This is not really a problem with Tor, but within Firefox. One of the certificates which Firefox uses for signing of add-ons is expired. They write about it in their bugtracking system: https://bugzilla.mozilla.org/show_bug.cgi?id=1548973
Hopefully this will fixed within the next hours.
Tor also has the entry #30388 in their bug tracker.
So basically we ...
Anyone with the private key can submit HSDir entries for a .onion address.
There is no "registration" per se, only deriving the private key and its public key, but creating a private key with a specific public key is computationally infeasible.
Those vanity url's like Facebook's facebookcorewwwi.onion are discovered, not registered, by generating billions ...
I had the same 'connection refused' [WSAECONNREFUSED] error after upgrading my firewall (ZoneAlarm free, from 12.0.104 to 13.2.015) and I solved it this way:
Stop Tor (with button on Vidalia control panel)
Change 'firewall settings'
Start Tor again
Error? restart from step 1
I repeated these steps ~10 times to find out that I had to deactivate:
[ ] '...
You can check manually, not as easy as a plugin/extension but...
Steve Gibson makes some handy tools for security, like this section-
Simply comparing a fingerprint from his server and your browser as being identical OR not, as he explains how, will validate if the CA is being spoofed and/or intercepted pretty quick.
Several issues were present:
1) Firewall was too restrictive preventing connections to a necessary port (53, for local dns resolving)
2) Torrc misconfiguration. Not entirely sure which option.
3) Network interface misconfiguration, preventing connections to the IP for was set to use (server had 2 ipv4 ips and /64 block of ipv6
4) Bad cached certs
[waves] Facebook-over-Tor-geek here. It's a toughie, the cleanest thing is to use the same SSL certificate in your clearnet and onion sites, but this only will work if you can use EV certificates on both.
Facebook currently (March 2016) uses DV certificates for our main site - mostly because EV certificates don't currently support wildcards for clearnet ...
All certificates types are listed here, see section "A.1. List of certificate types"
 - Ed25519 signing key with an identity key
(see prop220 section 4.2)
 - TLS link certificate signed with ed25519 signing key
(see prop220 section 4.2)
** - Reserved for RSA identity cross-certification;
(see section 2.3 ...
This is likely unrelated to Tor Browser (except that Tor Browser is being more strict about TLS being properly configured on the server side, it seems...), the server itself is at fault, the administrator has failed to configure TLS correctly.
It is missing an intermediate certificate to complete the "trust" chain between it's certificate and a trusted ...
Permanent exceptions can't be made in Private Browsing mode. Go to about:preferences#privacy and either uncheck "Always use private browsing mode" or select "Remember History."
This will save your browsing history, download history, and save cookies by default. To fix, uncheck "Remember browsing and download history" and "Remember search and form history." ...
At the moment the only way to get a trusted SSL certificate for a .onion domain is to buy an EV (extended validation) certificate.
For more info see: https://www.digicert.com/blog/ordering-a-onion-certificate-from-digicert/
Think for a moment about what it actually means to revoke a private key in X.509 PKI.
Originally, you created a key pair, and you submit the public key to a certificate authority (CA) for key signing in certificate signing request (CSR). The CA verifies you owned your domain and probably your identity as well, and sign your public key with their private ...
There is no direct way to revoke an onion address, because there is no registration process for the onion address. If the key is stolen (via malware infestation, for example), the key is always going to work and will always have the same address even if you're not the one who possesses it anymore.
There are alternative revocation schemes out there, such as ...
You can't revoke a .onion address in the same sense like an TLS certificate. The .onion address is computed from the identity key each relay maintains (see answer to "How are domain names created"). So you compute the name on your machine. If you want to stop your hidden service and "de-register" the name, it is sufficient to safely delete the directory ...
As it has been some time since I have had any experience with this sort of thing, it is unclear what exactly you mean by "certificate spoofing". However, from my understanding of MITM attacks, the implementation of the more secure HSTS protocol used by Google et al. mitigates against many of the attacks using methods such as sslstrip. I'm not sure if banks ...