4 ms·

Good for the New Yorker; I hope this catches on. Unfortunately, if the encryption is not end-to-end, the data is not secure. In fact, the NSA may choose to hang

Good for the New Yorker; I hope this catches on. Unfortunately, if the encryption is not end-to-end, the data is not secure. In fact, the NSA may choose to hang out and watch the unsecured traffic flow. The New Yorker should make the traffic a little more secure by encrypting traffic (using https). There have been past instances where similar weaknesses were exploited by sniffers: http://www.wired.com/politics/security/news/2007/09/embassy_hacks?currentPage=all http://www.wired.com/politics/security/news/2007/09/embassy_...

deleted 13y ago
[deleted]
zokier 13y ago
Do CAs actually sign .onion certs? Of course they could go self-signed with fingerprint on the public-web site, but that would make it more difficult to use for fairly minor gain.
ef4 13y ago
That vulnerability applies when accessing normal web pages via Tor. But that's now what the New Yorker has set up. They're hosting a Tor hidden service, and in that case Tor is necessarily encrypting the traffic end-to-end.
- 286c8cb04bda 13y ago
  The problem is that you got the .onion address from an unsecured web page. Someone between you and that unsecured web page could've changed the .onion address and when you went there you would be visiting a Strongbox hosted by the NSA rather than one for The New Yorker.
  - mcdigman 13y ago
    This is why you typically want to publish things like this as far and wide as possible - if any single source is compromised, it can be detected by noticing a discrepancy between two publicly available addresses. I'd wager they'll put it in their print edition (same as their physical address and phone number) from now on, because the NSA probably isn't going to everyone's house swapping out their magazines for altered ones, so anyone who gets the magazine will have a hard copy of the address.

4 ms·

Good for the New Yorker; I hope this catches on. Unfortunately, if the encryption is not end-to-end, the data is not secure. In fact, the NSA may choose to hang

by ignostic 13y ago

deleted 13y ago
[deleted]
zokier 13y ago
Do CAs actually sign .onion certs? Of course they could go self-signed with fingerprint on the public-web site, but that would make it more difficult to use for fairly minor gain.
ef4 13y ago
That vulnerability applies when accessing normal web pages via Tor. But that's now what the New Yorker has set up. They're hosting a Tor hidden service, and in that case Tor is necessarily encrypting the traffic end-to-end.
- 286c8cb04bda 13y ago
  The problem is that you got the .onion address from an unsecured web page. Someone between you and that unsecured web page could've changed the .onion address and when you went there you would be visiting a Strongbox hosted by the NSA rather than one for The New Yorker.
  - mcdigman 13y ago
    This is why you typically want to publish things like this as far and wide as possible - if any single source is compromised, it can be detected by noticing a discrepancy between two publicly available addresses. I'd wager they'll put it in their print edition (same as their physical address and phone number) from now on, because the NSA probably isn't going to everyone's house swapping out their magazines for altered ones, so anyone who gets the magazine will have a hard copy of the address.