Просмотр кода страницы Английская Википедия:.onion

{{Английская Википедия/Панель перехода}}
{{short description|Pseudo–top-level internet domain}}
{{Use dmy dates|date=January 2020}}
{{Infobox top level domain
| name=.onion
| image= Tor-logo-2011-flat.svg
| introduced=2004
| type=Host suffix
| status=Not in root, but used by Tor clients, servers, and proxies
| registry=[[Tor (anonymity network)|Tor]]
| sponsor=
| intendeduse=To designate an onion service reachable via Tor
| actualuse=Used by Tor users for services in which both the provider and the user are anonymous and difficult to trace
| restrictions=Addresses are "registered" automatically by Tor client when an onion service is set up
| structure=Names are opaque strings generated from public keys
| document={{Plainlist|
* [https://tools.ietf.org/html/rfc7686 RFC 7686]
* [https://svn-archive.torproject.org/svn/projects/design-paper/tor-design.html Tor design document]
* [https://spec.torproject.org/address-spec Special Hostnames in Tor specification]
}}
| disputepolicy=N/A
}}

'''.onion''' is a special-use [[top level domain]] name designating an anonymous [[onion service]], which was formerly known as a "hidden service",<ref>{{cite web |last1=Winter |first1=Philipp |title=How Do Tor Users Interact With Onion Services? |url=https://nymity.ch/onion-services/pdf/sec18-onion-services.pdf |access-date=27 December 2018}}</ref> reachable via the [[Tor (anonymity network)|Tor]] network. Such addresses are not actual [[DNS name]]s, and the .onion TLD is not in the [[DNS root zone|Internet DNS root]], but with the appropriate proxy software installed, Internet programs such as [[web browser]]s can access sites with .onion [[URL|addresses]] by sending the request through the Tor network.

The purpose of using such a system is to make both the information provider and the person accessing the information more difficult to trace, whether by one another, by an intermediate network host, or by an outsider. Sites that offer dedicated .onion addresses may provide an additional layer of identity assurance via [[Extended Validation Certificate|EV HTTPS Certificates]].{{citation needed|date=October 2019}} Provision of an onion site also helps mitigate [[SSL stripping]] attacks by [[Tor (anonymity network)#Exit node eavesdropping|malicious exit nodes]] on the Tor network upon users who would otherwise access traditional HTTPS [[clearnet (networking)|clearnet]] sites over Tor.{{cn|date=August 2019}}

== Format ==
Addresses in the onion TLD are generally opaque, non-[[mnemonic]], alpha-numerical strings which are automatically generated based on a [[public key]] when an [[Tor (anonymity network)#Onion services|onion service]] is configured. They used to be 16 characters long for the V2 onion services and they are 56 characters long for V3 onion services.<ref>{{cite web|title=Intro to Next Gen Onion Services (aka prop224)|url=https://trac.torproject.org/projects/tor/wiki/doc/NextGenOnions|publisher=The Tor Project|access-date=5 May 2018}}</ref> These strings can be made up of any letter of the alphabet, and decimal digits from 2 to 7, representing in [[base32]] either an 80-bit [[Cryptographic hash function|hash]] ("version 2", or 16-character) or a 256-bit [[EdDSA#Ed25519|ed25519]] public key along with a version number and a checksum of the key and version number ("version 3", "next gen", or 56-character). As a result, in the past all combinations of sixteen base32 characters could potentially be valid version 2 addresses (though as the output of a cryptographic hash, a randomly selected string of this form having a corresponding onion service should be [[Preimage attack|extremely unlikely]]), while in the current version 3 only combinations of 56 base32 characters that correctly encoded an ed25519 public key, a checksum, and a version number (i.e., 3) are valid addresses.<ref>{{Cite web|url=https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt#n2135|title=Encoding onion addresses [ONIONADDRESS]|website=gitweb.torproject.org|access-date=8 February 2021}}</ref>
It is possible to set up a partially human-readable .onion URL (e.g. starting with an organization name) by generating massive numbers of [[public-key cryptography|key pairs]] (a computational process that can be [[parallelized]]) until a sufficiently desirable URL is found.<ref name="scallion">{{cite web | url=https://github.com/lachesis/scallion | title=Scallion | publisher=GitHub | access-date=2 November 2014}}</ref><ref name="facebook url">{{cite mailing list | url=http://archives.seul.org/tor/talk/Oct-2014/msg00433.html | title=Re: Facebook brute forcing hidden services | publisher=Simple End-User Linux | mailing-list=tor-talk | date=31 October 2014 | access-date=2 November 2014 | author=Muffett, Alec}}</ref>

The "onion" name refers to [[onion routing]], the technique used by Tor to achieve a degree of [[anonymity]].

