{"action":"created","issue":{"url":"https://api.github.com/repos/globaleaks/Tor2web/issues/252","labels_url":"https://api.github.com/repos/globaleaks/Tor2web/issues/252/labels{/name}","comments_url":"https://api.github.com/repos/globaleaks/Tor2web/issues/252/comments","events_url":"https://api.github.com/repos/globaleaks/Tor2web/issues/252/events","html_url":"https://github.com/globaleaks/Tor2web/issues/252","id":99624925,"number":252,"title":"Allow end-to-end request encryption using SNI in Translation Mode","user":{"login":"DonnchaC","id":3081375,"avatar_url":"https://avatars.githubusercontent.com/u/3081375?v=3","gravatar_id":"","url":"https://api.github.com/users/DonnchaC","html_url":"https://github.com/DonnchaC","followers_url":"https://api.github.com/users/DonnchaC/followers","following_url":"https://api.github.com/users/DonnchaC/following{/other_user}","gists_url":"https://api.github.com/users/DonnchaC/gists{/gist_id}","starred_url":"https://api.github.com/users/DonnchaC/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DonnchaC/subscriptions","organizations_url":"https://api.github.com/users/DonnchaC/orgs","repos_url":"https://api.github.com/users/DonnchaC/repos","events_url":"https://api.github.com/users/DonnchaC/events{/privacy}","received_events_url":"https://api.github.com/users/DonnchaC/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-08-07T10:41:33Z","updated_at":"2015-08-10T21:04:07Z","closed_at":null,"body":"The current Tor2Web model entrusts Tor2Web operators with access to the content of users requests. As a result publicly hosted Tor2Web instance are at risk of coercive or other types of threats which could allow an attacker to access the traffic of user requests.\r\n\r\nIdeally it would be possible for connections to be end-to-end encrypted from the user's browser until termination on the hidden service server. With the broad deployment of SNI SSL headers this should now be possible for hidden services being provided in Translation Mode.\r\n\r\nWhen Tor2Web receives a new SSL connection, it should determine if the SNI header corresponds to a translated hidden service. Any matching SSL connections should be transparently forwarded to the backend hidden service which had a listener for the SSL connection.\r\n\r\nTo enable this type of feature:\r\n* The hidden service should register a public domain name and purchase an SSL certifcate for that domain.\r\n- The hidden service operator adds their SSL key and cert to their hidden service web server.\r\n- The operator finds a Tor2Web service provider who is willing to act as a translator for their service and registers their front domain:onion address pair.\r\n- The operator points the domain DNS to a server provided by the Tor2Web operator. DANE or similar key pinning techniques may provided better SSL cert authentication in future.\r\n\r\nThis type of public domain->onion translation could be provided by public service providers for free or a fee with lower trust requirements. It would allow anonymous service operators to allow public access to their services while maintaining user privacy and removing Tor2Web operators as a potential passive threat.\r\n\r\nGlobalLeaks operators could benefit from the increased accessibility without the potential risks of running clearnet infrastructure themselves.\r\n\r\nI'd like to try help with this feature in the near future if I can find the time. I'd be interested in hearing any feedback on this idea.\r\n\r\n<bountysource-plugin>\r\n---\r\nWant to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/25476459-allow-end-to-end-request-encryption-using-sni-in-translation-mode?utm_campaign=plugin&utm_content=tracker%2F318575&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F318575&utm_medium=issues&utm_source=github).\r\n</bountysource-plugin>"},"comment":{"url":"https://api.github.com/repos/globaleaks/Tor2web/issues/comments/129605727","html_url":"https://github.com/globaleaks/Tor2web/issues/252#issuecomment-129605727","issue_url":"https://api.github.com/repos/globaleaks/Tor2web/issues/252","id":129605727,"user":{"login":"DonnchaC","id":3081375,"avatar_url":"https://avatars.githubusercontent.com/u/3081375?v=3","gravatar_id":"","url":"https://api.github.com/users/DonnchaC","html_url":"https://github.com/DonnchaC","followers_url":"https://api.github.com/users/DonnchaC/followers","following_url":"https://api.github.com/users/DonnchaC/following{/other_user}","gists_url":"https://api.github.com/users/DonnchaC/gists{/gist_id}","starred_url":"https://api.github.com/users/DonnchaC/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DonnchaC/subscriptions","organizations_url":"https://api.github.com/users/DonnchaC/orgs","repos_url":"https://api.github.com/users/DonnchaC/repos","events_url":"https://api.github.com/users/DonnchaC/events{/privacy}","received_events_url":"https://api.github.com/users/DonnchaC/received_events","type":"User","site_admin":false},"created_at":"2015-08-10T21:04:07Z","updated_at":"2015-08-10T21:04:07Z","body":"This feature would allow users to access a hidden service via a clearnet domain chosen by the hidden service.\r\n\r\nFor example I run the hidden service myblogah4i29js0.onion. I would like the (large amount of) people who don't use Tor to still be able to access my website with privacy. I register the domain myblog.com and acquire an SSL certificate for it, via the LetsEncrypt CA for example.\r\n\r\nI start a SSL server on my onion at myblogah4i29js0.onion:443 with this SSL certificate. I then point my domain myblog.com at one or more Tor2Web servers. This domain pointing could be done by running a custom nameserver which will DNS round robin between Tor2Web instances.\r\n\r\nAs a user I request https://myblog.com in a browser. My connection will then be directed to a Tor2Web node. The Tor2Web node reads the SSL SNI header and forwards the SSL encrypted connection to the hidden service without access to any of the content.\r\n\r\nThe Tor2Web just sees the SSL connection without access to any of the content, or with out the SSL key to decrypt the content. The hidden service which is running the web server will need to do an domain rewriting at the web server end."}}