Hacker News Reader

Comment by ignostic | Hacker News Reader

Good for the New Yorker; I hope this catches on. Unfortunately, if the encryption is not end-to-end, the data is not secure. In fact, the NSA may choose to hang out and watch the unsecured traffic flow.

The New Yorker should make the traffic a little more secure by encrypting traffic (using https).

There have been past instances where similar weaknesses were exploited by sniffers: http://www.wired.com/politics/security/news/2007/09/embassy_...

View on HN

That vulnerability applies when accessing normal web pages via Tor.

But that's now what the New Yorker has set up. They're hosting a Tor hidden service, and in that case Tor is necessarily encrypting the traffic end-to-end.

The problem is that you got the .onion address from an unsecured web page.

Someone between you and that unsecured web page could've changed the .onion address and when you went there you would be visiting a Strongbox hosted by the NSA rather than one for The New Yorker.

This is why you typically want to publish things like this as far and wide as possible - if any single source is compromised, it can be detected by noticing a discrepancy between two publicly available addresses. I'd wager they'll put it in their print edition (same as their physical address and phone number) from now on, because the NSA probably isn't going to everyone's house swapping out their magazines for altered ones, so anyone who gets the magazine will have a hard copy of the address.

Do CAs actually sign .onion certs? Of course they could go self-signed with fingerprint on the public-web site, but that would make it more difficult to use for fairly minor gain.

Reply on news.ycombinator.com