Re: [secdir] Security review of draft-ietf-dnsop-onion-tld-00.txt

[Alec Muffett <[e-mail]>]

Hi Alvaro!

> On Sep 2, 2015, at 2:47 PM, Alvaro Retana (aretana) <[e-mail]> wrote:
> There is more there, but as an average Internet user (not a Tor user) I still don’t know what to look out for if presented with a .onion name (or something that looks like it).

That’s a really good point - is this document fit for the purposes of people who click on a link, expect it to work, and are surprised when it does not?

An example of this - where I was the author, and so I took steps to explain what would not happen - is on this page:

https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237 <https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237>

For people who don’t want to load that page, the relevant part is:

>> …To make their experience more consistent with our goals of accessibility and security, we have begun an experiment which makes Facebook available directly over Tor network at the following URL:
>> https://facebookcorewwwi.onion/ <https://facebookcorewwwi.onion/>
>> [ NOTE: link will only work in Tor-enabled browsers ]

…and there’s the thing: someone who is not using Tor will click on a link and nothing will happen, exactly as (for instance) I visit a coffee shop or my workplace and click on the bookmarked “http://router.local/ <http://router.local/>“ link which (when I am at home) would give me access to my DSL router’s control panel.

>  I suspect that most average users will just click on something w/out realizing (ever!) it is a .onion name, and not a “plain old link” to some other page.

Quite.  I believe that that is, in fact, rather the design goal.  Interoperability.

The onion network space consists of software, exactly like any other software (LAMP stacks, Wordpress, Facebook, etc) which is just accessed via a different address space, the latter being similarly to some VPN software.

Equally, my aforementioned router.local link *will* work when my VPN into my home network is working properly.

Similarly (again) - in my browser bar there are any number of links - or, for that matter, SSH connections - on the Facebook-internal corporate network which are not accessible from (say) my local Starbucks, again unless I have my corporate VPN software enabled - at which point everything magically suddenly "just works".

(aside) This is why I have always felt that using a scheme-change “onion://“ would not have been a good design choice for Tor Onion Names; my work life would be significantly more complex if I had to swap schemes when accessing a site over a VPN, a-la htvpntp://non-dns-name.internal/foo.txt

Returning to your point:

> However, the more I read this thread the more I am convinced not much can be said/done.  Just like the facebookXXX.onion versus facebookYYY.onion case, average users don’t pay enough attention to distinguish between facebook.com and faceboook.com, much less would they know that .onion (or any other name for that matter) is special.  As you already wrote in the latest version, we can just hope that the appropriate sw is updated to prevent the average user from doing something they don’t even understand that may result in some leakage of information.

Yes indeed, and I believe that the Ballot-144-enabled adoption of EV Certificates, with their big friendly green labels, will do a lot to reduce unwanted intermediary risk in Onion space.

Also, in passing, I do wish to point out, those “fooXXX.onion.tld” proxies which I have elsewhere presented as an unwanted risk, also do have a wanted and important role to play in making the world more open and connected; the (independent, non-Tor) Tor2web project was co-founded by the late Aaron Swartz (of whom some of you may have heard / seen documentaries?) in order to allow sites to publish via Tor to maintain anonymity, and Tor2web serves as yet one more bridge for the larger non-Tor world to access Tor/Onion resources.

More details on Tor2web are at https://en.wikipedia.org/wiki/Tor2web <https://en.wikipedia.org/wiki/Tor2web> - but to recap: there is a separate, parallel space of information out there, one that has been available for about a decade, and in order to bring greater trust to it and ensure that it is on a sound footing requires it to be slotted into the bigger picture of the internet and web.

Hence this draft.  It is what we are trying to do. :-)

   - alec

—
Alec Muffett
Security Infrastructure
Facebook Engineering
London