3 ms·

So Eve could also get a cert for facebookcorewwwi.onion?

• iancarroll 12y ago
  Yes. I submitted a request for one just now, actually. Hopefully the CA doesn't flag it for containing Facebook.
  • iancarroll 12y ago
    Just had it issued. Probably going to write a blog post now.
    • AmustheGreat 12y ago
      Did you get it from DigiCert? Or from another CA?
      • iancarroll 12y ago
        GlobalSign. edit: They've revoked the cert. :(
        • mike_hearn 12y ago
          But does TBB check for revocations? I bet the answer is no because otherwise it'd be sending the sites you visit to CA's via OCSP and Tor would never want that. So I think you still win.
          • e12e 12y ago
            You could still get a full revocation list (via Tor or not). In fact using OCSP over Tor should be safe? FB sees some-exit-node, sends you a cert, CA sees some-other-or-same-but-not-provably-you requesting status of FBs cert. Unless FB sent you a specially craftet, session-spesific cert, CA would only see that "someone" checked the status of FBs cert. And with no immediate link between "you" and "someone"? Much as DNS over Tor is safe (but DNS over udp isn't)?