3 ms·
But then you are relying on the CA system which is a huge risk. A significant benifit of onion addresses is that The key is distributed with the address. So as
by kevincox 5y ago
But then you are relying on the CA system which is a huge risk. A significant benifit of onion addresses is that The key is distributed with the address. So as long as you get the address over a secure channel you are safe.
With https you need to get the address over a secure channel and hope that no CAs are compromised. The secure channel might be easier (because you can quickly memozrize twitter.com) but to avoid the second you need some complicated and not officially supported certificate pinning.
- rosndo 5y agoThanks to certificate transparency the CA system is really not a huge risk.
- crtasm 5y agoAre all the CAs in your browser (and those of your site's users) trust list doing proper public logging now?
- rosndo 5y agoIt’s been mandatory since 2018. Browsers will reject certificates which have not been publicly logged. Perhaps next you’ll wonder if it’s as simple as compromising a CA and a CT log? Nope, as browsers require cryptographic attestations from multiple CT logs. If you’re using Chrome, one of those logs has to be the one operated by Google. Also such collusion will soon be defeated by SCT auditing https://www.hardenize.com/blog/certificate-transparency-sct-auditing https://www.hardenize.com/blog/certificate-transparency-sct-... https://docs.google.com/document/d/16G-Q7iN3kB46GSW5b-sfH5MO3nKSYyEb77YsM7TMZGE/mobilebasic https://docs.google.com/document/d/16G-Q7iN3kB46GSW5b-sfH5MO...