Adding a blacklist for known scam sites?

Question

It seems that the issue of fake/spoofed onion sites is becoming more and more of a problem.

The situation is such that on some more popular sites an incorrect keystroke may expose the user to malicious software, theft of credentials, government scrutiny, or simply fraud.

The lack of a central authority in the Tor network is such that there is no practical means of removing these entities. Therefore, it is incumbent upon the user to put in place practices which will prevent visits to unintended destinations.

Of course no human is perfect, and a failsafe should exist to avert this threat. That then begs the question:

Does the Tor Browser Bundle have the capability of blacklisting, either manually or through a subscription, spoofed sites? Can this be implemented , perhaps via a plug in or added feature?

Answer 1

Replace "onion site" with "clearnet site" - your description of the threats and attack vectors could equally apply to both. The same personal security practices and behaviours should therefore be followed in each case.

However, as soon as you add a centralised authority whose job it is to qualify and judge what is and isn't a spoofed site, and who acts to police hidden services, then you lose part of what makes Tor different to - and some would say better than - the internet at large.

Does the Tor Browser Bundle have the capability of blacklisting, either manually or through a subscription, spoofed sites?

Any subscription service - such as a third party supplying a blacklist - would be centralised, and would need to be trusted.

An additional problem is size of the address space. Any blacklist would need to keep up with the fast pace that .onion domains can be generated and made live, unlike clearnet URLs which have to be centrally registered and associated with a site, and which are therefore more likely to have a longer lifespan.

(The other option of whitelisting genuine sites would perhaps work to an extent, possibly in conjunction with a way to blacklist "similar" addresses, and with a way to decide how similar those addresses should be. Again, this assumes your genuine sites last long enough not to make updating your white/blacklist inconvenient.)

Answer 2

Richard's answer is correct, I'd also add some points:

1. People operating the legitimate sites have a static address, while the people creating clones or scam sites are capable of making arbitrary new addresses (with some effort if they wish to use homonyms) would make maintaining the blacklist an arms race that could easily exceed the capability of finding, verifying and cataloging "bad sites". Blacklisting would not (and never does fully) work.
2. Creating a "whitelist" of "legitimate" sites might place overconfidence in the legitimacy of the site operators. There is no long-term guarantee of their operations remaining legitimate. (This has historic precedent).
3. How do you decide what types of sites get a "whitelist" status? Do certain types of users get protection? Would the maintainers need to be anonymous to avoid them being coerced by law enforcement to promote their honeypots or watering holes? If they are to be anonymous maintainers, how do we establish any meaningful validation or trust in them? This too would fail.

Users should maintain their own list of services they use to ensure they are visiting the legitimate site.

---

None of the following is recommended or endorsed by anyone except me and you shouldn't trust strangers on the internet.

If the user does not wish to keep a persistent, potentially incriminating list of bookmarks. I've written some code that turns an onion address into a "correct horse battery staple" style password. This allows a users to remember a password, and convert that password back into the onion address to aide in the memorability of onion address names.

Available in python and C. The idea is simple, the onion address is a base32 encoding of the first 10 bytes of the sha1 hash of the onions public key. By decoding the onion address to binary and splitting it up into 5 16bit (little-endian) integers, we can create a 5 word passphrase that can be converted back into the onion address itself, alternative implementations encouraged and criticism requested if appropriate.