Hacker News new | ask | show | jobs
by cyphar 1872 days ago
Which is a problem that HSTS and the HSTS preload list[1] solve.

[1]: https://hstspreload.org/

1 comments

Can you get a tor hidden service in the preload list?
The HSTS preload checking service doesn't support .onion URLs (not to mention you can only get EV certificates for .onion URLs).

However, Tor onion services cannot be MITM'd by an exit node, because you don't use exit nodes and the connection is end-to-end encrypted (and authenticated -- the URL is also the public key of the hidden service so you'd need their key to spoof the service). So arguably .onion URLs are far harder to attack in this manner than TLS, and the HSTS preload list isn't needed at all to protect .onion URLs.

I don't know, but your connection to a .onion service is encrypted before leaving your machine (no nodes see plain HTTP traffic). It's also authenticated as the domain is derived from the public half of the keypair.