Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New York Times Is Now Available as a Tor Onion Service

open.nytimes.com

Post reply on HN
Print view View original

51–60 of 205 posts

Re: The New York Times Is Now Available as a Tor Onion Service

#51

Post by aeorgnoieang »

socceroos wrote: post #16
Bishonen88 wrote: post #2

So is it now "guaranteed", that TOR is secure? And how many "guarantees" does one need in order to be "guaranteed" security whilst browsing? [...]and they provide additional guarantees that readers are connected securely to our website.[...]

Disable Javascript. Enabling it makes you traceable. Run a Temporary profile in Firefox - otherwise cached images will make you traceable. Connect from your neighbors wifi (the further from your home the better, really) with a spoofed MAC address running from a write-locked USB live distro - this ensures you're protected from the unknown unknowns.

> Run a Temporary profile in Firefox

What're the equivalent or similar features in other browsers (e.g. Chrome)? Incognito mode?

Re: The New York Times Is Now Available as a Tor Onion Service

#52

Post by secabeen »

dublinben wrote: post #45
nailer wrote: post #20

Earlier quoted context omitted.

EV is mandatory for .onion HTTPS certificates - since onion hashes (the 'domain name') are even less meaningful as a form of identity than regular domains. There's a couple of other differences with .onion certs too: https://certsimple.com/help/tor-support

This is incorrect. Onion domain addresses already provide the same level of confidence as a DV certificate, because they are a public key of the server you are connecting to. There would be no additional value in issuing a DV certificate for an .onion domain.

Yes, but how do you know that you are actually connected to nytimes3xpfgragh.onion each time? DV lets you know that the onion site you connected to is the NYTimes, and not a privacy-attacking MITM site.

Did you notice that I changed the nytimes URL a tiny bit up there? nytimes3xbfgragh.onion is the real one. (Yes, there's no guarantee that someone else would be able to generate a specific alternate address, but one that also starts with nytimes is probably possible for a well-resourced attacker.)

Re: The New York Times Is Now Available as a Tor Onion Service

#53

Post by nobodyorother »

ceejayoz wrote: post #48
nobodyorother wrote: post #44

Does the onion service still serve the same advertisements their website and mobile app do? If so, they're leaving their users-who-want-to-stay-relatively-anonymous open to attack via the advertisement vector. Members of that group would be considered high-value targets simply due to their anonymity desires. I can't see the number of daily users being large enough that they'd lose significant profit by closing that a…

If you're using Tor surely you should be disabling third-party and non-onion assets and JavaScript?

Not all entry points do the most paranoid thing, and not options are even available on all entry points.

The Tor Browser Bundle (desktop) has different defaults than Orfox (phone), and I think both will connect to non-onion URLs when connecting to an onion site. Same for JS, ad-block, etc.

Re: The New York Times Is Now Available as a Tor Onion Service

#54

Post by jerheinze »

socceroos wrote: post #16
Bishonen88 wrote: post #2

So is it now "guaranteed", that TOR is secure? And how many "guarantees" does one need in order to be "guaranteed" security whilst browsing? [...]and they provide additional guarantees that readers are connected securely to our website.[...]

Disable Javascript. Enabling it makes you traceable. Run a Temporary profile in Firefox - otherwise cached images will make you traceable. Connect from your neighbors wifi (the further from your home the better, really) with a spoofed MAC address running from a write-locked USB live distro - this ensures you're protected from the unknown unknowns.

Or just use the Tor Browser - ideally with the High security setting. Other browsers don't have the same anti fingerprinting and first party isolation defenses.

Re: The New York Times Is Now Available as a Tor Onion Service

#57

Post by detaro »

Illniyar wrote: post #55

Err... does the tor site still have the 10 views a month for free limit? Are tor users supposed to subscribe to NYT - that will surely blow through any privacy you hope to achieve.

See this subthread https://news.ycombinator.com/item?id=15567778

Re: The New York Times Is Now Available as a Tor Onion Service

#58

Post by reaperducer »

nobodyorother wrote: post #44

Does the onion service still serve the same advertisements their website and mobile app do? If so, they're leaving their users-who-want-to-stay-relatively-anonymous open to attack via the advertisement vector. Members of that group would be considered high-value targets simply due to their anonymity desires. I can't see the number of daily users being large enough that they'd lose significant profit by closing that a…

Why not try it and let us know instead of simply making guesses?

Re: The New York Times Is Now Available as a Tor Onion Service

#59

Post by jerheinze »

comboy wrote: post #41
Gaelan wrote: post #36

Earlier quoted context omitted.

There are no “easy” onion URLs. They are essentially random (hash of a key iirc). It’s possible to generate random URLs until you get a prefix you like, but the time it takes increases exponentially with length of the desired prefix.

I wonder why namecoin addresses are not a part of the tor yet. Onion urls should be treated more like IPs.

It's in their works, see their proposal 279: https://gitweb.torproject.org/torspec.git/tree/proposals/279...

As well as this blog post: https://blog.torproject.org/cooking-onions-names-your-onions

See also this ticket for following the progress: https://trac.torproject.org/projects/tor/ticket/10747

Re: The New York Times Is Now Available as a Tor Onion Service

#60

Post by dublinben »

secabeen wrote: post #52
dublinben wrote: post #45

Earlier quoted context omitted.

This is incorrect. Onion domain addresses already provide the same level of confidence as a DV certificate, because they are a public key of the server you are connecting to. There would be no additional value in issuing a DV certificate for an .onion domain.

Yes, but how do you know that you are actually connected to nytimes3xpfgragh.onion each time? DV lets you know that the onion site you connected to is the NYTimes, and not a privacy-attacking MITM site. Did you notice that I changed the nytimes URL a tiny bit up there? nytimes3xbfgragh.onion is the real one. (Yes, there's no guarantee that someone else would be able to generate a specific alternate address, but one t…

DV lets you know that you're connecting to the domain that you're connecting to. You already know that with all onion addresses.

EV lets you assure that you are connected to the New York Times.

Post reply on HN