3 ms·
> you are guaranteed to be connected to what you expect — or not at all. Exactly the same guarantees are also achieved by putting your clearnet address on HSTS
by rosndo 5y ago
> you are guaranteed to be connected to what you expect — or not at all.
Exactly the same guarantees are also achieved by putting your clearnet address on HSTS Preload lists, or by writing https:// https:// in front of the url on the users side.
- kevincox 5y agoBut then you are relying on the CA system which is a huge risk. A significant benifit of onion addresses is that The key is distributed with the address. So as long as you get the address over a secure channel you are safe. With https you need to get the address over a secure channel and hope that no CAs are compromised. The secure channel might be easier (because you can quickly memozrize twitter.com) but to avoid the second you need some complicated and not officially supported certificate pinning.
- rosndo 5y agoThanks to certificate transparency the CA system is really not a huge risk.
- crtasm 5y agoAre all the CAs in your browser (and those of your site's users) trust list doing proper public logging now?
- rosndo 5y agoIt’s been mandatory since 2018. Browsers will reject certificates which have not been publicly logged. Perhaps next you’ll wonder if it’s as simple as compromising a CA and a CT log? Nope, as browsers require cryptographic attestations from multiple CT logs. If you’re using Chrome, one of those logs has to be the one operated by Google. Also such collusion will soon be defeated by SCT auditing https://www.hardenize.com/blog/certificate-transparency-sct-auditing https://www.hardenize.com/blog/certificate-transparency-sct-... https://docs.google.com/document/d/16G-Q7iN3kB46GSW5b-sfH5MO3nKSYyEb77YsM7TMZGE/mobilebasic https://docs.google.com/document/d/16G-Q7iN3kB46GSW5b-sfH5MO...