3 ms·

Why is the URL so long? Weren't .onion domains about 16 characters long? Compare with Facebook's hidden service: facebookcorewwwi.onion dns4torpnlfs2if

Why is the URL so long? Weren't .onion domains about 16 characters long? Compare with Facebook's hidden service: facebookcorewwwi.onion dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion Also, how does that website have SSL? Are there Certificate Authorities that can supply certificates for .onion domains now? CloudFlare did the same trick for https://1.1.1.1 https://1.1.1.1 too so perhaps they are just able to do things most people can't.

gant 8y ago
They have an intermediary CA. I wasn't sure too when they launched, but IP addresses as common names aren't against spec / Mozilla CA guidelines.
benjojo12 8y ago
Tor moved to a longer address space because the short one is 1024 bit RSA
- kodablah 8y ago
  To be even clearer, v2 service names are just a part of the RSA key hash whereas v3 service names are a full ed25519 pub key and a couple of other bytes.
whs 8y ago
Facebook also have that domain over SSL. CAB allow EV certificate to be issued for onion domains. https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/ https://cabforum.org/2015/02/18/ballot-144-validation-rules-...
detaro 8y ago
> Are there Certificate Authorities that can supply certificates for .onion domains now Yes, DigiCert does (maybe others too, haven't checked). Facebook was famously the first to have such a certificate. Currently needs to be an EV certificate though. Getting a certificate for an IP also isn't a "trick", it's generally available, although I believe it needs to be in your IP space, so you can't just get it for any random IP you got from your provider.
- markovbot 8y ago
  > Currently needs to be an EV certificate though. "currently" sounds like that might change in the future. I thought the CA/B forum was pretty much opposed to non-EV certs for .onions. Is that not the case? What is the potential use case for non-EV certs on a .onion?
  - Operyl 8y ago
    There’s been a recent push to open it up to DV. The CA/B forum was against it a few years ago, but seems more open to it now.
  - tialaramex 8y ago
    The EFF's representative to CA/B (Seth Schoen) suggested that DV certs for .onion make sense in the v3 onion service world. There wasn't exactly rapturous support, but there were constructive comments from some of the usual suspects on the Browser side of the equation. So far I as know/ remember this discussion died out without anybody producing an actual ballot that could be voted on. Most notably there wasn't a fierce backlash of CA reps yelling that this was an awful idea and they wanted no part in it. So either they're OK with it, or they've decided it won't go anywhere and they don't care. Without a ballot changing the actual Baseline Requirements you'd never know for sure. Personally I'm not convinced DV .onion certificates are a great idea, but I'm not opposed to them either, and it seems some people who own .onion services that aren't legal, or need to be anonymous for whatever reason would like to have such certificates.
    - markovbot 8y ago
      hrm, what would the purpose of such certificates be?
    - deleted 8y ago
      [deleted]

gant 8y ago

They have an intermediary CA. I wasn't sure too when they launched, but IP addresses as common names aren't against spec / Mozilla CA guidelines.

benjojo12 8y ago

Tor moved to a longer address space because the short one is 1024 bit RSA

kodablah 8y ago
To be even clearer, v2 service names are just a part of the RSA key hash whereas v3 service names are a full ed25519 pub key and a couple of other bytes.

whs 8y ago

Facebook also have that domain over SSL. CAB allow EV certificate to be issued for onion domains. https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/ https://cabforum.org/2015/02/18/ballot-144-validation-rules-...

detaro 8y ago

> Are there Certificate Authorities that can supply certificates for .onion domains now Yes, DigiCert does (maybe others too, haven't checked). Facebook was famously the first to have such a certificate. Currently needs to be an EV certificate though. Getting a certificate for an IP also isn't a "trick", it's generally available, although I believe it needs to be in your IP space, so you can't just get it for any random IP you got from your provider.

markovbot 8y ago
> Currently needs to be an EV certificate though. "currently" sounds like that might change in the future. I thought the CA/B forum was pretty much opposed to non-EV certs for .onions. Is that not the case? What is the potential use case for non-EV certs on a .onion?
- Operyl 8y ago
  There’s been a recent push to open it up to DV. The CA/B forum was against it a few years ago, but seems more open to it now.
- tialaramex 8y ago
  The EFF's representative to CA/B (Seth Schoen) suggested that DV certs for .onion make sense in the v3 onion service world. There wasn't exactly rapturous support, but there were constructive comments from some of the usual suspects on the Browser side of the equation. So far I as know/ remember this discussion died out without anybody producing an actual ballot that could be voted on. Most notably there wasn't a fierce backlash of CA reps yelling that this was an awful idea and they wanted no part in it. So either they're OK with it, or they've decided it won't go anywhere and they don't care. Without a ballot changing the actual Baseline Requirements you'd never know for sure. Personally I'm not convinced DV .onion certificates are a great idea, but I'm not opposed to them either, and it seems some people who own .onion services that aren't legal, or need to be anonymous for whatever reason would like to have such certificates.
  - markovbot 8y ago
    hrm, what would the purpose of such certificates be?
  - deleted 8y ago
    [deleted]