Monsters defeated in quest to free .onion from clutches of DNS-snooping demons

Nice friendly IETF monsters, natch

Big steps were taken this week to get The Onion Router (Tor) project's .onion names out of DNS – and away from prying eyes.

Tor helps cloak people's identities online by routing their connections through multiple nodes to internal hidden services, or out to the wider internet via exit relays. Tor is used by all sorts of people: whistleblowers, journalists, activists, crooks, lowlifes, you name it.

These hidden services are reached using a .onion name that is used by the Tor software to locate a server within the Tor network: for example, facebookcorewwwi.onion looks like a normal URL, but is actually an onion name for a Facebook web server in the Tor network. Similarly, frxleqtzgvwkv7oz.onion was the onion name for the Freenode IRC service within the Tor network.

Trouble is, if you give an application an onion name, it may well try to contact a DNS server on the public internet to resolve this name into an IP address to connect to, rather than pass it to a Tor client to handle securely. Anyone eavesdropping on these external lookups can easily work out you're trying to access a hidden service – you'll end up leaving footprints that lead back to you, destroying your privacy.

Software such as the Tor Browser is configured to use .onion names properly, and not toss them out to the public DNS system, but not every app is aware of Tor. So anti-surveillance campaigners Jacob Applebaum and Alec Muffett have proposed an official internet standard to:

  • Force applications to either handle .onion names directly, or run them through a Tor proxy to keep information about the connection away from the public internet.
  • Force DNS library code and APIs to use the Tor network to resolve .onion domains or responded with the error code NXDOMAIN.
  • Force caching DNS servers to return NXDOMAIN for .onion lookups that manage to come their way.
  • Force DNS server admins to not handle .onion lookups.
  • Force DNS registrars to not register .onion domain names on the public internet.

Such measures are needed because the Tor project decided to start using .onion names before domain-name overseer ICANN started taking applications for new dot-word domains – meaning anyone with enough money to burn could buy the rights to operate all .onion addresses and make life hell for the Tor project.

The good news, for the project, is that IANA – the ICANN-run body that oversees the world's DNS among other things – on Wednesday made .onion a special case domain name, meaning just like addresses ending in .invalid, internet software should treat .onion different to normal domain names.

Crucially, also on Wednesday, the IETF – the backroom techies that help keep the internet ticking over – approved Appelbaum and Muffett's draft standard. Now the document is with the RFC Editor to rubber stamp and publish as a standard that software and systems are expected to obey – thus ring-fencing .onion from the public DNS.

All that's left then is for ICANN to agree to put .onion on its list of reserved generic top-level domains, meaning it won't flog the dot-word off to a registry at a later date.

The IETF's approval is in line with the Internet Architecture Board's decision to rethink the 'net, top-to-bottom, in the face of pervasive surveillance. ®

Editor's note: This story was revised after publication with extra context and information.

Similar topics

Other stories you might like

  • James Webb Space Telescope has arrived at its new home – an orbit almost a million miles from Earth

    Funnily enough, that's where we want to be right now, too

    The James Webb Space Telescope, the largest and most complex space observatory built by NASA, has reached its final destination: L2, the second Sun-Earth Lagrange point, an orbit located about a million miles away.

    Mission control sent instructions to fire the telescope's thrusters at 1400 EST (1900 UTC) on Monday. The small boost increased its speed by about 3.6 miles per hour to send it to L2, where it will orbit the Sun in line with Earth for the foreseeable future. It takes about 180 days to complete an L2 orbit, Amber Straughn, deputy project scientist for Webb Science Communications at NASA's Goddard Space Flight Center, said during a live briefing.

    "Webb, welcome home!" blurted NASA's Administrator Bill Nelson. "Congratulations to the team for all of their hard work ensuring Webb's safe arrival at L2 today. We're one step closer to uncovering the mysteries of the universe. And I can't wait to see Webb's first new views of the universe this summer."

    Continue reading
  • LG promises to make home appliance software upgradeable to take on new tasks

    Kids: empty the dishwasher! We can’t, Dad, it’s updating its OS to handle baked on grime from winter curries

    As the right to repair movement gathers pace, Korea’s LG has decided to make sure that its whitegoods can be upgraded.

    The company today announced a scheme called “Evolving Appliances For You.”

    The plan is sketchy: LG has outlined a scenario in which a customer who moves to a locale with climate markedly different to their previous home could use LG’s ThingQ app to upgrade their clothes dryer with new software that makes the appliance better suited to prevailing conditions and to the kind of fabrics you’d wear in a hotter or colder climes. The drier could also get new hardware to handle its new location. An image distributed by LG shows off the ability to change the tune a dryer plays after it finishes a load.

    Continue reading
  • IBM confirms new mainframe to arrive ‘late’ in first half of 2022

    Hybrid cloud is Big Blue's big bet, but big iron is predicted to bring a welcome revenue boost

    IBM has confirmed that a new model of its Z Series mainframes will arrive “late in the first half” of 2022 and emphasised the new device’s debut as a source of improved revenue for the company’s infrastructure business.

    CFO James Kavanaugh put the release on the roadmap during Big Blue’s Q4 2021 earnings call on Monday. The CFO suggested the new release will make a positive impact on IBM’s revenue, which came in at $16.7 billion for the quarter and $57.35bn for the year. The Q4 number was up 6.5 per cent year on year, the annual number was a $2.2bn jump.

    Kavanaugh mentioned the mainframe because revenue from the big iron was down four points in the quarter, a dip that Big Blue attributed to the fact that its last mainframe – the Z15 – emerged in 2019 and the sales cycle has naturally ebbed after eleven quarters of sales. But what a sales cycle it was: IBM says the Z15 has done better than its predecessor and seen shipments that can power more MIPS (Millions of Instructions Per Second) than in any previous program in the company’s history*.

    Continue reading

Biting the hand that feeds IT © 1998–2022