The .onion address

A draft RFC for Tor's .onion address is finally being written. This is a proper thing. Like the old days of the Internet, people just did things, then documented them later. Tor's .onion addresses have been in use for quite a while (I just setup another one yesterday). It's time that we documented this for the rest of the community, to forestall problems like somebody registering .onion as a DNS TLD.

One quibble I have with the document is section 2.1, which says:

1. Users: human users are expected to recognize .onion names as having different security properties, and also being only available through software that is aware of onion addresses.

This certain documents current usage, where Tor is a special system run separately from the rest of the Internet. However, it appears to deny a hypothetical future were Tor is more integrated.

For example, imagine a world where Chrome simply integrates Tor libraries, and that whenever anybody clicks on an .onion link, that it automatically activates the Tor software, establishes a circuit, and grabs the indicated page -- all without the user having to be aware of Tor. This could do much to increase the usability of the software.

Unfortunately, this has security risks. An .onion web page with a non-onion <IMG> tag would totally unmask the user, which would presumably not go over Tor in this scenario. One could imagine, therefore, that it would operate like Chrome's "Incognito" mode does today. In such a scenario, no cookies or other information should cross the boundary. In addition, any link followed from the .onion page should be enforced to also go over Tor. Like Chrome's little spy guy icon on the window, it would be good to have something onion shaped identifying the window.

Therefore, I suggest some text like the following:

1b. Some systems may desire to integrate .onion addresses transparently. An example would be web browsers allowing such addresses to be used like any other hyperlinks. Such system MUST nonetheless maintain the anonymity guarantee of Tor, with visual indicators, and blocking the sharing of identifying data between the two modes.

The Tor Project opposes transparent integration into browsers. They've probably put a lot of thought into this, and are the experts, so I'd defer to them. With that said, we should bend over backwards to make security, privacy, and anonymity an invisible part of all normal products.