They link to the HTTP version of their Onion address: http://www.propub3r6espa33w.onion/ http://www.propub3r6espa33w.onion/ A bunch of important resources lik

They link to the HTTP version of their Onion address: http://www.propub3r6espa33w.onion/ http://www.propub3r6espa33w.onion/ A bunch of important resources like CSS and images fail to load for me because their Content-Security-Policy dictates that non-https resources should be upgraded. However, the certificate isn't trusted, because nobody (other than Facebook apparently) can get a https certificate for an .onion hostname. If I change it to https and accept the certificate, it all works fine. Interestingly, it also works fine when using Tor Browser Bundle. Just not in plain Firefox or Chromium. [edit] In the TBB console: "Content Security Policy: Couldn't process unknown directive 'upgrade-insecure-requests'" - So presumably when TBB is upgraded to use a newer version of Firefox at some point in future, TBB users will start to see the same problem. [edit2] Dropped the guy an email to let him know. [edit3] Although the website is fetched over a hidden service, they still load resources from lots of non-hidden services into the page, from the likes of Facebook, Google, Twitter and so on. They state in the article: "Our readers should never need to worry that somebody else is watching what they’re doing on our site. So we made our site available as a Tor hidden service to give readers a way to browse our site while leaving behind less of a digital trail." A much better way to do this than implementing a Tor hidden service would be to stop handing over visitor data to Google, Facebook, Twitter, Disqus, Reddit and Linkedin.