June 2021 - tor-commits - lists.torproject.org

[community/master] Update contents.lr mentioning it is an proposal and adding sources as links
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 659758b7e72664f2a6f7188fb4b861bb0abd81b9 Author: nyxnor <nyxnor(a)protonmail.com> Date: Fri Jun 25 14:23:03 2021 +0000 Update contents.lr mentioning it is an proposal and adding sources as links --- content/onion-services/advanced/https/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/onion-services/advanced/https/contents.lr b/content/onion-services/advanced/https/contents.lr index 8e68ee3..675ee83 100644 --- a/content/onion-services/… [View More]advanced/https/contents.lr +++ b/content/onion-services/advanced/https/contents.lr @@ -37,7 +37,7 @@ Alternatively, websites can provide other ways to verify their onion address usi While there is extensive criticism regarding HTTPS and the CA trust model, the information security community has taught users to look for HTTPS when visiting a website as a synonym of secure connection and avoid HTTP connections. Tor Developers and UX team worked together to bring a new user experience for Tor Browser users, so when a user visits an onion site using HTTP [Tor Browser doesn't display a warning or error message](https://support.torproject.org/onionservices/onionservices-5/). -3. One of the risks of using a certificate issued by a CA is that .onion names might unintentionally get leaked due to Certificate Transparency if the onion service owners use HTTPS for their .onions. If you still want to use HTTPS, you can avoid this leakage by using a self-created https cert (where you can make your own https cert chain using your onion key to sign it, and Tor Browser knows how to verify a self-created chain like that), because not only do you not need to involve a third-party in making it, you don't need to reveal to a third-party that it exists. +3. One of the risks of using a certificate issued by a CA is that .onion names might unintentionally get [leaked](https://crt.sh/?q=.onion) due to [Certificate Transparency](https://certificate.transparency.dev/) if the onion service owners use HTTPS for their .onions. If you still want to use HTTPS, there is an [open proposal](https://github.com/alecmuffett/onion-dv-certificate-proposal/blob… to allow Tor Browser to verify self-created https cert (where you can make your own https cert chain using your onion key to sign it, and Tor Browser knows how to verify a self-created chain like that), because not only do you not need to involve a third-party in making it, you don't need to reveal to a third-party that it exists. 4. Some websites have a complex setup and are serving HTTP and HTTPS content. In that case, just using onion services over HTTP could leak [secure cookies](https://github.com/alecmuffett/eotk/blob/master/docs.d/security-ad…. [View Less]

1 0

[community/master] Merge branch 'certificate-transparency'
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit c06a58177d9f065c4c025c3335632ae55c2b06cd Merge: 7a110b3 659758b Author: gus <gus(a)torproject.org> Date: Fri Jun 25 11:34:29 2021 -0300 Merge branch 'certificate-transparency' content/onion-services/advanced/https/contents.lr | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)

1 0

[community/master] Update contents.lr
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 62d9ab970a4f3d75f811a3b90f3ebc447a466d31 Author: nyxnor <nyxnor(a)protonmail.com> Date: Fri Jun 25 11:31:29 2021 +0000 Update contents.lr --- content/onion-services/advanced/https/contents.lr | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/content/onion-services/advanced/https/contents.lr b/content/onion-services/advanced/https/contents.lr index c49fd7a..8e68ee3 100644 --- a/content/onion-services/advanced/https/contents.lr +++ b/content/onion-… [View More]services/advanced/https/contents.lr @@ -37,7 +37,9 @@ Alternatively, websites can provide other ways to verify their onion address usi While there is extensive criticism regarding HTTPS and the CA trust model, the information security community has taught users to look for HTTPS when visiting a website as a synonym of secure connection and avoid HTTP connections. Tor Developers and UX team worked together to bring a new user experience for Tor Browser users, so when a user visits an onion site using HTTP [Tor Browser doesn't display a warning or error message](https://support.torproject.org/onionservices/onionservices-5/). -3. Some websites have a complex setup and are serving HTTP and HTTPS content. +3. One of the risks of using a certificate issued by a CA is that .onion names might unintentionally get leaked due to Certificate Transparency if the onion service owners use HTTPS for their .onions. If you still want to use HTTPS, you can avoid this leakage by using a self-created https cert (where you can make your own https cert chain using your onion key to sign it, and Tor Browser knows how to verify a self-created chain like that), because not only do you not need to involve a third-party in making it, you don't need to reveal to a third-party that it exists. + +4. Some websites have a complex setup and are serving HTTP and HTTPS content. In that case, just using onion services over HTTP could leak [secure cookies](https://github.com/alecmuffett/eotk/blob/master/docs.d/security-ad…. We wrote about [Tor Browser security expectations](https://blog.torproject.org/tor-brower-onion-services-challen…, and how we're working on onion services usability and adoption. There are some alternatives you might want to try to address this problem: @@ -47,10 +49,10 @@ Then the content will work smoothly no matter what website name it's being serve * Another option is to use webserver rules to rewrite absolute links on the fly. * Or use a reverse proxy in the middle or more specifically EOTK with an HTTPS certificate. -4. Related to the previous point, some protocols, frameworks, and infrastructures use SSL as a technical requirement; they won't work if they don't see an "https://" link. +5. Related to the previous point, some protocols, frameworks, and infrastructures use SSL as a technical requirement; they won't work if they don't see an "https://" link. In that case, your onion will need to use an HTTPS certificate in order to function. -5. Actually HTTPS does give you a little bit more than onion services. +6. Actually HTTPS does give you a little bit more than onion services. For example, in the case where the webserver isn't in the same location as the Tor program, you would need to use an HTTPS certificate to avoid exposing unencrypted traffic to the network in between the two. Remember that there's no requirement for the webserver and the Tor process to be on the same machine. [View Less]

1 0

[manual/master] Merge branch 'readme-how-to-report-bugs'
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 541b8eb2f9b4de82077732a39727b4e57fb8f97a Merge: 696c3e4 220b1c2 Author: gus <gus(a)torproject.org> Date: Fri Jun 25 11:30:01 2021 -0300 Merge branch 'readme-how-to-report-bugs' README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)

1 0

[manual/master] Update README.md
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 220b1c2db0ad67c00857ce4513626e1e05cf8304 Author: nyxnor <nyxnor(a)protonmail.com> Date: Fri Jun 25 12:19:53 2021 +0000 Update README.md --- README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/README.md b/README.md index f3f9c90..d5cdec8 100644 --- a/README.md +++ b/README.md @@ -12,8 +12,7 @@ or browse it online: http://jqs44zhtxl2uo6gk.onion/project/web/manual.git How to report bugs or feedback ============================== -Please file a [… [View More]

1 0

[community/master] Merge branch 'readme-how-to-report-bugs'
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 7a110b3517276fdceea2f1bb69cc32d649023262 Merge: 7fe5655 0658e48 Author: gus <gus(a)torproject.org> Date: Fri Jun 25 11:28:11 2021 -0300 Merge branch 'readme-how-to-report-bugs' README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)

1 0

[community/master] Update README.md
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 0658e48edbf56ca17b08e2164cf4a602fc88dffc Author: nyxnor <nyxnor(a)protonmail.com> Date: Fri Jun 25 12:22:44 2021 +0000 Update README.md --- README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/README.md b/README.md index d0d917a..69aa767 100644 --- a/README.md +++ b/README.md @@ -12,8 +12,7 @@ or browse it [online](http://gitweb.torproject.org/project/web/community.git). ## How to report bugs or feedback -First check if your issue wasn't … [View More]

1 0

[tor-browser-build/master] Update allowed_addons.json, build2.
by sysrqb＠torproject.org 25 Jun '21

25 Jun '21

commit a203356d18698e55e157a5f0e64717fc3e3e19ce Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Jun 25 14:19:50 2021 +0000 Update allowed_addons.json, build2. --- projects/tor-browser/allowed_addons.json | 204 +++++++++++++++---------------- rbm.conf | 2 +- 2 files changed, 103 insertions(+), 103 deletions(-) diff --git a/projects/tor-browser/allowed_addons.json b/projects/tor-browser/allowed_addons.json index 9cd6b11..4556886 100644 … [View More]

1 0

[community/master] Upload Intercepet logo
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit a5ca0a6ff0a017bee51af6631c78c4a3d39c6044 Author: nyxnor <nyxnor(a)protonmail.com> Date: Fri Jun 25 13:23:04 2021 +0000 Upload Intercepet logo --- assets/static/images/onions/png/intercept.png | Bin 0 -> 49087 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/assets/static/images/onions/png/intercept.png b/assets/static/images/onions/png/intercept.png new file mode 100644 index 0000000..141eb95 Binary files /dev/null and b/assets/static/images/onions/png/intercept.png differ

1 0

[community/master] Update onions.ini
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 84f7016dad691bb7f2ff919bf23edc7ef88a467f Author: nyxnor <nyxnor(a)protonmail.com> Date: Fri Jun 25 14:00:20 2021 +0000 Update onions.ini --- databags/onions.ini | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/databags/onions.ini b/databags/onions.ini index 2f2f749..2962713 100644 --- a/databags/onions.ini +++ b/databags/onions.ini @@ -18,6 +18,11 @@ link = https://www.bbcnewsv2vjtpsuy.onion image = /static/images/onions/png/bbc.png label = BBC +[intercept] +… [View More]

1 0