News for hackers. Stuff that matters.
Re:MoreOnionsPorfavor: Onionize your website and take back t... by surround on Wednesday July 08, 2020 @09:16PM (#23776064)
What I mean is, how is a .onion website over tor better than an https website over tor? I edited my comment to clarify.
Re:MoreOnionsPorfavor: Onionize your website and take back t... by threentaway on Wednesday July 08, 2020 @09:29PM (#23776129)
The traffic never leaves the Tor network. This has a few advantages:

* You don't need a TLS certificate from a public certificate authority, as it is already encrypted end to end

* The exit node cannot attempt to snoop on your traffic (via TLS SNI) or inject content/ads/exploits into your unencrypted traffic

* It reduces load on the exit nodes so they can work on serving traffic to sites that don't have an .onion endpoint

Re:MoreOnionsPorfavor: Onionize your website and take back t... by surround on Wednesday July 08, 2020 @11:27PM (#23776677)
If certificate authorities are a concern, then why do some onion services use https?
Re:MoreOnionsPorfavor: Onionize your website and take back t... by zaarn on Thursday July 09, 2020 @01:41AM (#23777257)
Tor public keys don't prove identity (ie, that is cloudflare.com) while such a certificate over, for example, Alt-Svc headers does. Pure .onion certs exist as well and give extra reinsurance that you're on the correct website.
Re:MoreOnionsPorfavor: Onionize your website and take back t... by danielheath on Thursday July 09, 2020 @01:27AM (#23777194)
If I had to guess, it’d be because TOR users are not a solid block with identical opinions.
Re:MoreOnionsPorfavor: Onionize your website and take back t... by boring_twenties on Wednesday July 08, 2020 @11:20PM (#23776634)
In theory no one can spoof a Tor hidden service. The service name itself encodes the public key, and only the corresponding private key can authenticate. Much better than https, where you have many dozens of "trusted" authorities, any one of which can compromise you.

And also it precludes any attacks a malicious exit node could run on your https traffic, like the other comment says