Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by hiro):

 We are now serving the onion-location header.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:  closed
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+
Changes (by hiro):

 * status:  assigned => closed
 * resolution:   => fixed


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by hiro):

 I am deploying this change today.
 Detail of the change here:
 https://share.riseup.net/#XmWMy2u3D_PSHhm2pOkCng

 To make sure I am temporarily disabling puppet from running on:
 - web-cymru-01.torproject.org
 - web-fsn-01.torproject.org
 - web-fsn-02.torproject.org
 - cdn-backend-sunet-01.torproject.org

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by evilaliv3):

 I just noticed that a ticket has been already opened in order to document
 this topic: https://trac.torproject.org/projects/tor/ticket/33516

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by evilaliv3):

 Hello! Here i've acutally the same question of @hiro.

 In GlobaLeaks we are considering to implement one or both the headers alt-
 svc and onion-location and we have documented here the use case:
 https://github.com/globaleaks/GlobaLeaks/issues/2847

 My doubt is:
 - do you advise to implement just one and what is your vision on long term
 support; i consider that you considered adding the onion-location before
 the definition of the standard alt-svc; will you continue to keep onion-
 location and which is it's value over alt-svc?
 - Does they both work in relation to http and https?
 - which is the prioritization run inside the Tor browser over the two
 implementations
 - which are the versions of Tor that supports one or the other?

 Thank you so much for clarifying. :)

 Thank

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by antonela):

 Replying to [comment:11 hiro]:
 > So should we implement both? Or only onion-location?
 Both

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by hiro):

 So should we implement both? Or only onion-location?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by antonela):

 Thanks for opening this ticket, hiro!

 At the moment there is no standard to redirect users to onions. Thanks to
 our work with S27, we deployed some features in the Tor Browser, which
 improves the experience of users reaching onions. Given that it is the
 first time we are prioritizing onions in Tor Browser, we decided to prompt
 users the first time of use and allow them to opt-in to prioritize onions
 globally.

 I hope that at some point, we can reach a moment where we can contemplate
 all stakeholder's needs and develop a standard for this TLS upgrade
 without messing around the domain naming business.

 For now, onion-location seems a to go for Tor Browser users, and (if I'm
 not wrong), alt-svc will work in clients like Brave. The end-user
 experience will be a little different, but both options will serve onions.

 I'm happy to learn about your pain-points implementing this. It will serve
 as material for our next iteration in this space.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Description changed by hiro:

Old description:

> We have received a number of tickets by Tor Browser users that we should
> keep people visiting the .onion version of a torproject.org website in
> the .onion space. Instead because we have different subdomains for
> different websites a user surfing the onion version of torproject.org
> will be taken to support.torproject.org instead of its onion address.
>
> I am willing to implement a header that signal the .onion address for all
> of our onions and I am currently considering two options.
>
> 1. Implement alt-svc. This is what facebook does. Specifically the
> browser receive a alt-sv header like:
>
> {{{
> alt-svc:
> h2="facebook2futmrduts5uqn3ahwg4qyqoks6h3alxf5drhsgyhzujyqad.onion:443";
> ma=86400
> }}}
>
> 2. Use onion-location:
>
> {{{
> Onion-Location:
> http://sbe5fi5cka5l3fqe.onion/~acat/test/onionlocation/header/
> }}}
>
> 3. Use a onion-location meta-tag:
>

> {{{
> 
> 
>   
>  content="http://sbe5fi5cka5l3fqe.onion/~acat/test/onionlocation/meta/"/>
>   
>   
> Onion-Location meta tag test.
>   
> 
> }}}
>
> I would personally prefer to use one of the two headers options. Either
> the alt-sv or the onion-location one. Both have advantages. I like that
> with alt-sv the connection is upgraded to an onion location without the
> address bar changing. At the same time we should also showcase our
> onions! And if we launch the onion-location header support we should show
> it on our websites.
>
> Something I would avoid is following the model that Privacy International
> use, and issue a "Location:" redirect when the client comes from an exit
> node. We currently do not check in our infrastructure where a user is
> coming from and I wouldn't like to start doing that.

New description:

 We have received a number of tickets by Tor Browser users that we should
 keep people visiting the .onion version of a torproject.org website in the
 .onion space. Instead because we have different subdomains for different
 websites a user surfing the onion version of torproject.org will be, for
 example, taken to support.torproject.org instead of its onion address.

 I am willing to implement a header that signal the .onion address for all
 of our onions and I am currently considering the following options.

 1. Implement alt-svc. This is what facebook does. Specifically the browser
 receive a alt-sv header like:

 {{{
 alt-svc:
 h2="facebook2futmrduts5uqn3ahwg4qyqoks6h3alxf5drhsgyhzujyqad.onion:443";
 ma=86400
 }}}

 2. Use onion-location:

 {{{
 Onion-Location:
 http://sbe5fi5cka5l3fqe.onion/~acat/test/onionlocation/header/
 }}}

 3. Use a onion-location meta-tag:


 {{{
 
 
   
 http://sbe5fi5cka5l3fqe.onion/~acat/test/onionlocation/meta/"/>
   
   
 Onion-Location meta tag test.
   
 
 }}}

 I would personally prefer to use one of the two headers options. Either
 the alt-sv or the onion-location one. Both have advantages. I like that
 with alt-sv the connection is upgraded to an onion location without the
 address bar changing. At the same time we should also showcase our onions!
 And if we launch the onion-location header support we should show it on
 our websites.

 Something I would avoid is following the model that Privacy International
 use, and issue a "Location:" redirect when the client comes from an exit
 node. We currently do not check in our infrastructure where a user is
 coming from and I wouldn't like to start doing that.

