Re:Making Connections to Facebook More Secure
by akavel on Friday October 31, 2014 @02:46PM
(#8540401)
Actually, to me the first thought after seeing the URL was totally: "wow, I wonder what backronym they invented for the ugly wwwi suffix." And the others posts in this thread seem to confirm that this was the case, and that this prettification mechanism is actually quite common on Tor already.
Now, the other, more important for me observation is, that reportedly the TLS certificate is actually worth close to nothing, and giving false security, as a HNer claims to have got a valid cert issued for this very same facebook's .onion address already: https://news.ycombinator.com/item?id=8539066 -- if I understand correctly, cert issuers seem to happily accept any .onion URLs in "alternative addresses" in SSL certs without any verification. Anybody else could confirm/deny?
Now, the other, more important for me observation is, that reportedly the TLS certificate is actually worth close to nothing, and giving false security, as a HNer claims to have got a valid cert issued for this very same facebook's .onion address already: https://news.ycombinator.com/item?id=8539066 -- if I understand correctly, cert issuers seem to happily accept any .onion URLs in "alternative addresses" in SSL certs without any verification. Anybody else could confirm/deny?