Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New York Times Is Now Available as a Tor Onion Service

open.nytimes.com

Post reply on HN
Print view View original

171–180 of 205 posts

Re: The New York Times Is Now Available as a Tor Onion Service

#171

Post by pavement »

_eht wrote: post #169
woodandsteel wrote: post #160

Earlier quoted context omitted.

What we need is some way for the vast majority of the population who are not nearly as good at security as you are and never could be, to be able to access such sites securely.

The first step to that involves educating the media that the big scary dark web isn't just for drugs and other like minded Bitcoin slinging criminals.

Oh, I'd hazard a guess that the media is well-educated, and handily equipped with an agenda similar to advertisers and marketers employing dark patterns and pervasive analytics.

And I never claimed I was good at anything. But I did intend to point out that with advanced persistent threats in the mix, and nation state actors operating with effectively unlimited resources, failing to notice the difference between two vaguely similar nonces (in a situation where it matters) is going to get you hanged, depending on what you're trying to fly below radar.

Re: The New York Times Is Now Available as a Tor Onion Service

#172

Post by easyroot »

forapurpose wrote: post #117
colejohnson66 wrote: post #30

Earlier quoted context omitted.

So in addition to knowing that your browser is connected to where you want, you now know that the website you want is actually who they say they are?

> you now know that the website you want is actually who they say they are? That's the idea. Of course, validation, while more thorough than for standard certs, still is not that reliable. My strong impression is that it could be fooled by anyone sufficiently motivated.

EV is part of a narrative. Which has some value, even if weak.

Re: The New York Times Is Now Available as a Tor Onion Service

#173

Post by [deleted] »

4684499 wrote: post #170

I don't see the point. A hidden service is set for information can not be safely presented on the public Internet. Like what The Daily Stormer did. If one just wanted to bypass blocking or hide himself from evil third parties, he could just use tor browser to open NYT's regular domain instead of the hidden service domain, no?

[deleted]

Re: The New York Times Is Now Available as a Tor Onion Service

#174

Post by unsignedint »

animeseinfeld wrote: post #31
nottorp wrote: post #8

Hmm don't you have to pay to access the full newspaper? How does that mix with Tor anonymity?

The paywall exists on the NYT's onion site as well. But a certain number of articles -- I think 10 -- are free to read each month.

That would still contradict anonymity though. They can't track users by IP address or cookies (if Tor browser is used... it is transient for the session) and having people register means they are likely have to come out of anonymity. If they do manage to register one from anonymous throwaway address, then it essentially make paywall moot...

Re: The New York Times Is Now Available as a Tor Onion Service

#175

Post by Ajedi32 »

4684499 wrote: post #170

I don't see the point. A hidden service is set for information can not be safely presented on the public Internet. Like what The Daily Stormer did. If one just wanted to bypass blocking or hide himself from evil third parties, he could just use tor browser to open NYT's regular domain instead of the hidden service domain, no?

Onion services are faster on Tor, since you aren't limited by the bandwidth of the exit nodes.

There are also some security benefits, since connections to hidden services are automatically encrypted and authenticated, no HTTPS or trust in Certificate Authorities required (though HTTPS with EV certs can still be useful for identification purposes).

Re: The New York Times Is Now Available as a Tor Onion Service

#176

Post by nailer »

dublinben wrote: post #45
nailer wrote: post #20

Earlier quoted context omitted.

EV is mandatory for .onion HTTPS certificates - since onion hashes (the 'domain name') are even less meaningful as a form of identity than regular domains. There's a couple of other differences with .onion certs too: https://certsimple.com/help/tor-support

This is incorrect. Onion domain addresses already provide the same level of confidence as a DV certificate, because they are a public key of the server you are connecting to. There would be no additional value in issuing a DV certificate for an .onion domain.

I believe you've misread my post. A domain name is a poor form of identity in many cases, a hash is even less recognisable to most people.

Re: The New York Times Is Now Available as a Tor Onion Service

#177

Post by alloyed »

juliangoldsmith wrote: post #149
pbarnes_1 wrote: post #144

Earlier quoted context omitted.

LOL. A link to the Washington Times! Good job. A significant portion of the dossier has been corroborated so far. The GOP funded it originally. The FBI funded it after. In either case, the NYT loves Trump. Their "feud" is for show only. Trump is the establishment.

Got literally any sources?

This is pretty defineably public record:

https://en.wikipedia.org/wiki/Donald_Trump%E2%80%93Russia_do...

notably: it's not the GOP the organization that initial funded the oppo, but a private news org with conservative leanings. and the FBI did not fund the dossier, but were provided it during its creation. (side note: who cares)

When it comes to corroboration: I would think the special investigation is good enough evidence that the claims of Russian cooperation are being taken seriously, no? Significant is a weasel word but there is actual smoke here.

Re: The New York Times Is Now Available as a Tor Onion Service

#178

Post by JoshTriplett »

chrisfosterelli wrote: post #125
JoshTriplett wrote: post #115

Earlier quoted context omitted.

Sometimes I wonder if it's a good idea to brute-force these kinds of "vanity" onion prefixes. Take a look at the addresses used in http://incoherency.co.uk/blog/stories/hidden-service-phishin... ; they brute-forced the same prefix with a different suffix. Would anyone really notice?

If they didn't use vanity names, then people would only remember the first/last few random characters and the phishing scheme could very well still work, just it'd be less readable for visitors. I don't think we can assume that if all the characters were random they would remember them all better.

I don't think people would remember them better if completely random. Rather, I think if they're completely random, people might correctly assume they can't, and remain appropriately skeptical; if they include a vanity prefix, people seem likely to remember the vanity prefix and somewhat less likely to pay attention to the rest.

Re: The New York Times Is Now Available as a Tor Onion Service

#180

Post by kurusii »

DonHopkins wrote: post #99
athenot wrote: post #64

Earlier quoted context omitted.

> "a bunch of business documents and legal proof" In my case they just needed me to put an entry in the Yellow Pages...

Don't forget to restart your ypserver! Also, never put this line in /etc/netgroup then rwall to it: universal (,,) http://www-mice.cs.ucl.ac.uk/multimedia/misc/tcp_ip/8702.mm....

That was a fun read. Thanks for the link.

On a somewhat related topic, I worry a lot about things on the internet disappearing, most often simply due to neglect (domain expiry, companies being bought, et c.) I try to save everything I can that I find interesting, in fear of it never being available again.

That said, it makes me very happy to see emails from 1987 archived online--so happy that I've even saved a copy.

Post reply on HN