--

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by mcs):

 * cc: mcs (added)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by hiro):

 * cc: steph (added)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by hiro):

 * cc: steph (removed)
 * cc: sysrqb (added)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by hiro):

 * cc: stephw (added)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by hiro):

 * cc: isabela (added)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by hiro):

 Yes I was at the beginning inclined to implement both. But there was a
 quick chat on #tor-dev and the idea was to pick either one of the two. I'd
 like to know what we prefer. I think we should showcase the .onion so
 onion-location would be ideal. Not sure others have other opinions.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by acat):

 Technically you could have both, since they are independent. But I'm
 assuming we want to advertise the `.onion` address, let people bookmark
 it, etc., and that's not something you can do with `Alt-Svc`, so I think
 `Onion-Location` would be preferable.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Normal   | Resolution:
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Description changed by hiro:

Old description:

> We have received a number of tickets by Tor Browser users that we should
> keep people visiting the .onion version of a website in the .onion space.
>
> I am willing to implement a header that signal the .onion address for all
> of our onions and I am currently considering two options.
>
> 1. Implement alt-svc. This is what facebook does. Specifically the
> browser receive a alt-sv header like:
>
> {{{
> alt-svc:
> h2="facebook2futmrduts5uqn3ahwg4qyqoks6h3alxf5drhsgyhzujyqad.onion:443";
> ma=86400
> }}}
>
> 2. Use onion-location:
>
> {{{
> Onion-Location:
> http://sbe5fi5cka5l3fqe.onion/~acat/test/onionlocation/header/
> }}}
>
> 3. Use a onion-location meta-tag:
>

> {{{
> 
> 
>   
>  content="http://sbe5fi5cka5l3fqe.onion/~acat/test/onionlocation/meta/"/>
>   
>   
> Onion-Location meta tag test.
>   
> 
> }}}
>
> I would personally prefer to use one of the two headers options. Either
> the alt-sv or the onion-location one. Both have advantages. I like that
> with alt-sv the connection is upgraded to an onion location without the
> address bar changing. At the same time we should also showcase our
> onions! And if we launch the onion-location header support we should show
> it on our websites.
>
> Something I would avoid is following the model that Privacy International
> use, and issue a "Location:" redirect when the client comes from an exit
> node. We currently do not check in our infrastructure where a user is
> coming from and I wouldn't like to start doing that.

New description:

 We have received a number of tickets by Tor Browser users that we should
 keep people visiting the .onion version of a torproject.org website in the
 .onion space. Instead because we have different subdomains for different
 websites a user surfing the onion version of torproject.org will be taken
 to support.torproject.org instead of its onion address.

 I am willing to implement a header that signal the .onion address for all
 of our onions and I am currently considering two options.

 1. Implement alt-svc. This is what facebook does. Specifically the browser
 receive a alt-sv header like:

 {{{
 alt-svc:
 h2="facebook2futmrduts5uqn3ahwg4qyqoks6h3alxf5drhsgyhzujyqad.onion:443";
 ma=86400
 }}}

 2. Use onion-location:

 {{{
 Onion-Location:
 http://sbe5fi5cka5l3fqe.onion/~acat/test/onionlocation/header/
 }}}

 3. Use a onion-location meta-tag:


 {{{
 
 
   
 http://sbe5fi5cka5l3fqe.onion/~acat/test/onionlocation/meta/"/>
   
   
 Onion-Location meta tag test.
   
 
 }}}

 I would personally prefer to use one of the two headers options. Either
 the alt-sv or the onion-location one. Both have advantages. I like that
 with alt-sv the connection is upgraded to an onion location without the
 address bar changing. At the same time we should also showcase our onions!
 And if we launch the onion-location header support we should show it on
 our websites.

 Something I would avoid is following the model that Privacy International
 use, and issue a "Location:" redirect when the client comes from an exit
 node. We currently do not check in our infrastructure where a user is
 coming from and I wouldn't like to start doing that.

--

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #33705 [Internal Services/Tor Sysadmin Team]: Add header to redirect websites visitors using tor-browser to the .onion address

[Tor Bug Tracker & Wiki]

#33705: Add header to redirect websites visitors using tor-browser to the .onion
address
-+-
 Reporter:  hiro |  Owner:  hiro
 Type:  defect   | Status:  assigned
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin   |Version:
  Team   |
 Severity:  Normal   |   Keywords:
Actual Points:   |  Parent ID:
   Points:   |   Reviewer:
  Sponsor:   |
-+-
 We have received a number of tickets by Tor Browser users that we should
 keep people visiting the .onion version of a website in the .onion space.

 I am willing to implement a header that signal the .onion address for all
 of our onions and I am currently considering two options.

 1. Implement alt-svc. This is what facebook does. Specifically the browser
 receive a alt-sv header like:

 {{{
 alt-svc:
 h2="facebook2futmrduts5uqn3ahwg4qyqoks6h3alxf5drhsgyhzujyqad.onion:443";
 ma=86400
 }}}

 2. Use onion-location:

 {{{
 Onion-Location:
 http://sbe5fi5cka5l3fqe.onion/~acat/test/onionlocation/header/
 }}}

 3. Use a onion-location meta-tag:


 {{{
 
 
   
 http://sbe5fi5cka5l3fqe.onion/~acat/test/onionlocation/meta/"/>
   
   
 Onion-Location meta tag test.
   
 
 }}}

 I would personally prefer to use one of the two headers options. Either
 the alt-sv or the onion-location one. Both have advantages. I like that
 with alt-sv the connection is upgraded to an onion location without the
 address bar changing. At the same time we should also showcase our onions!
 And if we launch the onion-location header support we should show it on
 our websites.

 Something I would avoid is following the model that Privacy International
 use, and issue a "Location:" redirect when the client comes from an exit
 node. We currently do not check in our infrastructure where a user is
 coming from and I wouldn't like to start doing that.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs