This Connection is Untrusted
(Error code: ssl_error_bad_cert_domain)
That make sense, but it is more work and things to keep up to date. If there were a lot of people with this need I'd say go for it, but atm I think this would help a very reduced group of people and I believe it is more useful to concentrate in more wide reaching actions. We are spread quite thin to maintain a lot of assets, so we need to prioritize. However, if someone is willing to go down this rabbit hole, please explain what you need and we will try to help.The SSL cert for https://dash.org seems to be different than the one for https://www.dash.org (which works).
Why don't we have a .onion?
For people who don't trust PKI, a unique .onion hidden service would be easy to implement and would put many security-conscious users at ease.
Since most users are downloading precombiled binaries, a custom .onion address that is impossible to man-in-the-middle (because only the server owner holds the private key for it) would be awesome. That would solve a lot of headeaches for people trying to learn PGP verification and such.
That is great, thanks! I thought there was more work involved. I can't promise anything because even the simplest task always has unforseen complications, but I will definitely look into it with some more calm in the near future :smile:Yeah, I know you guys have a lot on your plate at the moment. It was just something I thought of after realizing how well it solves potential man-in-the-middle attacks.
There is actually very little work involved, if anyone has the inspiration to spend a few minutes on it.
All you need to do is install and run Tor directly on the same webserver that hosts the current site, create a .onion address with private key, then edit the tor config file to point all incoming tor requests from your .onion address to 127.0.0.1:8080. https://www.torproject.org/docs/tor-hidden-service.html.en
As far as the "need" goes, the real benefit of having a .onion address would not come from satisfying current users needs, but rather from attracting more Tor users to Dash. It is no secret that tor users are heavily into crypto (or vice versa). Doing this would simply add a little extra emphasis to the fact that our community cares about security and privacy; it would have value as marketing.
Even Facebook now has an .onion--which reminds me: another benefit is that it allows people in other countries who might be blocked from specific sites (like what happened to bitcoin.org in Russia last year) to connect directly without DNS.
Something like this?
http://dashorg64cjvj4s3.onion
We'll need to create a special Tor version of the website though, as there are still many reference to dash.org on the original site...
It's not a matter of content, but of the sourcelet me know if I can help and clean that up
Fernando / flare
Theoretically™ we just need to install a plugin for this, but I'd like to speak with Fernando first.can't you 'auto correct script' that
(beep beep)
Something like this?
http://dashorg64cjvj4s3.onion
We'll need to create a special Tor version of the website though, as there are still many reference to dash.org on the original site...
Awesome. It works!!!
If full website navigation is going to take a while to implement, IMO the most important link to get working first is http://dashorg64cjvj4s3.onion/downloads/, so users can easily download the wallet without fear of MITM (as long as they visually double-check the full onion address--not just the first 7 letters--before proceeding).
please let me know when the Tor link is up and running and i do a PR run with that
('Light and dark" Net)
I think i got it, could you please check. There are still some legacy references to dashpay.io/dash.org in the code, but 90% of the site should work now.
--> http://dashorg64cjvj4s3.onion