HTTPS-everywhere update
-
Session is suddenly about onion names through HTTPS-Everywhere
-
"Update channels" new feature
- HTTPS-everywhere has update chanels because releasing extensions is a PITA
- EFF has its own channel already in TB
- scope of channel. you can limit the ability of HTTPS-everywhere to rewrite only certain regexps (e.g. only "onions")
- https://github.com/EFForg/https-everywhere/blob/master/docs/en_US/ruleset-update-channels.md
-
Is this begging for a web of trust system?
-
HTTPS-everywhere is willing to support this use case and add features/UX etc.
-
Potential UX Problems from securedrop:
- Update channel UX though their website would not work for securedrop
- Rewriting from .tor to huge .onion will confuse securedrop sources
- Can we do UX work to improve the user confusion that could happen here?
- Same as onion-location issue
- Fear of new pseudo-tld leakage in normal browsers if we use .tor or something.
-
Are there securedrop instances that dont have a normal DNS name?
- Most securedrop organizations have normal DNS name.
-
What about multiple rulesets specifying conflicting .tor names?
- HTTPS-everywhere uses the first ruleset that it can find
- We can improve this
-
URL scoped based on what the list is:
- securedrop.alecmuffett.tor
- securedrop.reddit.tor
-
How to avoid URL leakage from browsers?
- Securedrop and others are really worrying about this.
- Do we do securedrop.tor or securedrop.tor.onion ? Or securedrop.local?
- Can we ask browsers to also reserve .tor? How long will it take?