4 ms·
This is incorrect. Onion domain addresses already provide the same level of confidence as a DV certificate, because they are a public key of the server you are
by dublinben 9y ago
This is incorrect. Onion domain addresses already provide the same level of confidence as a DV certificate, because they are a public key of the server you are connecting to. There would be no additional value in issuing a DV certificate for an .onion domain.
- secabeen 9y agoYes, but how do you know that you are actually connected to nytimes3xpfgragh.onion each time? DV lets you know that the onion site you connected to is the NYTimes, and not a privacy-attacking MITM site. Did you notice that I changed the nytimes URL a tiny bit up there? nytimes3xbfgragh.onion is the real one. (Yes, there's no guarantee that someone else would be able to generate a specific alternate address, but one that also starts with nytimes is probably possible for a well-resourced attacker.)
- dublinben 9y agoDV lets you know that you're connecting to the domain that you're connecting to. You already know that with all onion addresses. EV lets you assure that you are connected to the New York Times.
- detaro 9y agoI believe the original post meant "meaningful as form of identity" to human brains, not technical identity.
- komali2 9y agoI'm trying to understand onion/tor better, what about Onion addresses specifically make them I guess invulnerable to man in the middle attacks?
- detaro 9y agoThe public key is encoded in the onion address, so the client can verify the server you connect to has the matching private key. This is part of the tor protocol, so happens always when talking to onion services.
- xorcist 9y agoOnion domains are a form of content addressing based on public key pairs. Normally onion domains aren't that readable as the nytimes one and look more like a bunch of random letters. (All nytimes did was generate many million key pairs until they found one that looked cool.) If you fetch web pages from http://abc123.onion http://abc123.onion you bascially tell tor "connect me to whoever holds the certificate with fingerprint abc123". Any domain validated certificates on top of that is superfluous since you already know which certificate you are talking to. What you don't know is who holds it. This is where organizationally validated certificates can help.
- nailer 9y agoI believe you've misread my post. A domain name is a poor form of identity in many cases, a hash is even less recognisable to most people.