Delivery-Date: Tue, 19 May 2015 05:40:58 -0400
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	RCVD_IN_DNSWL_MED,T_DKIM_INVALID,T_RP_MATCHES_RCVD autolearn=ham version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id 1A98A1E0683
	for <archiver@seul.org>; Tue, 19 May 2015 05:40:56 -0400 (EDT)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id A91E635468;
	Tue, 19 May 2015 09:40:50 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id 0A0AD353CD
 for <tor-talk@lists.torproject.org>; Tue, 19 May 2015 09:40:47 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at 
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id XlHSyJplAeGo for <tor-talk@lists.torproject.org>;
 Tue, 19 May 2015 09:40:46 +0000 (UTC)
Received: from mx0a-00082601.pphosted.com (mx0b-00082601.pphosted.com
 [67.231.153.30])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by eugeni.torproject.org (Postfix) with ESMTPS id E3278353CC
 for <tor-talk@lists.torproject.org>; Tue, 19 May 2015 09:40:40 +0000 (UTC)
Received: from pps.filterd (m0004003 [127.0.0.1])
 by mx0b-00082601.pphosted.com (8.14.5/8.14.5) with SMTP id t4J9Nngc029781
 for <tor-talk@lists.torproject.org>; Tue, 19 May 2015 02:40:38 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fb.com;
 h=from : to : subject : date
 : message-id : references : in-reply-to : content-type : mime-version;
 s=facebook; bh=FI/6olJ5uRwuxgmNX/rQAJ080ghC5YwzX/VDNeKlaSE=;
 b=hEu4w2iEwKS/VjG41+3qqHMI1dNy95crlHub0aV8NOFSLBKTGx+Ucnm+iCNj0VI3/yGe
 5uO4xoGFpvjipXtKm2z3RWpVKvZFjaCWYfVX8S6okp+I3mAEujfx1mq1dycvyyRPmmnc
 +qosHqsFVOzRs24VMeew/gTOgb5bnGrNpv4= 
Received: from mail.thefacebook.com ([199.201.64.23])
 by mx0b-00082601.pphosted.com with ESMTP id 1ug0f0gdmu-1
 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT)
 for <tor-talk@lists.torproject.org>; Tue, 19 May 2015 02:40:38 -0700
Received: from PRN-MBX02-4.TheFacebook.com ([169.254.5.133]) by
 PRN-CHUB10.TheFacebook.com ([fe80::c983:d64f:e422:461d%12]) with mapi id
 14.03.0195.001; Tue, 19 May 2015 02:40:36 -0700
From: Alec Muffett <alecm@fb.com>
To: "tor-talk@lists.torproject.org" <tor-talk@lists.torproject.org>
Thread-Topic: [tor-talk] Making a Site Available as both a Hidden Service
 and on the www - thoughts?
Thread-Index: AQHQkKCWQyEiwmCnlUWOIfZbRgRBcJ2C4UEAgACBBgCAACGEgA==
Date: Tue, 19 May 2015 09:40:35 +0000
Message-ID: <52B6B3D5-F25C-46FA-84A1-9F2A73948958@fb.com>
References: <447D885D-B966-43F7-B491-19F9E829279B@fb.com>
 <20150519073953-728-87379-mailpile@mailpile-home>
In-Reply-To: <20150519073953-728-87379-mailpile@mailpile-home>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: 
x-originating-ip: [192.168.52.13]
MIME-Version: 1.0
X-Proofpoint-Spam-Reason: safe
X-FB-Internal: Safe
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.14.151, 1.0.33,
 0.0.0000
 definitions=2015-05-19_04:2015-05-19,2015-05-19,1970-01-01 signatures=0
Subject: Re: [tor-talk] Making a Site Available as both a Hidden Service and
 on the www - thoughts?
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============8574020889010047874=="
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>

--===============8574020889010047874==
Content-Language: en-US
Content-Type: multipart/signed;
	boundary="Apple-Mail=_34E4E485-3612-4560-91FE-859D96FC65ED";
	protocol="application/pgp-signature"; micalg=pgp-sha512

--Apple-Mail=_34E4E485-3612-4560-91FE-859D96FC65ED
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

>=20
>> As observed elsewhere, we tell our infrastructure that any traffic =
inbound
>> from the Facebook onion site is sourced from the DHCP broadcast
>> network (169.254/whatever).
>=20
> [=E2=80=A6]
> I'm assuming you're pushing an IP in that range into the =
X-Forwarded-For
> header?

Approximately yes; we use a different header (extant, internal) so we =
can mostly not mess with the existing headers.

> Without wanting to start a thread-in-a-thread, I've definitely got =
mixed
> feelings on that one. I think most sites should be using HTTPS, but I
> think there are also cases where HTTPS genuinely may not be
> needed/desirable.

I agree that sometimes it=E2=80=99s overkill.  I=E2=80=99m okay with an =
occasional bit of overkill in this area.

One extra aside: if you go with SSL and get the EV Onion cert (which =
supports wildcards, yay!) - then if you were to lose your onion key for =
some reason the move to a new address would be less traumatic.  Of =
course this is a mechanism of trust placed in CAs (etc, etc) and of =
course there are other ways to achieve the same thing (e.g.: TOFU?) - =
but this one is extant and works.

I like the mutual reinforcement of Tor and SSL, each addresses issues in =
the other.  :-)

    -a

=E2=80=94
Alec Muffett
Security Infrastructure
Facebook Engineering
London



--Apple-Mail=_34E4E485-3612-4560-91FE-859D96FC65ED
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="signature.asc"
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Message signed with OpenPGP using GPGMail

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJVWwUSAAoJECldTB9TIAHGpDcP/2p2Cw/caBEC0+DmCSCQKJrj
9Uykhrel6djloLS82+6EdK7Ftx9W2zB1Xl98D6TOvh1zSvzz/KrpaPyItNm413MQ
vlLthHmlT2b7QgiSNnDrnq1xvbP5ARYsx4yK0L6NR0NZUsHoDpj8XkZuWxg9w1NV
dkEGhOQBDI0neKfHgpazyE256MDlNB/gouUjdqnrE1q+FqxvobBJ8Jzwdb9YeCj0
wLCH0DpdxNsvTnDprNA5aqViVHudmdOmDwp4Rg/yqVBDfA0ZOXs2MEbDyAPBqapq
m9nVjkC4LeK8HmCOK2EVmhmxvGyvx4fKrJ3tKfJpYLY0ottuc05gO1Vl/Sv+bnMg
rTxvTO5EHZj8KNEgj7D5jlLZYkcp20nJDGGPwFnHa4qfjC5I9sCNGjZoYlKA4gb9
KmESElwinMajZhlrMEK78iT2IzGAjyZL+4qovbTu7amaz2uTr03zJEytEGIpp7KY
tKyEGlIt6RQ+b1H8EZU3CR6xH3yhyyqfViKCeaXte4aaVHpeEDChFW5VCJqDiwyc
nfKO8mZ/tCHDhGVguKPjST8La/2lT4cq0vkbzsWOXIOCiXcamXct9gR0UldyAgyy
eviJEps/h6CPwv+90dj/OHntCf6deBC6cji1Qinj4917fXJpRZQMSyh8IjO8SHcx
N/bx7B0AHQ2niracccO7
=XjhG
-----END PGP SIGNATURE-----

--Apple-Mail=_34E4E485-3612-4560-91FE-859D96FC65ED--

--===============8574020889010047874==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

--===============8574020889010047874==--

