I've no idea how your "VPN extension" loaded the onion but I have heard of some VPN providers who will proxy .onion. In these cases the VPN provider gets to see all your traffic to the onion, it's not encrypted at all when traversing the VPN providers network. This clearly breaks the end-to-end encryption properties of an onion address.

As for putting an onion address into applications, there is now RFC 7686 which sets aside the .onion domain as a special use case, any applications which respect this RFC should throw an error if they're not able to use Tor to access it. However, clearly not all applications implement this RFC. This should stop them from from leaking addresses you try to visit through DNS requests.

If a leak does occur then anyone between you and the DNS resolver will know that you tried to resolve the .onion address. We've known for some years now that these kinds of leaks are actively being watched for by intelligence agencies, as evidenced by the "Tor Stinks" NSA slide deck.

On Dumb Users (EPICFAIL):

Analytics: Dumb Users (EPICFAIL) (S//SI)

GCHQ QFD that looks for Tor users when they are not using Tor.

On DNS:

Analytics: DNS (TS//SI)

How does Tor handle DNS requests? Are DNS requests going through Tor? Does this depend on how the target is using Tor?

I would expect that anything intelligence agencies were doing half a decade ago, other smaller adversaries too would be performing now (e.g. Law enforcement, private intelligence and surveillance companies).

I've no idea how your "VPN extension" loaded the onion but I have heard of some VPN providers who will proxy .onion. In these cases the VPN provider gets to see all your traffic to the onion, it's not encrypted at all when traversing the VPN providers network. This clearly breaks the end-to-end encryption properties of an onion address.

As for putting an onion address into applications, there is now RFC 7686 which sets aside the .onion domain as a special use case, any applications which respect this RFC should throw an error if they're not able to use Tor to access it. However, clearly not all applications implement this RFC. This should stop them from from leaking addresses you try to visit through DNS requests.

If a leak does occur then anyone between you and the DNS resolver will know that you tried to resolve the .onion address. We've known for some years now that these kinds of leaks are actively being watched for by intelligence agencies, as evidenced by the "Tor Stinks" NSA slide deck.

On Dumb Users (EPICFAIL):

Analytics: Dumb Users (EPICFAIL) (S//SI)

GCHQ QFD that looks for Tor users when they are not using Tor.

On DNS:

Analytics: DNS (TS//SI)

How does Tor handle DNS requests? Are DNS requests going through Tor? Does this depend on how the target is using Tor?

I would expect that anything intelligence agencies were doing half a decade ago, other smaller adversaries too would be performing now (e.g. Law enforcement, private intelligence and surveillance companies).

I've no idea how your "VPN extension" loaded the onion but I have heard of some VPN providers who will proxy .onion. In these cases the VPN provider gets to see all your traffic to the onion, it's not encrypted at all when traversing the VPN providers network. This clearly breaks the end-to-end encryption properties of an onion address.

As for putting an onion address into applications, there is now RFC 7686 which sets aside the .onion domain as a special use case, any applications which respect this RFC should throw an error if they're not able to use Tor to access it. However, clearly not all applications implement this RFC. This should stop them from from leaking addresses you try to visit through DNS requests.

If a leak does occur then anyone between you and the DNS resolver will know that you tried to resolve the .onion address. We've known for some years now that these kinds of leaks are actively being watched for by intelligence agencies, as evidenced by the "Tor Stinks" NSA slide deck.

On Dumb Users (EPICFAIL):

Analytics: Dumb Users (EPICFAIL) (S//SI)

 

GCHQ QFD that looks for Tor users when they are not using Tor.

On DNS:

Analytics: DNS (TS//SI)

 

How does Tor handle DNS requests? Are DNS requests going through Tor? Does this depend on how the target is using Tor?

I would expect that anything intelligence agencies were doing half a decade ago, other smaller adversaries too would be performing now (e.g. Law enforcement, private intelligence and surveillance companies).

I've no idea how your "VPN extension" loaded the onion but I have heard of some VPN providers who will proxy .onion. In these cases the VPN provider gets to see all your traffic to the onion, it's not encrypted at all when traversing the VPN providers network. This clearly breaks the end-to-end encryption properties of an onion address.

As for putting an onion address into applications, there is now RFC 7686 which sets aside the .onion domain as a special use case, any applications which respect this RFC should throw an error if they're not able to use Tor to access it. However, clearly not all applications implement this RFC. This should stop them from from leaking addresses you try to visit through DNS requests.

If a leak does occur then anyone between you and the DNS resolver will know that you tried to resolve the .onion address. We've known for some years now that these kinds of leaks are actively being watched for by intelligence agencies, as evidenced by the "Tor Stinks" NSA slide deck.

On Dumb Users (EPICFAIL):

Analytics: Dumb Users (EPICFAIL) (S//SI)

GCHQ QFD that looks for Tor users when they are not using Tor.

On DNS:

Analytics: DNS (TS//SI)

How does Tor handle DNS requests? Are DNS requests going through Tor? Does this depend on how the target is using Tor?

I would expect that anything intelligence agencies were doing half a decade ago, other smaller adversaries too would be performing now (e.g. Law enforcement, private intelligence and surveillance companies).