Tor Gains an Extra Layer of Security as .onion becomes a Special-Use Domain
The dark web just got a little more secure as the .onion domain extension has been assigned the special-use status. The Engineering Task Force (IETF) along with the Internet Assigned Numbers Authority (IANA), part of ICANN, granting the .onion URL “Special Use Domain” status last Wednesday.
The special-use status granted to the .onion extension means specific domains will only be accessibly through Tor. Earlier, .onion domains could have technically been opened on the regular web, due to its pseudo-TLD status. The status also opens the possibility for site-specific encryption and the ability to purchase security certificates/SSL and TLS certificates for .onion domains.
Tor is a network designed for high anonymity throughout the Internet. Tor, short for “the onion router,” and directs Internet traffic through various sets of nodes, encrypting the connection once more at each hop, making it nearly impossible to unmask the user behind it. Tor is often used by high-profile journalists and those who live in censored countries and can’t access the regular Internet.
In the past Tor has faced competition from other security-based systems such as HORNET. However, the latest changes to the .onion status will drastically improve security across the Tor network, presumably shrinking competition.
The official recognition of .onion will help improve security and reduce the ability to identify or locate network users. The IETF documentation explains what the recent changes mean for accessing .onion sites:
“Applications (including proxies) that implement the Tor protocol MUST recognize .onion names as special by either accessing them directly, or using a proxy (e.g., SOCKS [RFC1928]) to do so. Applications that do not implement the Tor protocol SHOULD generate an error upon the use of .onion, and SHOULD NOT perform a DNS lookup.”
Other information continues on, ensuring security further:
“Name Resolution APIs and Libraries: Resolvers MUST either respond to requests for .onion names by resolving them according to [tor-rendezvous] or by responding with NXDOMAIN.
“Caching DNS Servers: Caching servers, where not explicitly adapted to interoperate with Tor, SHOULD NOT attempt to look up records for .onion names. They MUST generate NXDOMAIN for all such queries.
“Authoritative DNS Servers: Authoritative servers MUST respond to queries for .onion with NXDOMAIN.”
“This enables the Tor .onion ecosystem to benefit from the same level of security you can get in the rest of the web,” Richard Barnes, a security engineer told Motherboard in a phone call. “It adds a layer of security on top .”
Official recognition from groups like the IETF and IANA make it more obvious than ever that Tor and .onion sites are real tools used for digital privacy.
