3 ms·
Also, if private keys were obtained, it's trivial to republish to the same onion address with any changes you want. This is that one scenario where an EV cert t
by kodablah 8y ago
Also, if private keys were obtained, it's trivial to republish to the same onion address with any changes you want. This is that one scenario where an EV cert that can be revoked has value if you're a non-anonymous hoster. There are other alternative-factor identity verification techniques (e.g. DNS, Alt-Svc HTTP header) but the querying aspect reduces anonymity.
- jamieweb 8y agoWith the DNS and Alt-Src, are you saying that the Onion site identity can be verified by visiting the non-onion version of the site, and then relying on the header/DNS record to take the session onto Tor? Then when the onion service private key is breached, the site operator just changes the header and DNS record to a new, non-breached one? As you say though, querying these does reduce anonymity.
- kodablah 8y agoYup (well, automatically with Alt-Svc when using the Tor browser, some kind of manual TXT record I would guess with DNS, I don't know of anything standardized)