4 ms·
You still have to get a correct onion address from a reputable source otherwise how do you know that you're going to the right onion and not a malicious mirror
by wybiral 9y ago
You still have to get a correct onion address from a reputable source otherwise how do you know that you're going to the right onion and not a malicious mirror or something?
So somehow there is a chain of trust, not too unlike the traditional PKI model.
- zAy0LfpBZLC8mAC 9y agoWhat would be the "correct onion address" for 3fyb44wdhnd2ghhl.onion?
- hedora 9y agoThat is the “correct onion address” for that hashcode, but you have to obtain the hashcode somehow.
- wybiral 9y agoAnd you might be obtaining a fake link from one of my phishing schemes that mimic the services you thought you were visiting...
- c22 9y agoNo one is arguing that onion links are impervious to being lied about. But domain names don't have that property either. In fact, it's somewhat easier to compromise many domain names.
- zAy0LfpBZLC8mAC 9y agoWell, yes, obviously, in order to know something you have to know it!? What I don't understand is what any of that has to do with any sort of "correctness"?! How do you find out the correct name of James Miller? How do you find out the correct domain of google.com? That just seems like a set of nonsensical questions to me.
- axonic 9y agoCouldn't we put the onion address on the site, signed by the site/publishers key? Ignoring key exchange methods for a moment, once you have a key for "Bob the Blogger" you can verify Bob says the address is X and your url is X, so this is Bob's site.