Hacker News Reader

Comment by vbezhenar | Hacker News Reader

EV certificates add green buttons with company names. Registrar checked that this company indeed exists and legal. So you can be sure, that you didn't mistype URL. And may be some users are comfortable with HTTPS scheme.

Another concern is that major browsers might obsolete HTTP scheme, so their UI will warn user about insecure connection. I'm not sure whether browsers will be able to distinct between onion sites and regular sites in that aspect.

View on HN

> EV certificates add green buttons with company names. Registrar checked that this company indeed exists and legal. So you can be sure, that you didn't mistype URL. And may be some users are comfortable with HTTPS scheme.

Yeah, but those are companies that might as well have non-hidden websites, or be serving .onion mirrors of their regular domains.

The main "use case" for .onion domains are people for whom EV certificates would defeat the whole point.

> be serving .onion mirrors of their regular domains.

Which is an excellent usecase for a cert to make sure that you actually are connected to the mirror. They could even have a cert that works for both domains, linking those together.

That's not true. One of the points of TOR services is that they can't be (easily) blocked by governments and/or ISPs. There's a huge HUGE difference between a TLD and .onion.

Washington Post, Gawker, and others who use the SecureDrop software for soliciting leaks are a great use case for .onion+EV. You get the assurance that your connection is encrypted and, as much as possible, anonymous from the person you're connecting to; you get the assertion of the person you're leaking to that they are who they claim to be; and you get a 3rd-party validating with high confidence that someone authorized to represent that company set up the domain you're leaking to.

Reply on news.ycombinator.com