Ride the Lightning

IETF Recognizes .onion as a Special-use Domain Name

November 2, 2015

SC Magazine reported last week that there has been formal recognition of .onion as a Special-use Domain Name by the Internet Engineering Task Force (IETF). Jacob Appelbaum, a security researcher and developer, privacy expert and a core member of the Tor Project, said in a blog post that the draft to register the domain name included security and privacy considerations that likely “will help to protect end users from targeted and mass-surveillance."

“Losing control of .onion had the potential to create confusion for all hidden services, not just Facebook,” Facebook software engineer and Internet security evangelist Muffet told SC Magazine in an e-mail correspondence. “This is really about securing the way people connect to Facebook. With our .onion site on the TOR network, people can confidently connect to Facebook knowing their link is genuine and end-to-end secure.”

By using .onion, Appelbaum noted, users are assured of security from end to end. Due in part to its self-authentication capability, “if you can get a .onion domain name you can be absolutely sure you're only talking to” who is supposed to be at the other end, he said, adding that Facebook was able to get a vanity name, meaning that used in conjunction with .onion, users are offered two layers of security. “If you have .onion, you don't need SSL, because you know who you're talking to.” But users can still buy Extended Validation (EV) SSL/TLS certificates for .onion services, which provide added safeguards.

Does this protect the bad guys too? Of course. But protecting the privacy of good guys necessarily means affording the same protections to the villains of the world. And to think it all started in what these folks call the "Summer of Snowden." Hard to believe it was only two years ago that we learned how massive government surveillance had become.

E-mail:    Phone: 703-359-0700
Digital Forensics/Information Security/Information Technology
http://www.senseient.com
http://twitter.com/sharonnelsonesq
www.linkedin.com/in/sharondnelson