4 ms·
A .onion cert is pretty useless though, besides being revocable I guess. Access to .onion domains is already secured.
by AgentME 12y ago
A .onion cert is pretty useless though, besides being revocable I guess. Access to .onion domains is already secured.
- nevir 12y agoCerts don't secure the connection; they establish the identity of the server you're connecting to (i.e. trust). This should help that. You can be more confident that it's not being man in the middled.
- icebraining 12y agoThe point is that you should already be confident, because the .onion address itself establishes the identity of the server.
- billpg 12y ago.onion establishes the identity of the key. If they ever lost control of the key and had to replace it, they would need a new .onion domain.
- mike-cardwell 12y agoOne use: On https://example.com/ https://example.com/ I add: <script src="//example.onion/x.js"></script> x.js contains: alert( "I notice you can access Tor hidden services. We have" + "a hidden service address at example.onion by the way" ); The only way this would work when you are using SSL on example.com is if you are also using SSL on example.onion.
- elsjaako 12y agoI had a friend that used the wikipedia page on the silk road to get the silk road address, and he fell for a fake version of the website (someone had changed the wikipedia entry). A cert could protect against that.
- AlyssaRowan 12y agoA certificate could pin an .onion key to a real entity, if the entity in question wants to do that. But for a Silk Road-like marketplace? Uh, sure: why don't they incorporate, print business cards, lease an office, do an IPO and invite the FBI to the opening party while they're at it? ;-)