5 ms·
>TLS/HSTS is still subject to CA attacks, e.g. diginotar. Largely solved by Certificate Transparency. If you compromise a CA, you can issue certificates. Howev
by Asan1 5y ago
>TLS/HSTS is still subject to CA attacks, e.g. diginotar.
Largely solved by Certificate Transparency. If you compromise a CA, you can issue certificates. However, you can't issue new certificates without broadcasting that fact to the whole world as browsers will not accept certificates without SCTs.
>Reducing load on exit nodes is a technical benefit that's in that blog post.
This hasn't been a real benefit for years. Exit nodes are running at something like 10% capacity.
>Another benefit to using Tor onion services for large sites is that the Tor circuit ID can be used as an additional key in an IP rate limit cache. This helps block Tor bots (on the basis that establishing a Tor circuit is expensive).
This is just another problem with hidden services. Opening circuits costs malicious clients far less cpu time than it costs the server.
- hpcoke 5y ago> This hasn't been a real benefit for years. Exit nodes are running at something like 10% capacity. https://metrics.torproject.org/bandwidth-flags.html https://metrics.torproject.org/bandwidth-flags.html corroborates what you say about utilitisation. Exit nodes are legally difficult to host in many countries, which reduces diversity, which is a risk. Onion services avoid the need the exit nodes, and thus the diversity risk. > This is just another problem with hidden services. Opening circuits costs malicious clients far less cpu time than it costs the server. I had a look for this but couldn't find it.