4 ms·
Why do .onion domain names need certificates, if Tor already enforces that only the party with the corresponding private key can see traffic to them?
by josephcsible 2y ago
Why do .onion domain names need certificates, if Tor already enforces that only the party with the corresponding private key can see traffic to them?
- mcpherrinm 2y agoI think the main reason is it allows for easier access to Tor hidden sides with a “regular” web browser. Consider a wifi network that exposed .onion domains via normal DNS, or a VPN, or other similar mechanisms. It’s not as good as Tor browser, but may be a lot more accessible.
- keepamovin 2y agoThe last hop off the relay is unencrypted breaking the security model. Also, some browser features only work on HTTPS sites.
- josephcsible 2y ago> The last hop off the relay is unencrypted breaking the security model. Isn't that only true of using Tor to access regular websites, not hidden services?
- keepamovin 2y agoYes, thank you, I think I had the wrong idea, I probably didn’t know. I looked it up and: so long as the tor service and the web server are on the same machine, and operated by the same people - i think that’s true. But they don’t need to be on the same machine, or managed by the same person. Some more info: https://community.torproject.org/onion-services/advanced/https/#:~:text=Related%20to%20the%20previous%20point,be%20on%20the%20same%20machine. https://community.torproject.org/onion-services/advanced/htt...