Onion addresses offer lookup and routing security, self-authenticated connections, and censorship resistance. Many websites are thus also available as onionsites reachable using Tor Browser. Onion Location (how Tor currently associates registered domains and onion addresses) is a weak link. It’s completely blocked if the registered domain is blocked, canceling censorship advantages. I will describe such blocking, also how Onion Location makes hijack and targeted tracking easier to do without detection. I will also describe an implemented alternative, sauteed onions, that leverages Certificate Transparency to make onion association blocking resistant, hijack resistant, transparent, and consistent for all users.
Sauteed onions are great, if you already have an onionsite to go with your domain (serverside) or are running Tor Browser (clientside). Self-authenticating Traditional addresses (SATAs) offer onion address protections but are meaningful to users, popular browsers, and to DNS. They’re completely backwards compatible: browsers that only know about TLS and certificates but nothing about onion services work with SATAs as with any typical URL. Contacting a SATA on Firefox with our extension adds self-authentication protection and the transparency of sauteed onions to ordinary browsers. Using the extension in Tor Browser will add the full routing and lookup protections too.