Hacker News Reader

Comment by wyager | Hacker News Reader

You can have cryptographically anchored pseudonymous trust, which is what Tor does. In many ways it’s stronger than the kinds of trust you run into normally.

View on HN

You still have to get a correct onion address from a reputable source otherwise how do you know that you're going to the right onion and not a malicious mirror or something? So somehow there is a chain of trust, not too unlike the traditional PKI model.

What would be the "correct onion address" for 3fyb44wdhnd2ghhl.onion?

That is the “correct onion address” for that hashcode, but you have to obtain the hashcode somehow.

And you might be obtaining a fake link from one of my phishing schemes that mimic the services you thought you were visiting...

No one is arguing that onion links are impervious to being lied about. But domain names don't have that property either. In fact, it's somewhat easier to compromise many domain names.

Well, yes, obviously, in order to know something you have to know it!?

What I don't understand is what any of that has to do with any sort of "correctness"?!

How do you find out the correct name of James Miller? How do you find out the correct domain of google.com? That just seems like a set of nonsensical questions to me.

Couldn't we put the onion address on the site, signed by the site/publishers key? Ignoring key exchange methods for a moment, once you have a key for "Bob the Blogger" you can verify Bob says the address is X and your url is X, so this is Bob's site.

Reply on news.ycombinator.com