Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

.onion addresses aren't resolved using the DNS system. So... no?

I guess in theory a browser _could_ support something like that, but it'd be pretty unusual. I also think the idea of relying on DNS to resolve a hidden service would defeat a lot of the privacy and security guarantees associated with those services, so I don't think any browser serious about security would implement something like that.



Would it make any sense to use something like tor.nytimes.com to redirect to their hidden service on the other hand? To allow people to be sure they're hitting the correct endpoint on Tor. If you're on TOR you typically have access to the rest of the internet, at least depending on setup.


Only if you're fine broadcasting in plaintext what tor site you're going to. The DNS lookup defeats the privacy of using an onion address.


Exit nodes could also manipulate DNS.


Nice one cheers. I have no idea how .onion domains work, never used them/Tor


> guess in theory a browser _could_ support something like that, but it'd be pretty unusual.

Websites redirect all the time, there's 3 HTTP status codes for it.


An HTTP redirect is a completely different thing from a CNAME record in the DNS.

If you visit https://onion.nytimes.com/ and it sends you a 301 redirect to https://nytimes3xbfgragh.onion/ then yes, I'm pretty sure that'd work fine. However, if you perform a DNS lookup on `onion.nytimes.com` and receive in response a CNAME record pointing to `nytimes3xbfgragh.onion`, I seriously doubt the browser is going to respond to that by establishing a new Tor circuit to the named hidden service. Rather, it's most likely just going to do what every other DNS client does when it receives a CNAME record; it'll try to look up `nytimes3xbfgragh.onion` in the DNS. (And fail, because `.onion` is not a valid TLD in the regular DNS system.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: