Delivery-Date: Sun, 17 Jan 2016 09:17:22 -0500
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	RCVD_IN_DNSWL_MED,T_DKIM_INVALID,T_RP_MATCHES_RCVD autolearn=ham version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id 8D3A01E2FB2;
	Sun, 17 Jan 2016 09:17:20 -0500 (EST)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id BD0A63700F;
	Sun, 17 Jan 2016 14:17:16 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id 1B0B936C80
 for <tor-talk@lists.torproject.org>; Sun, 17 Jan 2016 14:17:14 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at 
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id ECm3xb4JbGQm for <tor-talk@lists.torproject.org>;
 Sun, 17 Jan 2016 14:17:14 +0000 (UTC)
Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com
 [66.111.4.29])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by eugeni.torproject.org (Postfix) with ESMTPS id 0432A36C18
 for <tor-talk@lists.torproject.org>; Sun, 17 Jan 2016 14:17:13 +0000 (UTC)
Received: from compute3.internal (compute3.nyi.internal [10.202.2.43])
 by mailout.nyi.internal (Postfix) with ESMTP id 7954E207D6
 for <tor-talk@lists.torproject.org>; Sun, 17 Jan 2016 09:17:11 -0500 (EST)
Received: from frontend1 ([10.202.2.160])
 by compute3.internal (MEProxy); Sun, 17 Jan 2016 09:17:11 -0500
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=veryspeedy.net; h=
 content-transfer-encoding:content-type:date:from:in-reply-to
 :message-id:mime-version:references:subject:to:x-sasl-enc
 :x-sasl-enc; s=mesmtp; bh=Oa5bN3hMCjzYDsuqu08RVuFkO5k=; b=XVmQ8U
 AN0qocmmJPaCXUtAkhl/KT/JbNWFjNxu5OSivanbwmdghCXKy+IzqYxY2Yx7HQqJ
 zYwhmmEOtZNsL59HRbukDS91OhEzQ4fMD24+QD8vQWlNChenGNqYGJWpFUoJM1wR
 J4PuTORSvB6jZyOEXRfSgcpo0wNLRDHfe4IyE=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=
 messagingengine.com; h=content-transfer-encoding:content-type
 :date:from:in-reply-to:message-id:mime-version:references
 :subject:to:x-sasl-enc:x-sasl-enc; s=smtpout; bh=Oa5bN3hMCjzYDsu
 qu08RVuFkO5k=; b=AKh+5HylREodc20Vhlzu+GqNAkTn7cT2dsga66TbZomW5Zd
 rVOpxHpN4zG0O04UDzI6uyxa/JO2A6TIF+gRWUXiTJsBIItxzLfsl2HDW0bZdaZ9
 yclUdZI9XA5pJS7yFyQMuKXNxyfQxbXyWoV+lo2A21ATK6ugKPpqTpapE9ZI=
X-Sasl-enc: Y1wYHDxLeleb/6kg8U36M+3FDagQshBbEKS195wXUD19 1453040230
Received: from 127.0.0.1 (ns330209.ip-5-196-66.eu [5.196.66.162])
 by mail.messagingengine.com (Postfix) with ESMTPA id 1A5B4C016C4
 for <tor-talk@lists.torproject.org>; Sun, 17 Jan 2016 09:17:09 -0500 (EST)
To: tor-talk@lists.torproject.org
References: <20160116212250.GA14827@ix-293.local>
From: Lara <lara.tor@emails.veryspeedy.net>
Message-ID: <569BA25E.4040108@emails.veryspeedy.net>
Date: Sun, 17 Jan 2016 14:17:02 +0000
MIME-Version: 1.0
In-Reply-To: <20160116212250.GA14827@ix-293.local>
Subject: Re: [tor-talk] trusting .onion services
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>

Rejo Zenger:
>  - How can a user reliably determine some .onion address actually
>    belongs to intended owner?

The user can call the admin and ask the admin to read aloud the key
fingerprint.

>  - How is the provider of .onion service supposed to deal with a lost or
>    compromised private key, especially from the point of view from the
>    user of this service? How does the user know a .onion-address has
>    it's key revoke?

Use any form of reliable communication to communicate the old key is
unreliable. I am not aware of a revoke system.

> By relying on
> the certificate signed by a trusted CA, the user can be sure the site he
> is connecting to is actually belongs to a particular entity. With a
> .onion address that is no longer needed since those address are
> self-authenticating. Sounds good.

No. Through hacking or criminal intent the CAs are known to generate
fake keys that are certificated too. This is why there is a SSL Observatory.

With any certificate you get that. Not only ,onion addresses. And there
are quite a few sites in clearnet with self-signed certificates.

> As far as I can tell, Facebook has two solutions to this: it
> mentions the correct address in presentations, blogs and press coverage
> wherever it can and its TLS-certificate mentions both the .onion address
> as well as it's regular address (as Subject Alt Names).

This is why there might be any number of Fakebook.com, Faeebook.com,
Facebook.net. The big players buy a lot of these domains and use the
muscle to remove the others. But that is not for everybody.

Cheers
-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

