Slashdot Mirror

← Back to Stories (view on slashdot.org)

More Tor .Onion Sites May Get Digital Certificates Soon

Posted by timothy on from the try-to-stop-from-crying dept.

Trailrunner7 writes News broke last week that Facebook had built a hidden services version of its social network available to users browsing anonymously via the Tor Project's proxy service. Unlike any .onion domain before it, Facebook's would be verified by a legitimate digital signature, signed and issued by DigiCert. Late yesterday, Jeremy Rowley, DigiCert's vice president of business development and legal, explained his company's decision to support this endeavor in a blog entry. He also noted that DigiCert is considering opening up its certification business to other .Onion domains in the future. "Using a digital certificate from DigiCert, Tor users are able to identify the exact .onion address operated by Facebook," Rowley explained. "Tor users can evaluate the digital certificate contents to discover that the entity operating the onion address is the same entity as the one operating facebook.com."

5 of 52 comments (clear)

  1. Re:Why not use Verizon as your ISP as well by Crashmarik · · Score: 4, Insightful

    If you are worried about your government persecuting you Facebook is not the place to hangout. If you want to get your message out to social media get a friend in a less repressive country to post on your behalf. Posting on facebook from someplace like Syria or No Korea would be tantamount to signing your own death warrant.

  2. Lessons previous learned: by Severus+Snape · · Score: 3, Interesting

    Lavabit.

    You would need to be a fucking moron to not believe there is not a warrant drafted for the FISC court already. Trust in any US web stakeholders for any users privacy is fallacy. Never mind when getting up to illegal shenanigans found on .onion like Silk Road.

  3. That's fucking stupid by Anonymous Coward · · Score: 4, Insightful

    The protocol itself cryptographically ensures that you're talking to the same service every time. That's why .onion addresses look funny: The cost of choosing parts of the name grows exponentially with the number of characters you want to choose. Taking over an .onion domain requires "choosing" the entire name, and that's impossible (infeasible to the point of impossibility).

    Using a certificate hierarchy with TOR can only do one thing: Expose you.

  4. Well, anyway ... by CaptainDork · · Score: 3, Informative

    ... I used the Tor browser to get to one of my burner Facebook accounts and it locked me. Such joy. I was coming at the site from another country, so Facebook had a major cow.

    I went mainstream and gave Facebook a tummy rub and all is well, but it was a fun ride.

    I still wonder what the Sam Hill any Facebook member would be doing on Tor, but you can bet your sweet ass that Facebook wants you no matter what route you take.

    --
    It little behooves the best of us to comment on the rest of us.
  5. Re:Wait by jythie · · Score: 4, Informative

    There is also another advantage of things like this, Tor becomes more effective as more people are using it for general tasks. I can recall a while back someone being caught for sending fake bomb threats via Tor. How did they find the person? They were the only one using Tor on their entire network and only used it at the same times the emails were sent.

    So there is an advantage to people simply using Tor for their normal everyday activities like this.