[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #21321 [Applications/Tor Browser]: .onion HTTP is shown as non-secure in Tor Browser
#21321: .onion HTTP is shown as non-secure in Tor Browser
-------------------------------------------------+-------------------------
Reporter: cypherpunks | Owner: tbb-
| team
Type: task | Status: closed
Priority: High | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Blocker | Resolution: fixed
Keywords: ff52-esr, tbb-7.0-issues, tbb- | Actual Points:
usability, ux-team, tbb-7.0-frequent, |
TorBrowserTeam201708R, GeorgKoppen201708 |
Parent ID: | Points:
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Comment (by cypherpunks):
Replying to [comment:29 yawning]:
> Replying to [comment:28 cypherpunks]:
> > Replying to [comment:27 yawning]:
> > > How is using a site over Tor through an exit, with a CA signed TLS
cert any less secure than using an `onion` over HTTP.
> >
> > There's the risk of MiTM by the exit, or due to the flawed CA system
itself - as happened in the past for Tor Project infrastructure with CA
DigiNotar [1], in comparison with a 0 risk for a MiTM with onion services.
>
> HSTS is a thing.
It's not HSTS that should be spoken about but HPKP. And FYI Google is
abandroning HPKP: theregister.co.uk/2017/10/30/google_hpkp
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21321#comment:55>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs