Asan1

>TLS/HSTS is still subject to CA attacks, e.g. diginotar.

Largely solved by Certificate Transparency. If you compromise a CA, you can issue certificates. However, you can't issue new certificates without broadcasting that fact to the whole world as browsers will not accept certificates without SCTs.

>Reducing load on exit nodes is a technical benefit that's in that blog post.

This hasn't been a real benefit for years. Exit nodes are running at something like 10% capacity.

>Another benefit to using Tor onion services for large sites is that the Tor circuit ID can be used as an additional key in an IP rate limit cache. This helps block Tor bots (on the basis that establishing a Tor circuit is expensive).

This is just another problem with hidden services. Opening circuits costs malicious clients far less cpu time than it costs the server.

Airtags are fucking terrible anyway. Great idea, awful execution.

Why do my car keys have to start beeping every couple of hours?

The Tor network has 1Tbps+ of real exit capacity available, real usage is a small fraction of that.

Exit capacity as a significant bottleneck has not been a realistic issue for many years.

I think this blog post largely disregards the fact that TLS and HSTS preload lists exist and work.

I got into a conversation with the author about this yesterday, but unfortunately his replies quickly devolved into trolling https://nitter.net/AlecMuffett/status/1501585708145942534

As other commenters have pointed out:

>The first benefits are authenticity and availability: if you are running Tor Browser and if you click/type in exactly the proper Onion address, you are guaranteed to be connected to what you expect — or not at all.

https://hstspreload.org/ offers the same benefits. You are guaranteed to be connected to what you expect - or not at all.

>Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent

TLS mitigates attacks that can be executed by malicious exit nodes (or WiFi networks, or ISPs), that is the whole purpose of TLS.

Muffett absolutely gets the social aspects right, but seems to severely stumble on the technical details.

>But setting up an Onion address is a practical step which demonstrates that the platform is providing explicitly for the needs of people who use Tor

>an onion address is a promise and a mechanism to assure that you are taking seriously the needs of the people who use Tor.

There is value in providing onion addresses for clearnet sites, but it's primarily marketing.