4 ms·
Which is a problem that HSTS and the HSTS preload list[1] solve. [1]: https://hstspreload.org/ https://hstspreload.org/
by cyphar 5y ago
Which is a problem that HSTS and the HSTS preload list[1] solve.
[1]: https://hstspreload.org/ https://hstspreload.org/
- remram 5y agoCan you get a tor hidden service in the preload list?
- crtasm 5y agoI don't know, but your connection to a .onion service is encrypted before leaving your machine (no nodes see plain HTTP traffic). It's also authenticated as the domain is derived from the public half of the keypair.
- cyphar 5y agoThe HSTS preload checking service doesn't support .onion URLs (not to mention you can only get EV certificates for .onion URLs). However, Tor onion services cannot be MITM'd by an exit node, because you don't use exit nodes and the connection is end-to-end encrypted (and authenticated -- the URL is also the public key of the hidden service so you'd need their key to spoof the service). So arguably .onion URLs are far harder to attack in this manner than TLS, and the HSTS preload list isn't needed at all to protect .onion URLs.