== WWW to .onion gateways ==
Proxies into the Tor network like [[Tor2web]] allow access to onion services from non-Tor browsers and for search engines that are not Tor-aware. By using a gateway, users give up their own anonymity and trust the gateway to deliver the correct content. Both the gateway and the onion service can [[browser fingerprint|fingerprint]] the browser, and access user IP address data. Some proxies use caching techniques that claim to provide better page-loading<ref>{{cite web|url=https://onion.cab/?a=why|archive-url=https://web.archive.org/web/20140521220306/https://onion.cab/?a=why|url-status=dead|archive-date=21 May 2014|title=Onion.cab: Advantages of this TOR2WEB-Proxy|access-date=21 May 2014}}</ref> than the official [[Tor (anonymity network)#Tor Browser|Tor Browser]].

== .exit (defunct pseudo-top-level domain) ==
'''.exit''' was a [[pseudo-top-level domain]] used by [[Tor (anonymity network)|Tor]] users to indicate on the fly to the Tor software the preferred [[exit node]] that should be used while connecting to a service such as a [[World Wide Web|web server]], without having to edit the configuration file for Tor (''torrc'').

The syntax used with this domain was ''hostname'' + ''.exitnode'' + ''.exit'', so that a user wanting to connect to <nowiki>http://www.torproject.org/</nowiki> through node ''tor26'' would have to enter the URL ''<nowiki>http://www.torproject.org.tor26.exit</nowiki>''.

Example uses for this would include accessing a site available only to addresses of a certain country or checking if a certain node is working.

Users could also type ''exitnode.exit'' alone to access the IP address of ''exitnode''.

The .exit notation was deprecated as of version 0.2.9.8.<ref>{{cite web |url=https://gitweb.torproject.org/tor.git/tree/ReleaseNotes |title=Tor Release Notes |access-date=4 October 2017}}</ref> It is disabled by default as of version 0.2.2.1-alpha due to potential application-level attacks,<ref>{{cite web |url=https://gitweb.torproject.org/torspec.git/tree/address-spec.txt |title=Special Hostnames in Tor |access-date=30 June 2012}}</ref> and with the release of 0.3-series Tor as "stable"<ref>{{cite web|title=Tor 0.3.2.9 is released: We have a new stable series!|url=https://blog.torproject.org/tor-0329-released-we-have-new-stable-series|publisher=The Tor Project|access-date=7 May 2018}}</ref> may now be considered defunct.

== Official designation ==
The domain was formerly a [[pseudo-top-level domain]] host suffix, similar in concept to such endings as [[.bitnet]] and [[.uucp]] used in earlier times.

On 9 September 2015 [[ICANN]], [[Internet Assigned Numbers Authority|IANA]] and the [[IETF]] designated .onion as a 'special use domain', giving the domain an official status following a proposal from [[Jacob Appelbaum]] of the Tor Project and [[Facebook]] security engineer [[Alec Muffett]].<ref name=lwn-iana>{{cite news |author=Nathan Willis |date=10 September 2015 |title=Tor's .onion domain approved by IETF/IANA |publisher=[[LWN.net]] |url=https://lwn.net/Articles/657056/ }}</ref><ref name="official">{{cite news|last1=Franceschi-Bicchierai|first1=Lorenzo|title=Internet Regulators Just Legitimized The Dark Web|url=http://motherboard.vice.com/en_uk/read/internet-regulators-just-legitimized-the-dark-web|access-date=10 September 2015|date=10 September 2015}}</ref><ref>{{cite web|title=Special-Use Domain Names|url=https://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml|access-date=10 September 2015}}</ref>

== HTTPS support ==

Prior to the adoption of [[CA/Browser Forum]] Ballot 144, an [[HTTPS]] certificate for a .onion name could only be acquired by treating .onion as an Internal Server Name.<ref name="ballot144">{{cite web|title=CA/Browser Forum Ballot 144 - Validation rules for .onion names|url=https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/|access-date=13 September 2015}}</ref> Per the CA/Browser Forum's Baseline Requirements, these certificates could be issued, but were required to expire before 1 November 2015.<ref>{{cite web|title=Baseline Requirements for the Issuance and Management Publicly-Trusted Certificates, v1.0|url=https://cabforum.org/wp-content/uploads/Baseline_Requirements_V1.pdf|access-date=13 September 2015}}</ref>

