Opened 10 years ago

#1039 closed enhancement (Won't implement)

subdomain.torproject.org as www.torproject.org/subdomain

Reported by: Athaba Owned by:
Priority: Low Milestone:
Component: Webpages/Website Version: 0.2.0.35
Severity: Keywords:
Cc: Athaba, Sebastian Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

I suggest to make all the subdomain.torproject.org websites (also) available as www.torproject.org/subdomain

So instead of
https://bridges.torproject.org/
the should be also a https://www.torproject.org/bridges

In this case there is a https://www.torproject.org/bridges, but it has other content.
So maybe name it https://www.torproject.org/list-bridges

The reason for this is to make it harder to find out on which pages of the tor website a user was browsing.

A HTTPS request is encrypted, but if you sniff it you can see the complete hostname (host.domain.tld).
You can't see the directory/file which is requested (https://torproject.org/this/stuff).

It's also be easier for a the great wall or an ISP to block or even redirect the user to a malicious set of
bridges and therefore get aware of bridge user/their IP addresses.

[Automatically added by flyspray2trac: Operating System: All]

Child Tickets

Change History (3)

comment:1 Changed 10 years ago by Sebastian

There are some issues with that approach, one the above-listed "what if
www.torproject.org/$subdomain already exists" as well as an even larger
problem: Many subdomains point at a different machine than www.tp.o.

Using tp.o as a proxy for them isn't a solution here.

Also, this would create problems with mirrors if the new URLs became
canonical, because they would be part of the website, and the mirrors
wouldn't have their content.

comment:2 Changed 10 years ago by phobos

torproject.org is already blocked in china and other places. But due to the different IPs, bridges.tpo, and others are not.

comment:3 Changed 10 years ago by phobos

flyspray2trac: bug closed.

Note: See TracTickets for help on using tickets.