4 ms·

There is very little benefit from such addresses http://news.netcraft.com/archives/2014/06/25/steam-phishing-attacks-exploiting-look-alike-domain-names.html ht

• raverbashing 10y ago
  I disagree Domain squatting is even harder on tor, but how am I supposed to know the real Debian is on xyabdjfhkj1345 or xvhdjakeueg12567?
  • ryan-c 10y ago
    Re domain squatting, it's not as hard as you probably think it is to generate an onion addresses that is a near collision.
  • throwaway7767 10y ago
    If debian generated an onion address like debiandebxwnjx6t.onion (just made that up), how would that help you determine that the .onion address is owned by debian? All it proves is that someone ran a vanity key/address generator on his GPU for a couple of days to get a nice-looking prefix. I could do the same thing at home and get a different address with the same prefix, and you wouldn't be able to tell the difference without comparing the whole address.
    • raverbashing 10y ago
      You're right, by itself it doesn't However, with several Debian volunteers they can get a more friendly-looking address. One person alone with a GPU can't compete with that It's a proof of work (just like bitcoin)
      • wcummings 10y ago
        One person with a botnet can compete
  • dublinben 10y ago
    You know because they published this list. This page is HTTPS with a certificate that you (presumably) trust.
  • ashitlerferad 10y ago
    You need a trust path to the Debian sysadmins. The best option right now is the HTTPS on onion.debian.org and the knowledge that Debian uses Lets Encrypt.