the DNS level, rather than at the URI scheme level, is because any protocol can be routed over TOR.
- pcl 11y ago
  Well, there's nothing keeping a well-defined tor scheme from including the protocol information in it, is there? For example, I could imagine specifying a tor URI in my git config: onion:ssh:pcl@aoeusnth or onion:http:aoeusnth
  - vodik 11y ago
    The point is its still http. Think of TOR as acting like a VPN or point-to-point tunnel. You can conceptually think of it as another network interface plugged into your network. The policy you choose what to route over it is your own. It doesn't affect how any other protocols function. I can still access regular sites over TOR. I can also access regular websites over a VPN. openvpn+http:// http:// isn't exactly useful either for the same reason. And there are other special tld. Your multicast domain group (e.g. .local) is also special. Your dns resolver sees the TLD and resolves it specially. But once again, doing multicast DNS doesn't impact http, git, ssh, etc. So it be silly to have to write mdns+http://.. http://... as well. And if you where to join them, then you have to describe what kind of behaviour should happen if, for example, on openvpn+http://foobar.tld http://foobar.tld you hit a hyperlink to http://baz.tld http://baz.tld. Do I rewrite this to prepend openvpn+? Fail? etc.

deleted 11y ago

[deleted]

deleted 11y ago
[deleted]

telescope7 11y ago

Measuring the Leakage of Onion at the Root “A measurement of Tor’s .onion pseudo-top-level domain in the global domain name system” [https://www.petsymposium.org/2014/papers/Thomas.pdf https://www.petsymposium.org/2014/papers/Thomas.pdf]

deleted 11y ago

[deleted]