Comment by markasoftware | Hacker News Reader

Comment by markasoftware | Hacker News Reader

Parent Full thread

Fascinating, onion services are always encrypted by the tor network but still tunnel "cleartext" http inside that, and there are no CAs that issue free of charge certificates for .onion domains, and therefore there's no free of charge way to get http/2 on onion services without self signing.

Which raises the question: why not just trust self-signed certificates on onion services? From my brief look it seems to be because the Tor project views the primary purposes of HTTPS on onion services to be other things rather than just http/2 support: http/2 isn't even mentioned on their page about https for onion services (https://community.torproject.org/onion-services/advanced/htt...). Unfortunate.

I personally would support automatically trusting self signed https certs since their key is typically secured under the same safety as the hidden service's key. And even when they are not the browser has no warning when you get downgraded to HTTP on an onion compared to a regular site.

Trying to push hidden services to stay on HTTP is going against what the rest of the web is doing and as a minority of web traffic it really should be aligned to the rest of the web and also require HTTPS. Yes, it's technically wasteful, but reduces both work and security risk by keeping security models aligned with the rest of the web.

And it breaks Javascript as a lot of APIs only work when the site is served via HTTP - which .onion sites won't be usually. Tor browser treats .onion sites as secure content, but not your regular browser using TOR via proxy.

Who would issue the certificates?

The "self" in "self-signed" means "you"

There's no point teaching the browser that self signed certificates are secure instead of teaching the browser that onion addresses are secure.

I believe the http/2 implementations are often quite intertwined with TLS in particular

Negotiating HTTP 2 requires an extra round trip btw. It gets absorbed into the several round trips required for TLS.

Despite that my benchmark was faster with HTTP 2.

Reply on news.ycombinator.com