Repository navigation
[Idea] Tor Onion services #3798
Description
Activity
If you have it as a separate project and the user runs both addons i see a conflict of rewrites,
Having it in HTTPS-Everywhere needs a way to figure out if TOR is active, since otherwise the redirects are useless. Maybe implement it as an extra platform-tag?I would prefer to integrate such feature in HTTPS Everywhere if possible.
platform="tor"looks goods:Note: This should be something like platform=tor, to indicate that these rules should not go through the fetch tester on the non-Tor Internet because they will fail. As an approximation to that, we just use platform="mixedcontent", since Tor Browser is a mixedcontent platform, and the https-everywhere-checker will skip non-default platforms.
platform="mixedcontent"is currently used by Tor Browser only:To enable a rule only on platforms that allow mixed content (currently only the Tor Browser), you can add a platform="mixedcontent" attribute to the ruleset element.
Platform is currently selected by checkMixedContentHandling during initialization. We could just append
|tortolocalPlatformRegexpif Tor is on.Tor is considered enabled if testProxySettings sets
proxy_test_successfultotrue. It uses https://check.torproject.org/, but what if Tor is on but check.torproject.org is off or there's a temporary connection issue?Here's my proposal:
- Add "tor" to
localPlatformRegexpiftestProxySettingssays that Tor is on - Replace
platform="mixedcontent"withplatform="tor"in src/chrome/content/rules/*.onion.xml - Create new ruleset with
platflatform="tor"in order to rewrite domains with theirs .onion counterparts if they exist - Enhance
testProxySettings: testing an .onion service and/or allow to override the test with a parameter (optional)
- Add "tor" to
This may make things a bit slower. Although this is a great idea I would defiantly like to see this added.
There actually was a fork for that: https://github.com/chris-barry/darkweb-everywhere
@UsernameLoginIsAlreadyTaken
Tor Browser already included HTTPS Everywhere by default. How about adding a new function to detect
the browser? If the user is using Firefox, redirect to https. If not, redirect to .onion.Some of Tor Project devs already "discussed with the HTTPS everywhere
people over the years, but it's unclear whether the team has the
firepower and energy to handle such a task, or whether it's worth it at
all.As an alternative here is a more general and abstract approach to
solving the UX problem: https://lists.torproject.org/pipermail/tor-dev/2016-October/011514.html"
https://lists.torproject.org/pipermail/tor-talk/2017-March/043027.htmlFollowing @Hainish's comment in #10007 (comment):
TB no longer enables
platform="mixedcontent"rules. See trac.torproject.org/projects/tor/ticket/21323I did some testing and onion rules are indeed disabled. This means
platform="tor"is now necessary for those rules.No, users may still want to enable them. This simply means that
platform="mixedcontent"rulesets are now considereddefault_offby all browsers.I don't see why we need a
platformattribute at all for.onionURLs. The worst thing that happens is someone who enters an onion URL such ashttp://facebookcorewwwi.onionis redirected tohttps://facebookcorewwwi.onionin a normal browser. In either case, the resolution fails. So what's the advantage here?I think we should just remove
platform='mixedcontent'from onion rulesets. It seems a little hacky, anyway. The only reason we're calling these rulesetsmixedcontentis because then they will redirect within the Tor Browser, not because they actually have mixed content on that page.@J0WI thanks for the tip. I'm going to close this issue for the reasons described above in #3798 (comment)
Some websites are providing access as a Tor Onion service, like:
Roger Dingledine (original developer of Tor along with Nick Mathewson and Paul Syverson) says something like "Tor Onion services vs HTTPS only websites is like HTTPS vs HTTP few years ago".
-- https://media.ccc.de/v/32c3-7322-tor_onion_services_more_useful_than_you_think#video&t=1041
I think it would be cool to have an option in HTTPS Everywere which instead of replacing http:// with https:// could replace the domain with the equivalent .onion domain.
I submitted a new issue on https-everywhere because I know this program is a collaboration between EFF and The Tor Project and the aim is to making browsing more secure, so I think there could be an interest for this kind of feature.
Would it makes sense to you? Or do you think it would be better to develop a different project, maybe using the same codebase of https-everywhere?