3 ms·
> This let us issue certificates on .onion. Isn't TOR encrypted up to a hidden service anyway? Why would you HTTPS over TOR? Honest Question.
by jimktrains2 11y ago
> This let us issue certificates on .onion.
Isn't TOR encrypted up to a hidden service anyway? Why would you HTTPS over TOR? Honest Question.
- RaleyField 11y agoProbably authentication of server, but client still remains anonymous.
- m00dy 11y agoThat's true. Exit nodes do not play a role in hidden services. But, Rendezvous point does. So, If your node somehow selected as rendezvous point for meeting, then you could possibly sniff the traffic.
- dchest 11y agoThis is incorrect, exit nodes are not involved with hidden services. Edit: the original comment I replied to stated that exit nodes could sniff traffic. Reply to new comment: The connection is encrypted to the service's public key, what are you talking about? Stop spreading nonsense and go read documentation.
- herbst 11y agoThey cant. That is the whole concept behind the word "onion" that they cant.
- dchest 11y agoIt is encrypted, but when you're going to facebookcorewwwi.onion you only know that you're connecting to server that knows the corresponding private key, of which "facebookcorewwwi" is a hash. Which is already good. However, seeing EV certificate on this domain also shows you that the corresponding private key for HTTPS connection is signed by a certificate authority: that is, if you trust this CA, you can pretty much trust that you're connecting to Facebook, Inc.
- belorn 11y agoTo add on that explenation, EV is about identity. Its what should differential someone pretending to be facebook using facebookcorewwwl.com and the real entity. Its less about encryption and keys, and more about a CA claiming to have looked at the companies registration papers and other government official documents and thus confirmed their identity.