Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter's onion service is serving an invalid TLS certificate since 3/6/2023

twitter3e4tixl4xyajtrzo62zg5vztmjuricljdp2c5kshju4avyoid.onion

Post reply on HN
Print view View original

41–50 of 52 posts

Re: Twitter's onion service is serving an invalid TLS certificate since 3/6/2023

#41

Post by derefr »

ThePowerOfFuet wrote: post #9

Why are they even using TLS? Onion services bring their own security.

AFAICT, the one thing you get from using TLS, is a kind of redundant defense-in-depth to the site being taken over: to successfully pose as the site, the attacker would have to obtain both the Tor daemon private key, and the TLS private key. If the Tor session and the TLS session are each terminated on their own middlebox with separate security (or if e.g. the Tor privkey lives in memory on the machine, while the TLS privkey lives inside an HSM attached to the machine), then it becomes harder for anyone — even a state actor — to commandeer the site.

Also, the TLS cert would be signed by a CA, and so that CA can independently determine that the site has been commandeered and revoke the cert. (Not that I expect a CA would actually do this in a timely manner if the commandeering is done on behalf of a state actor — but that's more a fault in our current CA system than a fault in the logic of X.509 trust infrastructure itself.)

Re: Twitter's onion service is serving an invalid TLS certificate since 3/6/2023

#42

Post by derefr »

duskwuff wrote: post #39
sva_ wrote: post #21

Earlier quoted context omitted.

If there is no reason for it, then that is a reason against it. Regular people probably don't use Tor.

There's an annoying practical reason to use HTTPS on Tor: some browser features are gated on the page being served from an HTTPS origin. Some of them (like geolocation and payment requests) are likely to be irrelevant to most Tor users, but others (like HTTP2 and Web Crypto) are more generally relevant. https://developer.mozilla.org/en-US/docs/Web/Security/Secure...

Mind you, most of these TLS-origin-requiring features are only accessible through Javascript APIs — and so won't be used by any "zero trust" Tor hidden services (which must assume the client's Javascript is disabled) anyway.

Re: Twitter's onion service is serving an invalid TLS certificate since 3/6/2023

#44

Post by zen928 »

stathibus wrote: post #11

Twitter should not care about having an onion service. Great example of a distraction that the Musk downsizing properly removed.

It's so funny to me seeing variations of this post in response to anything related to what could be seen as a weakness to the actions taken after acquisition, while also seeing this in posts promoting twitters relative stability. It's just so transparent to what your motivation is and laughably pathetic how you feel the need to reaffirm and defend your stance on musk (lowercase) at any opportunity that projects any positivity on his decision making.

Oh, right, the topic that neither of us were actually taking about. Yep, I don't think anyone reasonably minded would be using a twitter tor exit node with twitters current reputation. Probably best to remove a service that no one would ever trust you enough to use.

Re: Twitter's onion service is serving an invalid TLS certificate since 3/6/2023

#45

Post by rakoo »

ThePowerOfFuet wrote: post #9

Why are they even using TLS? Onion services bring their own security.

TLS brings security and auth: how do you know twitter's service is at https://twitter3e4tixl4xyajtrzo62zg5vztmjuricljdp2c5kshju4av... ? Or is it at https://twitter3e4tixl4xyajtrzo62zg5vztmjuricljdp2c5kshju4av... ?

.onion certs can now go the whole chain such that you don't need to rely on non-tor access to do the auth

Re: Twitter's onion service is serving an invalid TLS certificate since 3/6/2023

#46

Post by jimrandomh »

Given that Twitter is the target of a lot of manipulation attempts, some of which come from intelligence agencies, having a .onion service seems like an actively bad thing. This seems like the sort of thing that a spy who snuck through the hiring process would build. Leaving it unmaintained seems worse than taking it down (especially since that implies a lack of monitoring that would invite abuse), but it definitely ought to go down.

Re: Twitter's onion service is serving an invalid TLS certificate since 3/6/2023

#47

Post by cedws »

jimrandomh wrote: post #46

Given that Twitter is the target of a lot of manipulation attempts, some of which come from intelligence agencies, having a .onion service seems like an actively bad thing. This seems like the sort of thing that a spy who snuck through the hiring process would build. Leaving it unmaintained seems worse than taking it down (especially since that implies a lack of monitoring that would invite abuse), but it definitely…

I mean, it's not like Twitter can't see where the traffic is coming from. If you start seeing thousands of users tweeting the same thing over Tor, it's a pretty obvious campaign.

Re: Twitter's onion service is serving an invalid TLS certificate since 3/6/2023

#48

Post by justinclift »

bastawhiz wrote: post #34
justinclift wrote: post #33

Earlier quoted context omitted.

> infra that was doing this job correctly Twitter's Onion handling hasn't been reasonably functional for years, so in this particular case it's not that.

The infrastructure that issues and replaces certs isn't the same infra that performs onion handling.

Am not personally seeing how that changes the relevance of our statements? :)

Re: Twitter's onion service is serving an invalid TLS certificate since 3/6/2023

#49

Post by weare138 »

jimrandomh wrote: post #46

Given that Twitter is the target of a lot of manipulation attempts, some of which come from intelligence agencies, having a .onion service seems like an actively bad thing. This seems like the sort of thing that a spy who snuck through the hiring process would build. Leaving it unmaintained seems worse than taking it down (especially since that implies a lack of monitoring that would invite abuse), but it definitely…

And what about users in countries with hostile governments? Your online posts get you killed in places like Saudi Arabia. The state will literally execute you. If there's a conspiracy here that's why Twitter's 'secure' TOR access is less secure now.

Re: Twitter's onion service is serving an invalid TLS certificate since 3/6/2023

#50

Post by bastawhiz »

justinclift wrote: post #48
bastawhiz wrote: post #34

Earlier quoted context omitted.

The infrastructure that issues and replaces certs isn't the same infra that performs onion handling.

Am not personally seeing how that changes the relevance of our statements? :)

The post is about the cert expiring in March of this year. So your statement that this issue is years old is simply untrue. There might be a separate issue, but the cert being invalid has nothing to do with that.
Post reply on HN