SSL-over-Onion: How Tor can enable verification with DV certs

guest · Mar 15, 2019

SSL-over-Onion
How Tor can enable verification with DV certs
March 14, 2019
https://portswigger.net/daily-swig/how-tor-can-enable-verification-with-dv-certs

But as more and more new web features move towards requiring HTTPS to function, those wanting to use things like WebRTC (Web Real-Time Communication) through Tor may find themselves locked out due to the lack of DV SSL certificates.

“Tor goes to considerable lengths to enable secure networking in a way which people can get running without registering with an ISP, a DNS provider, nor a web host,” Alec Muffett, security researcher and a director at Open Rights Group, told The Daily Swig.

“It seems strange, therefore, that anyone who wants to use HTTPS over these Onion network addresses needs to register themselves with a certificate authority (CA), thereby disclosing their existence to the world via ‘certificate transparency’, and inviting the world’s hackers to try and break in,” he said.
Click to expand...

“Tor already works on HTTPS, it’s already working with zero changes on EV certs, so let’s make a way to have DV certs.”
Muffett proposes a solution to bring Tor’s mechanism of trust onto browsers such as Firefox through the use of homebrew DV certificates, so that the browser can use the assurance that Tor Onions already provide, rather than using a CA.

To implement SSL-over-Onion, sites should be allowed to use homebrew DV certificates, and in the restricted situation of a .onion domain, their ‘homebrew’ nature would be ignored in favor of checks against the Onion address, he says.
Click to expand...

Log in or Sign up

SSL-over-Onion: How Tor can enable verification with DV certs

guest Guest

Log in or Sign up

SSL-over-Onion: How Tor can enable verification with DV certs

guest Guest

Useful Searches