1

According to various sources (like this question) DuckDuckGo has an onion site. However,

  1. I can't easily find any mention of it on their clearnet site (but I stumbled across a special search result page) and
  2. the certificate used on the onion site is not valid for the .onion address, only for *.duckduckgo.com and duckduckgo.com.

Verifying that the .onion certificate is the same as the official one and not from some CA breach is not easy: it seems Firefox doesn't show certificate details in the Page Info when you get a certificate warning. I was finally able to compare them using this command (You can ignore the SSL session differences):

meld \
    <(openssl s_client -connect duckduckgo.com:443 -status <<< '') \
    <(torify openssl s_client -connect 3g2upl4pq6kufc4m.onion:443 -status <<< '') &

What am I supposed to do as an end user in this situation? Not use HTTPS? Ask DuckDuckGo to update their certificate & web site? Verify the certificate manually each time? Or have I misunderstood how .onion sites work?

(DuckDuckGo is just an example; I'm sure there are other .onion sites with the same issues.)

  • SSL is pretty useless when tor is already Point-To-Point encrypted, and you can verify the "certificate" with the address. – php_coder_3809625 Mar 12 '16 at 3:56
  • @php_coder_3809625 How do you mean? The host name "3g2upl4pq6kufc4m.onion" doesn't tell me anything about the owner, and it's trivial to set up a scraping site which just forwards traffic to the real site. So as far as I can tell nothing about the address verifies the owner. – l0b0 Mar 12 '16 at 9:26
  • The address is a summary to the public key of that (client) hidden service node. Also hidden web is built for anonymity so SSL won't get you very far. – php_coder_3809625 Mar 14 '16 at 23:19
3

This is an open question. One suggestion is to actually create a new HTTP header like 'X-Onion-Address: foo.onion', which is only respected after a successful TLS connection is established.

Facebook's approach is to have the onion site's TLS be properly signed and also valid for facebook.com

        X509v3 Subject Alternative Name: 
            DNS:*.facebookcorewwwi.onion, DNS:facebookcorewwwi.onion, DNS:*.m.facebookcorewwwi.onion, DNS:*.fbcdn23dssr3jqnq.onion, DNS:*.xx.fbcdn23dssr3jqnq.onion, DNS:*.xy.fbcdn23dssr3jqnq.onion, DNS:*.xz.fbcdn23dssr3jqnq.onion, DNS:*.fbsbx2q4mvcl63pw.onion, DNS:www.facebook.com

The 'darkweb-everywhere' add-on team (imagine https-everywhere but for onions) also collected evidence of the validity of claims of onion ownership, although it's no longer up to date their collected evidence can be found here: https://github.com/chris-barry/darkweb-everywhere/blob/master/doc/EVIDENCE.md

edit: Also, Firefox/Tor Browser will allow you to view the vertificate. When you click on 'I Understand the Risks -> Add Exception' there is a 'View' button to let you view the certificate and once you've accepted it, you can click the padlock on the URL bar, go to 'More Information' then 'View Certificate' to get the same screen.

2

[waves] Facebook-over-Tor-geek here. It's a toughie, the cleanest thing is to use the same SSL certificate in your clearnet and onion sites, but this only will work if you can use EV certificates on both.

Facebook currently (March 2016) uses DV certificates for our main site - mostly because EV certificates don't currently support wildcards for clearnet address, only for onion addresses.

If the situation changes so that either ".onion" becomes okay for DV certs, or else EV becomes a suitable option for the main site, then maybe there will be a clearnet site which mentions the onion.

However: if you have an EV clearnet certificate for your main site, then I imagine you'd be able to add your onion address to it...

--
Alec Muffett
Facebook Engineering
London

  • +1, but "EV certificates don't currently support wildcards for clearnet address, only for onion addresses." I think you meant the other way around…? – l0b0 Mar 15 '16 at 8:09
  • Incorrect. EV Certificates do not support wildcards, except in the case that the certificate has been issued for an Onion address. See cabforum.org/2015/02/18/… – Alec Muffett Apr 10 '16 at 9:27
0

Don't be hasty ;) First, FF itself is not about to do everything, and you must use add-ons for the exact functionality set you're looking for. The add-ons I'll mention downstrings are - IMHO - a must-have for clearnet too:

and if you're using a standalone/portable FireFox - make sure to use FoxyProxy add-on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.