Re: [secdir] Security review of draft-ietf-dnsop-onion-tld-00.txt

["Alvaro Retana (aretana)" <[e-mail]>]

On 9/2/15, 7:51 AM, "iesg on behalf of Alec Muffett" <[e-mail]<mailto:[e-mail]> on behalf of [e-mail]<mailto:[e-mail]>> wrote:

Alec:

Hi!

I am quite confident that Mark’s latest diff:

http://www.ietf.org/rfcdiff/rfcdiff.pyht?url1=https://www.ietf.org/id/draft-ietf-dnsop-onion-tld-00.txt&url2=http://mnot.github.io/I-D/dnsop-onion-tld/draft-ietf-dnsop-onion-tld-01.txt

…covers the “human factors” element quite well.

There is more there, but as an average Internet user (not a Tor user) I still don’t know what to look out for if presented with a .onion name (or something that looks like it).  I suspect that most average users will just click on something w/out realizing (ever!) it is a .onion name, and not a “plain old link” to some other page.

However, the more I read this thread the more I am convinced not much can be said/done.  Just like the facebookXXX.onion versus facebookYYY.onion case, average users don’t pay enough attention to distinguish between facebook.com and faceboook.com, much less would they know that .onion (or any other name for that matter) is special.  As you already wrote in the latest version, we can just hope that the appropriate sw is updated to prevent the average user from doing something they don’t even understand that may result in some leakage of information.

Thanks for addressing this point.

Alvaro.