4 ms·
> Is there any technical reason why they cant use protonmail.onion? Sure, there is. You can read about it in the Tor Phishing Resistance section of the article
by xkxx 10y ago
> Is there any technical reason why they cant use protonmail.onion?
Sure, there is. You can read about it in the Tor Phishing Resistance section of the article.
> Onion site addresses are 16-character hashes of encryption keys that typically look like this: 3ens52v5u7fei76b.onion. The problem is that there is no good way to differentiate between 3ens52v5u7fei76b.onion and 3lqpblf7bsm532xz.onion, as to the human eye, both are equally unrecognizable. This opens up a phishing risk because a phishing site can trivially be created and unless the 16-character random URL is checked carefully each time, users cannot be certain they are visiting the correct onion site. From a usability standpoint, it is not really realistic to expect users to perform this check every single time.
> To bypass this problem, we used ProtonMail’s spare CPU capacity to generate millions of encryption keys and then hashed them, using a “brute force” approach to find a more human readable hash for our onion address. The end result, after expending considerable CPU time, is the following address which is much more resistant to phishing:
protonirockerxow.onion as it can be easily remembered as: proton i rocker xow
- lazyeye 10y agoCheers. Thanks for the detailed explanation.