You can use the onion location header[0] to redirect the user, as mentioned in another comment thread.

0: https://community.torproject.org/onion-services/advanced/oni...

That has all the problems listed. The header could be modified or the response blocked by anyone who could modify or block the plain HTTP(S) response.

> you are guaranteed to be connected to what you expect — or not at all.

Exactly the same guarantees are also achieved by putting your clearnet address on HSTS Preload lists, or by writing https:// in front of the url on the users side.

But then you are relying on the CA system which is a huge risk. A significant benifit of onion addresses is that The key is distributed with the address. So as long as you get the address over a secure channel you are safe.

With https you need to get the address over a secure channel and hope that no CAs are compromised. The secure channel might be easier (because you can quickly memozrize twitter.com) but to avoid the second you need some complicated and not officially supported certificate pinning.

Thanks to certificate transparency the CA system is really not a huge risk.

Are all the CAs in your browser (and those of your site's users) trust list doing proper public logging now?

It’s been mandatory since 2018. Browsers will reject certificates which have not been publicly logged.

Perhaps next you’ll wonder if it’s as simple as compromising a CA and a CT log? Nope, as browsers require cryptographic attestations from multiple CT logs. If you’re using Chrome, one of those logs has to be the one operated by Google.

Also such collusion will soon be defeated by SCT auditing https://www.hardenize.com/blog/certificate-transparency-sct-...

https://docs.google.com/document/d/16G-Q7iN3kB46GSW5b-sfH5MO...

Neither. Either can be mistyped. Nobody enters addresses directly anymore. Either you google them or you get them from bookmarks.

Yeah so in case of Tor, people use DDG which is the default. And DDG, being bad and handling SEO spam worse than Google, often returns wrong onion address. (Which happened to me several times.)

And you cannot really check if it's the correct one.

At least on regular net, you have a chance to spot nytime5 is fake.

It's very easy to think that things we do ourselves are universal because they seem so intuitive and natural for us. I for one type addresses from scratch all the time.

Onion addresses that are mistyped are almost certainly an invalid address.

It is not possible to squat onion domains for typo errors like you can clearnet addresses.

Similar to bitcoin, one character swapped breaks the hash-checksum, making the address 99.99999999% likely to be invalid.