Why offer an Onion Address rather than just encourage browsing-over-Tor?

Re:Why offer an Onion Address rather than just encourage bro... by vageli on Thursday March 10, 2022 @08:36AM (#30626711)

> So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// explicitly, as that's your sole protection against getting MITMed.

>Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security.

https://www.torproject.org/download/

[ Parent | on HN ]

Re:Why offer an Onion Address rather than just encourage bro... by ryeights on Thursday March 10, 2022 @09:27AM (#30627239)

Caveat: HTTPS Everywhere relies on a manual whitelist of HTTPS-enabled sites. If the website you’re visiting isn’t popular enough to be on their list, you’re out of luck.

[ Parent | on HN ]

Re:Why offer an Onion Address rather than just encourage bro... by michaelt on Thursday March 10, 2022 @09:27AM (#30627240)

HTTPS Everywhere doesn't have a working rule for bitcoinknots.org

And more broadly, neither HSTS preloading or HTTPS Everywhere include a list of every single site on the internet.

[ Parent | on HN ]

Re:Why offer an Onion Address rather than just encourage bro... by tialaramex on Thursday March 10, 2022 @10:29AM (#30627975)

Mentioned below that HTTPS-default (which is an option in ordinary Firefox) is intended to become mandatory in Tor-browser.

I use this on my main PC. Once or twice a day I might visit some old or especially cantankerous site that doesn't do HTTPS, I get a full page interstitial explaining the problem, I can decide if I'm OK with that. Otherwise every single link, typed URL, etc. is HTTPS regardless of whether that was what was originally written.

I wouldn't recommend it in its current state for my mother, but it's definitely what someone using Tor would want, and it's only getting more ubiquitous.

[ Parent | on HN ]

Re:Why offer an Onion Address rather than just encourage bro... by aendruk on Thursday March 10, 2022 @11:33AM (#30628802)

I’m surprised to hear it’s not just using the native HTTPS-only mode now.

[ Parent | on HN ]