undefined | Better HN

0 pointsAjedi328y ago0 comments

.onion addresses aren't resolved using the DNS system. So... no?

I guess in theory a browser _could_ support something like that, but it'd be pretty unusual. I also think the idea of relying on DNS to resolve a hidden service would defeat a lot of the privacy and security guarantees associated with those services, so I don't think any browser serious about security would implement something like that.

0 comments

giancarlostoro8y ago

Would it make any sense to use something like tor.nytimes.com to redirect to their hidden service on the other hand? To allow people to be sure they're hitting the correct endpoint on Tor. If you're on TOR you typically have access to the rest of the internet, at least depending on setup.

ne0n8y ago

Only if you're fine broadcasting in plaintext what tor site you're going to. The DNS lookup defeats the privacy of using an onion address.

ryacko8y ago

Exit nodes could also manipulate DNS.

corobo8y ago

Nice one cheers. I have no idea how .onion domains work, never used them/Tor

dtech8y ago

> guess in theory a browser _could_ support something like that, but it'd be pretty unusual.

Websites redirect all the time, there's 3 HTTP status codes for it.

Ajedi32OP8y ago

An HTTP redirect is a completely different thing from a CNAME record in the DNS.

If you visit https://onion.nytimes.com/ and it sends you a 301 redirect to https://nytimes3xbfgragh.onion/ then yes, I'm pretty sure that'd work fine. However, if you perform a DNS lookup on `onion.nytimes.com` and receive in response a CNAME record pointing to `nytimes3xbfgragh.onion`, I seriously doubt the browser is going to respond to that by establishing a new Tor circuit to the named hidden service. Rather, it's most likely just going to do what every other DNS client does when it receives a CNAME record; it'll try to look up `nytimes3xbfgragh.onion` in the DNS. (And fail, because `.onion` is not a valid TLD in the regular DNS system.)

j / k navigate · click thread line to collapse