3 ms·

This is an unfortunate downside of onion URLs and a restriction imposed by Zooko's triangle (the CAP theorem of naming systems)[1]. One possible solution would

by cyphar 7y ago

This is an unfortunate downside of onion URLs and a restriction imposed by Zooko's triangle (the CAP theorem of naming systems)[1]. One possible solution would be to issue a TLS certificates for both the clear-web and .onion domain (for services which are offering .onion services to provide better anonymity for users not their servers). Unfortunately, the CAB forum has decided to not allow this -- only EV certificates can be issued for .onion services so you can't use LetsEncrypt for this. [1]: https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle

tgragnato 7y ago
I was looking for the name of the CAP theorem, thanks for posting this! HN discussed (https://news.ycombinator.com/item?id=14038013 https://news.ycombinator.com/item?id=14038013) about the issue and the post (https://blog.torproject.org/cooking-onions-names-your-onions https://blog.torproject.org/cooking-onions-names-your-onions) outlines some of the ways in which you can mitigate right now. Cloudflare is using the 'alt-svc' header (https://blog.cloudflare.com/cloudflare-onion-service/ https://blog.cloudflare.com/cloudflare-onion-service/).. The CIA is not, I'd have loved it. curl -I https://www.cia.gov/index.html https://www.cia.gov/index.html HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: text/html ETag: "<>" Last-Modified: Tue, 28 May 2019 15:05:25 GMT Content-Length: <> ID: <> SESSION: <> Date: Thu, 30 May 2019 12:36<> GMT Connection: keep-alive Set-Cookie: _session_=<>; path=/; domain=cia.gov; secure; HttpOnly ID: <> SESSION: <>
- kodablah 7y ago
  > Cloudflare is using the 'alt-svc' header [...] The CIA is not, I'd have loved it. It should be noted that alt-svc is an HTTP header returned which means you have first made an HTTP request before the onion request which affects anonymity. It's not a big deal over Tor because that HTTP call is on an exit node, but still should be noted.

by cyphar 7y ago

tgragnato 7y ago

I was looking for the name of the CAP theorem, thanks for posting this! HN discussed (https://news.ycombinator.com/item?id=14038013 https://news.ycombinator.com/item?id=14038013) about the issue and the post (https://blog.torproject.org/cooking-onions-names-your-onions https://blog.torproject.org/cooking-onions-names-your-onions) outlines some of the ways in which you can mitigate right now. Cloudflare is using the 'alt-svc' header (https://blog.cloudflare.com/cloudflare-onion-service/ https://blog.cloudflare.com/cloudflare-onion-service/).. The CIA is not, I'd have loved it. curl -I https://www.cia.gov/index.html https://www.cia.gov/index.html HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: text/html ETag: "<>" Last-Modified: Tue, 28 May 2019 15:05:25 GMT Content-Length: <> ID: <> SESSION: <> Date: Thu, 30 May 2019 12:36<> GMT Connection: keep-alive Set-Cookie: _session_=<>; path=/; domain=cia.gov; secure; HttpOnly ID: <> SESSION: <>

kodablah 7y ago
> Cloudflare is using the 'alt-svc' header [...] The CIA is not, I'd have loved it. It should be noted that alt-svc is an HTTP header returned which means you have first made an HTTP request before the onion request which affects anonymity. It's not a big deal over Tor because that HTTP call is on an exit node, but still should be noted.