Calling the formal recognition of the .onion as a Special-use Domain Name by the Internet Engineering Task Force (IETF) “a small and important landmark in the movement to build privacy into the structure of the Internet,” Jacob Appelbaum, a security researcher and developer, privacy expert and a core member of the Tor Project, said in a Wednesday blog post that the draft to register the domain name included security and privacy considerations that likely “will help to protect end users from targeted and mass-surveillance.”
The standards body's confirmation of the special-use domain name is a culmination of work done in conjunction with Facebook software engineer and internet security evangelist Alec Muffet and others since 2013, or as Appelbaum called it, the “Summer of Snowden,” to ensure that .onion not become a Top Level Domain (TLD) that could not be sold by the Internet Corporation For Assigned Names and Numbers (ICANN).
“We averted a disaster,” Appelbaum told SCMagazine.com, noting that .onion joins other familiar names such as .local, which is used by Apple.
“Losing control of .onion had the potential to create confusion for all hidden services, not just Facebook,” Muffet told SCMagazine.com in a Wednesday email correspondence. “This is really about securing the way people connect to Facebook. With our .onion site on the TOR network, people can confidently connect to Facebook knowing their link is genuine and end-to-end secure.”
The Tor Project has been working with members of the Peer to Peer community (led by Dr. Christian Grothoff) to register a number of Special-Use Domain names, Appelbaum said. “We were strongly encouraged to split out .onion from the other Peer to Peer Names draft.”
Following the same process as Apple used to register .local, the .onion proponents crafted a draft detailing security and privacy considerations, and last week's publication of the name a special-use domain name by the RFC Editor (as RFC 7686) was a move toward standards that would secure the internet.
“Effective security encompasses privacy, integrity, and availability. The ideal outcome of standards is to enable these things by decreasing the risks associated with adopting new technologies and approaches,” said Muffet. “By recognizing .onion as a special use top level domain, IETF has made it easier for other organizations to provide more secure connections for people online.”
By using .onion, Appelbaum noted, users are assured of security from end to end. Due in part to its self-authentication capability, “if you can get a .onion domain name you can be absolutely sure you're only talking to” who is supposed to be at the other end, he said, adding that Facebook was able to get a vanity name, meaning that used in conjunction with .onion, users are offered two layers of security. “If you have .onion, you don't need SSL, because you know who you're talking to.” But users can still buy Extended Validation (EV) SSL/TLS certificates for .onion services, which provide added safeguards.
It's a beautiful thing,” he said, explaining it would prevent the names of hidden services from being sent out over the internet.
“End users now have the security and privacy they thought they had,” said Appelbaum, who now resides in Berlin after his own privacy was compromised following the U.S. Justice Department's push to obtain his email records from Google while investigating his work as a WikiLeaks volunteer. Google was slapped with a gag order forbidding the company from notifying Appelbaum of the government's request and prompting a slow-burning legal battle when the search engine company refused to turn over the information. But the more secure alternative offered by .onion shouldn't be readily apparent to the end user, nor should it be disruptive.
“If we do this right, users won't even know,” Appelbaum explained.
