Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New York Times Is Now Available as a Tor Onion Service

open.nytimes.com

Post reply on HN
Print view View original

151–160 of 205 posts

Re: The New York Times Is Now Available as a Tor Onion Service

#151

Post by sp332 »

0xJRS wrote: post #81
spyspy wrote: post #39

Earlier quoted context omitted.

I recall that Facebook brute forced their way into having an onion url that was easy to remember, by generating millions of them and then picking one that was simple.

Its something like facebookcorewwwi.onion - that must have taken a lot of cycles to generate..

It was over 100,000,000 CPU-hours https://news.ycombinator.com/item?id=11550922 And they still got extremely lucky to find such a good address. https://news.ycombinator.com/item?id=8538390 It's not usually that easy.

Re: The New York Times Is Now Available as a Tor Onion Service

#152

Post by the8472 »

milofeynman wrote: post #122
jerheinze wrote: post #75

Earlier quoted context omitted.

... i.e. first party isolation, one can read more about it on the Tor Browser design document: https://www.torproject.org/projects/torbrowser/design/

How can I get first party isolation in regular chrome or firefox? That is exactly what I've been imagining/wanting since Firefox announced their new container prototype.

In firefox: about:config -> privacy.firstparty.isolate = true

Note that containers provide similar functionality but in a less rigid manner. On the other hand first party isolation has the advantage that it also applies on navigation within a single tab while containers are fixed within a single tab. Currently neither is a superset of the other. If bug 1323873 [0] gets implemented then containers + some scripting by extensions could act as a superset of first party isolation.

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1323873

Re: The New York Times Is Now Available as a Tor Onion Service

#153

Post by [deleted] »

blfr wrote: post #10

And they're using an Extended Validation certificate from DigiCert for it CN = nytimes3xbfgragh.onion OU = Technology O = The New York Times Company Object Identifier (2 5 4 15) = Private Organization along with some other addresses DNS Name: nytimes3xbfgragh.onion DNS Name: graylady3jvrrxbe.onion DNS Name: *.graylady3jvrrxbe.onion DNS Name: *.dev.graylady3jvrrxbe.onion DNS Name: *.stg.graylady3jvrrxbe.onion DNS Name…

[deleted]

Re: The New York Times Is Now Available as a Tor Onion Service

#154

Post by conductor »

What's the point of making it available in the Tor network if their onion site includes a script from www.googletagmanager.com (or an "iframe" if scripting is disabled) thus making it significantly less anonymous?

Onion websites should be isolated and should not initiate any connections to vanilla internet.

Edit: it also loads scripts from www.google.com, tags.bluekai.com, cdn.optimizely.com...

Re: The New York Times Is Now Available as a Tor Onion Service

#156

Post by tresp »

gressquel wrote: post #21
Bishonen88 wrote: post #2

So is it now "guaranteed", that TOR is secure? And how many "guarantees" does one need in order to be "guaranteed" security whilst browsing? [...]and they provide additional guarantees that readers are connected securely to our website.[...]

Its not secure. "Everyone" knows that. Everytime a drug market is taken down or a pedophile ring is busted, the investigators from FBI always claim it was some dubious mistake from the admin whic lead to it. But we all know they have discovered a vulnurability in the TOR protocol but won't disclose it. Safe browsing guys //edit: if you want extra security. Launch TOR from a remote desktop. And I am not talking about…

lmao, this is complete BS. sure it's not perfect and some nodes get compromised. no nation or three letter agency has cracked tor. prove me wrong

Re: The New York Times Is Now Available as a Tor Onion Service

#157

Post by tresp »

jerheinze wrote: post #61
gressquel wrote: post #21

Earlier quoted context omitted.

Its not secure. "Everyone" knows that. Everytime a drug market is taken down or a pedophile ring is busted, the investigators from FBI always claim it was some dubious mistake from the admin whic lead to it. But we all know they have discovered a vulnurability in the TOR protocol but won't disclose it. Safe browsing guys //edit: if you want extra security. Launch TOR from a remote desktop. And I am not talking about…

> //edit: if you want extra security. Launch TOR from a remote desktop. And I am not talking about the ones you buy from known VPN providers like NordicVPN or amazon web services. No, if you want extra security use Qubes OS with Whonix (it comes with it by default) for isolating the Tor process in a single VM and the browser in another - thereby prohibiting any leaks, unless an adversary has a VM escape RCE.

what about Tails?

Re: The New York Times Is Now Available as a Tor Onion Service

#158

Post by ryacko »

ne0n wrote: post #145
giancarlostoro wrote: post #142

Earlier quoted context omitted.

Would it make any sense to use something like tor.nytimes.com to redirect to their hidden service on the other hand? To allow people to be sure they're hitting the correct endpoint on Tor. If you're on TOR you typically have access to the rest of the internet, at least depending on setup.

Only if you're fine broadcasting in plaintext what tor site you're going to. The DNS lookup defeats the privacy of using an onion address.

Exit nodes could also manipulate DNS.

Re: The New York Times Is Now Available as a Tor Onion Service

#159

Post by JumpCrisscross »

acchow wrote: post #123
belorn wrote: post #22

Earlier quoted context omitted.

Extended Validation certificate is when a company go to a CA and provide a bunch of business documents and legal proof that they really own the company behind a name. Its not a technical aspect but human lawyer human lawyer that establish a certificate. At the end if the validation is successful, the company get a technical signed document that in browsers shows up as a green lock and the name in green next to the UR…

Why do we think a lawyer would be less likely to be duped? If they are relying on physical paper and pen signatures...aren't those all incredibly easy to fake?

> If they are relying on physical paper and pen signatures...aren't those all incredibly easy to fake?

Lawyers are good at verifying identities. It's a core part of their work. More critically, in-person fraud scales differently from electronic fraud.

Re: The New York Times Is Now Available as a Tor Onion Service

#160

Post by woodandsteel »

pavement wrote: post #139
JoshTriplett wrote: post #115

Earlier quoted context omitted.

Sometimes I wonder if it's a good idea to brute-force these kinds of "vanity" onion prefixes. Take a look at the addresses used in http://incoherency.co.uk/blog/stories/hidden-service-phishin... ; they brute-forced the same prefix with a different suffix. Would anyone really notice?

If you're that easily phished, why are you using TOR at all? You aren't being attentive enough for high risk activities. You lack proper verification channels, to confirm authenticity, which matters in this context. You lack the situational awareness to proceed safely. Admit that you might not be cut out for what it takes to maintain a secure posture on the internet, if that's what gets you. Just stop pretending to t…

What we need is some way for the vast majority of the population who are not nearly as good at security as you are and never could be, to be able to access such sites securely.
Post reply on HN