User:Alecmuffett/sandbox

.onion is a special-use top level domain suffix designating an anonymous hidden service reachable via the Tor network. Such addresses are not actual DNS names, and the .onion TLD is not in the Internet DNS root, but with the appropriate proxy software installed, Internet programs such as web browsers can access sites with .onion addresses by sending the request through the network of Tor servers.

The purpose of using such a system is to make both the information provider and the person accessing the information more difficult to trace, whether by one another, by an intermediate network host, or by an outsider; and also to improve the privacy and integrity of communications.

Sites which offer dedicated .onion addresses can provide an additional layer of identity assurance via SSL certificates, and provision of an HTTP certificate also enables browser features which would otherwise be unavailable to users of .onion sites. Provision of an onion site also helps mitigate SSL stripping attacks by malicious exit nodes on the Tor network upon users who would otherwise access traditional HTTPS clearnet sites over Tor.

Format
Addresses in the .onion TLD are generally opaque, non-mnemonic, 16- or 56-character alpha-semi-numerical strings which are automatically generated based on a public key when a hidden service is configured. These strings can be made up of any letter of the alphabet, and decimal digits from 2 to 7, representing in base32 either an 80-bit hash ("version 2"/16 character) or an ed25519 public key ("version 3"/56-character).

CITE:https://blog.torproject.org/we-want-you-test-next-gen-onion-services

It is possible to set up a human-readable .onion URL (e.g. starting with an organization name) by generating massive numbers of key pairs (a computational process that can be parallelized) until a sufficiently desirable URL is found.

The "onion" name refers to onion routing, the technique used by Tor to achieve a degree of anonymity.

Official designation
The .onion TLD used to be a pseudo-top-level domain host suffix, similar in concept to such endings as .bitnet and .uucp used in earlier times.

On 9 September 2015 ICANN, IANA and the IETF designated .onion as a 'special use domain', giving the domain an official status following a proposal from Jacob Appelbaum of the Tor Project and Facebook security engineer Alec Muffett.

HTTPS support
Prior to the adoption of CA/Browser Forum Ballot 144, a HTTPS certificate for a .onion name could only be acquired by treating .onion as an Internal Server Name. Per the CA/Browser Forum's Baseline Requirements, these certificates could be issued, but were required to expire before 1 November 2015.

DuckDuckGo launched an onion site with a self-signed certificate in July 2013, and (via the Internal Server Name process) Facebook published the first SSL Onion certificate to be issued by a Certificate Authority in October 2014, with the launch of facebookcorewwwi.onion.

Blockchain.info followed in December 2014, and The Intercept in April 2015.

After the adoption of CA/Browser Forum Ballot 144 in February 2015 and the designation of the domain as 'special use' in September 2015, .onion now meets the criteria for RFC 6761. and certificate authorities may now issue SSL certificates for HTTPS .onion sites per the process documented in the CA/Browser Forum's Baseline Requirements, introduced in Ballot 144.

CITE:https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/

As of May 2018, 44 different onion addresses have been registered to the Certificate Transparency logs, 4 of which are the "version 3"/56-character format.

CITE:https://crt.sh/?q=%25.onion

Notable Adoption

 * DuckDuckGo CITE:?
 * Facebookcorewwwi.onion CITE:?
 * Blockchain.info CITE:?
 * ProPublica launched an an .onion site in January 2016 CITE:https://www.propublica.org/nerds/a-more-secure-and-anonymous-propublica-using-tor-hidden-services
 * Privacy International CITE:?
 * The New York Times launched an .onion site in October 2017.

Clearnet gateways
Proxies into the Tor network like Tor2web allow access to hidden services from non-Tor browsers and for search engines that are not Tor-aware. By using a gateway, users give up their own anonymity and trust the gateway to deliver the correct content. Both the gateway and the hidden service can fingerprint the browser, and access user IP address data. Some proxies use caching techniques to provide better page-loading than the official Tor Browser.

.exit
.exit was a pseudo-top-level domain used by Tor users to indicate on the fly to the Tor software the preferred exit node that should be used while connecting to a service such as a web server, without having to edit the configuration file for Tor (torrc).

The syntax used with this domain was hostname + .exitnode + .exit, so that a user wanting to connect to http://www.torproject.org/ through node tor26 would have to enter the URL  http://www.torproject.org.tor26.exit .

Example uses for this include accessing a site available only to addresses of a certain country or checking if a certain node is working. Users could also type exitnode.exit alone to access the IP address of exitnode.

The .exit notation is deprecated as of version 0.2.9.8. It is disabled by default as of version 0.2.2.1-alpha due to potential application-level attacks.