<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Nov 2, 2015, at 20:39, Paul Syverson <<a href="mailto:paul.syverson@nrl.navy.mil" class="">paul.syverson@nrl.navy.mil</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">On Mon, Nov 02, 2015 at 09:05:26PM +0200, George Kadianakis wrote:<br class=""><blockquote type="cite" class="">Hello,<br class=""><br class="">as you might know, the IETF recently decided to formally recognize .onion names<br class="">as special-use domain names [0].<br class=""><br class="">This means that normal browsers like Chrome and Firefox can now<br class="">handle onion domains in a special manner since they know that they<br class="">only correspond to Tor.<br class=""><br class="">How would we like those browsers to treat onions?<br class=""><br class="">For starters, those browsers should refuse to connect to onion<br class="">domains entirely. Onions don't work on normal browsers anyway, and<br class="">also this will reduce the onion leakage through the DNS system [1].<br class=""></blockquote><br class="">Well, maybe not "entirely". Cf. below.<br class=""></div></blockquote><div><br class=""></div><div><br class=""></div><div><br class=""></div><div>Tangential aside: Chrome currently has a bug open in that it does not yet support onion certificates:</div><div><br class=""></div><div><a href="https://code.google.com/p/chromium/issues/detail?id=483614" class="">https://code.google.com/p/chromium/issues/detail?id=483614</a></div><div><br class=""></div><div>The Onion RFC lays a burden on DNS to NXDOMAIN onion lookups. </div><div><br class=""></div><div>It says nothing about having browsers block them.</div><div><br class=""></div><div>Perhaps the better thing for Tor adoption is - privacy purism enforced by TBB aside - to enable adoption. </div><div><br class=""></div><div>Allow (encourage?) non-TBB browsers to be capable to using Onions.</div><div><br class=""></div><div>Roger, after all, stood up movingly at the Aaron Swartz memorial and spoke of letting people pick the security that _they_ wanted, when connecting to a site.</div><div><br class=""></div><div>This would, I feel, accord with that position.</div><div><br class=""></div><div> - alec</div><div><br class=""></div><div><br class=""></div><div>ps: </div><br class=""><blockquote type="cite" class=""><div class="">It might be a better idea to point them to tor2web. For one thing<br class="">browser providers will be happier with a display that doesn't directly<br class="">tell people they need a different browser to get to an intended<br class="">address. </div></blockquote><div><br class=""></div><div><br class=""></div><div>Pointing people at tor2web would break SSL, but see this thread, which is a side-show to the larger "how can we get personal onion addresses" discussion: <a href="https://twitter.com/AlecMuffett/status/658440124624183296" class="">https://twitter.com/AlecMuffett/status/658440124624183296</a></div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class="">The display could say something like:<br class=""><br class=""> Oops, seems like you attempted to visit an onion address, a<br class=""> specialized address that provides additional security for<br class=""> connections to it. The site can be reached via proxy at<br class=""> [tor2web-link-to-relevant-onionsite]. To obtain the intended<br class=""> security for access to such sites, follow <A HREF=<br class=""> "[link-to-page-w-brief-simple-explanation-n-prominent-link-to-download-TBB]"><br class=""> these few simple steps</A> .<br class=""><br class="">No doubt some wordsmithing could make this better in various respects<br class="">(amongst them, shorter).<br class=""></div></blockquote><div><br class=""></div><div><br class=""></div><div><br class=""></div><div>Phishing-potential in such dialogues, here?</div><div><br class=""></div><div> -a</div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><br class=""><blockquote type="cite" class=""><br class=""><br class="">What else could we do here? And is there anyone who can lobby for the right<br class="">behavior? :)<br class=""><br class="">Of course, we all know that that inevitably those browsers will need<br class="">to bundle Tor, if they want to visit the actually secure onion<br class="">Internet. But let's give them a bit more time till they realize this<br class="">:)<br class=""></blockquote><br class="">I think something like the above improves the transition path, helping<br class="">the world along to better security instead of just waiting for the<br class="">world to catch up. (And in any case, perhaps at least a few more<br class="">months work would better prepare us for the resulting attention.)<br class=""><br class="">aloha,<br class="">Paul<br class=""><br class=""></div></blockquote></div></body></html>