The dark web isn’t the scary, pervert-riddled digital crime swamp that shows like CSI:Cyber portray it as. But until this week, dark web sites hidden with the .onion domain lacked some basic security features.
Without recognition from internet regulators like ICANN, people running .onion sites had no easy way to get security certificates. It was a stupid situation for a group of sites that were supposed to be extra-secure. Good thing it’s getting better.
The Internet Engineering Task Force and the Internet Assigned Numbers Authority (which is part of ICANN) gave .onion sites “Special Use Domain” status last week. which means site admins will be able to apply for SSL and TLS certificates now.
You access .onion sites through Tor, a network designed to provide anonymity on the internet. “Tor” stands for “the onion router” and that’s why .onion is named the way it is. There are other domains for the dark web but .onion is the most popular, so this is big.
This new “Special Use Domain” status also helps protect site admins from law enforcement spying, since it means people running .onion sites won’t be able to register with DNS, and that DNS servers won’t cache .onion site records. Prior to this, law enforcement could sometimes track down identifying footprints left on DNS.
Motherboard’s Lorenzo Franceschi-Bicchierai talked to security experts about why this matters:
“This enables the Tor .onion ecosystem to benefit from the same level of security you can get in the rest of the web,” Richard Barnes, a security engineer at Mozilla, told Motherboard in a phone call. “It adds a layer of security on top.”
It also makes it even more obvious than ever that Tor and .onion sites are tools for digital privacy that should be nurtured by groups like IETA and IANA, not ignored.
Illustration by Tara Jacoby; source image via Shutterstock