Despite these restrictions, [[DuckDuckGo]] launched an onion site with a self-signed certificate in July 2013;<ref>{{cite web|title=We've updated our Tor hidden service to work over SSL. No solution for the cert. warning, yet!|url=https://www.reddit.com/r/duckduckgo/comments/1hdqs6/weve_updated_our_tor_hidden_service_to_work_over/|website=Reddit|author=_zekiel|date=1 July 2013|access-date=20 December 2016}}</ref> [[Facebook]] obtained the first SSL Onion certificate to be issued by a Certificate authority in October 2014,<ref>{{cite news|last1=Muffett|first1=Alec|title=Making Connections to Facebook more Secure|url=https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237|access-date=11 September 2015|date=31 October 2014}}</ref> [[Blockchain.info]] in December 2014,<ref>{{cite news|last1=Alyson|title=Improved Security for Tor Users|url=https://blog.blockchain.com/2014/12/03/improved-security-for-tor-users/|access-date=11 September 2015|date=3 December 2014}}</ref> and [[The Intercept]] in April 2015.<ref>{{cite news|last1=Lee|first1=Micah|title=Our SecureDrop System for Leaks Now Uses HTTPS|url=https://theintercept.com/2015/04/08/securedrop-tor-hidden-service-now-uses-https/|access-date=10 September 2015|date=8 April 2015}}</ref> ''[[The New York Times]]'' later joined in October 2017.<ref>{{cite web | url = https://open.nytimes.com/https-open-nytimes-com-the-new-york-times-as-a-tor-onion-service-e0d0b67b7482 | title = The New York Times is Now Available as a Tor Onion Service | author-link = Runa Sandvik | last = Sandvik | first = Runa | date = 27 October 2017 | website = [[The New York Times]] | access-date = 17 November 2017}}</ref>

Following the adoption of CA/Browser Forum Ballot 144 and the designation of the domain as 'special use' in September 2015, .onion meets the criteria for RFC 6761.<ref>{{cite news|last1=Arkko|first1=Jari|title=.onion|url=https://www.ietf.org/blog/2015/09/onion/|access-date=13 September 2015|date=10 September 2015}}</ref>  Certificate authorities may issue SSL certificates for HTTPS .onion sites per the process documented in the [[CA/Browser Forum]]'s Baseline Requirements,<ref>{{cite web|title=Baseline Requirements Documents|url=https://cabforum.org/baseline-requirements-documents/|access-date=13 September 2015}}</ref> introduced in Ballot 144.<ref name="ballot144"/>

As of August 2016, 13 onion domains are https signed across 7 different organisations via [[DigiCert]].<ref>{{cite news|last1=Jamie Lewis|first1=Sarah|title=OnionScan Report: July 2016 - HTTPS Somewhere Sometimes|url=https://mascherari.press/onionscan-report-july-2016-https-somewhere-sometimes/|access-date=15 August 2016|date=7 August 2016}}</ref>

== See also ==

<!-- Please keep entries in alphabetical order & add a short description [[WP:SEEALSO]] -->
{{div col|small=no|colwidth=20em}}
* [[.tor]]
* [[.i2p]]
* [[.bit]]
* [[Darknet]]
* [[Dark web]]
* [[GlobaLeaks]]
* [[List of Tor onion services]]
* [[Onion routing]]
{{div col end}}
<!-- please keep entries in alphabetical order -->

== References ==
{{Reflist|30em}}

==External links==
* {{cite web |url= https://www.torproject.org/projects/torbrowser.html.en |title= Tor Browser |quote= Anonymous browsing via Tor, used to access .onion sites |publisher= [[Tor Project]] }}
* {{cite web |url= https://www.torproject.org/docs/tor-onion-service.html |title= Tor: Onion Service Configuration Instructions |publisher= Tor Project }}
* {{cite web |url= https://gitweb.torproject.org/torspec.git?a=blob_plain;hb=HEAD;f=rend-spec.txt |title= Tor Rendezvous Specification |publisher= Tor Project }}
* {{citation |first1= Alex |last1= Biryukov |first2= Ivan |last2= Pustogarov |first3= Ralf-Philipp |last3= Weinmann |date= 2013 |publisher= IEEE |work= Symposium on Security and Privacy |url= http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf |title= Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization }}
* {{cite web |url= https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/ |title= Ballot 144 |publisher= [[CA/Browser Forum]] |date= 18 February 2015 }}

{{Tor project}}
{{GTLD}}

{{DEFAULTSORT:ONION}}
[[Category:Dark web]]
[[Category:Computer-related introductions in 2004]]
[[Category:Top-level domains]]

[[sv:Toppdomän#Generiska toppdomäner]]
{{Навигационная таблица/Портал/Английская Википедия}}
[[Категория:Английская Википедия]]
[[Категория:Википедия]]
[[Категория:Статья из Википедии]]
[[Категория:Статья из Английской Википедии]]