3 ms·

Next, I hope they focus on issuing certificates for .onion addresses. On the modern web many features and protocols are locked behind HTTPS. The owner of a .oni

Next, I hope they focus on issuing certificates for .onion addresses. On the modern web many features and protocols are locked behind HTTPS. The owner of a .onion has a key pair for it, so proving ownership is more trustworthy than even DNS.

londons_explore 10mo ago
But isn't it unnecessary to use https, since tor itself encrypts and verifies the identity of the endpoint?
- rnhmjoj 10mo ago
  Yes, but browsers moan if you connect to a website without https, no matter if it's on localhost or an onion service.
  - creatonez 10mo ago
    Tor Browser handles this, it treats `.onion` as a secure context.
  - tucnak 10mo ago
    Well, you're not supposed to use Tor from browsers that don't explicitly support it. Tor Browser, Brave, and I'm sure some others really wouldn't mind HTTP hidden service traffic.
- charcircuit 10mo ago
  For example HTTP/2 and HTTP/3 require HTTPS. While technically HTTPS is redundant, .onion sites should avoid requiring browsers to add special casing for them due to their low popularity compared to regular web sites.
  - tucnak 10mo ago
    What are benefits of HTTP/2 and HTTP/3 for Tor hidden service traffic?
    - charcircuit 10mo ago
      Considerably faster page load times due to being able to continue to use the same connection for each request.
- gizmo686 10mo ago
  It would give you a certificate chain which may authenticate the onion service as being operated as who it purports to. Of course, depending on context, a certificate that is useful for that purpose might itself be too much if an information leak
  - huhhuh 10mo ago
    DV certificates (that lets encrypt) provides offer no verification of the owner. EV certificates for .onion could be actually useful though, but one generally has to pay for EV cert.
    - andrewaylett 10mo ago
      A certificate that's valid for both a regular domain and an onion domain gives you a degree of confidence of common ownership.
throw0101d 10mo ago
'Automated Certificate Management Environment (ACME) Extensions for ".onion" Special-Use Domain Names' * https://datatracker.ietf.org/doc/html/rfc9799 https://datatracker.ietf.org/doc/html/rfc9799 * https://acmeforonions.org https://acmeforonions.org * https://onionservices.torproject.org/research/appendixes/acme/ https://onionservices.torproject.org/research/appendixes/acm...

londons_explore 10mo ago

But isn't it unnecessary to use https, since tor itself encrypts and verifies the identity of the endpoint?

rnhmjoj 10mo ago
Yes, but browsers moan if you connect to a website without https, no matter if it's on localhost or an onion service.
- creatonez 10mo ago
  Tor Browser handles this, it treats `.onion` as a secure context.
- tucnak 10mo ago
  Well, you're not supposed to use Tor from browsers that don't explicitly support it. Tor Browser, Brave, and I'm sure some others really wouldn't mind HTTP hidden service traffic.
charcircuit 10mo ago
For example HTTP/2 and HTTP/3 require HTTPS. While technically HTTPS is redundant, .onion sites should avoid requiring browsers to add special casing for them due to their low popularity compared to regular web sites.
- tucnak 10mo ago
  What are benefits of HTTP/2 and HTTP/3 for Tor hidden service traffic?
  - charcircuit 10mo ago
    Considerably faster page load times due to being able to continue to use the same connection for each request.
gizmo686 10mo ago
It would give you a certificate chain which may authenticate the onion service as being operated as who it purports to. Of course, depending on context, a certificate that is useful for that purpose might itself be too much if an information leak
- huhhuh 10mo ago
  DV certificates (that lets encrypt) provides offer no verification of the owner. EV certificates for .onion could be actually useful though, but one generally has to pay for EV cert.
  - andrewaylett 10mo ago
    A certificate that's valid for both a regular domain and an onion domain gives you a degree of confidence of common ownership.

throw0101d 10mo ago

'Automated Certificate Management Environment (ACME) Extensions for ".onion" Special-Use Domain Names' * https://datatracker.ietf.org/doc/html/rfc9799 https://datatracker.ietf.org/doc/html/rfc9799 * https://acmeforonions.org https://acmeforonions.org * https://onionservices.torproject.org/research/appendixes/acme/ https://onionservices.torproject.org/research/appendixes/acm...