Twitter's onion service is serving an invalid TLS certificate since 3/6/2023 (opens in new tab)

The API page is still up

https://api.twitterstat.us/

That was a bigger discussion when Facebook did it back in the days and there's really no clear reason for and against it. In the end it mostly boils down to "regular people were educated that https is needed, so it's better to just keep doing that instead of explaining Tor to them". Which is a fair point I think.

https://blog.torproject.org/facebook-hidden-services-and-htt...

AFAICT, the one thing you get from using TLS, is a kind of redundant defense-in-depth to the site being taken over: to successfully pose as the site, the attacker would have to obtain both the Tor daemon private key, and the TLS private key. If the Tor session and the TLS session are each terminated on their own middlebox with separate security (or if e.g. the Tor privkey lives in memory on the machine, while the TLS privkey lives inside an HSM attached to the machine), then it becomes harder for anyone — even a state actor — to commandeer the site.

Also, the TLS cert would be signed by a CA, and so that CA can independently determine that the site has been commandeered and revoke the cert. (Not that I expect a CA would actually do this in a timely manner if the commandeering is done on behalf of a state actor — but that's more a fault in our current CA system than a fault in the logic of X.509 trust infrastructure itself.)

TLS brings security and auth: how do you know twitter's service is at https://twitter3e4tixl4xyajtrzo62zg5vztmjuricljdp2c5kshju4av... ? Or is it at https://twitter3e4tixl4xyajtrzo62zg5vztmjuricljdp2c5kshju4av... ?

.onion certs can now go the whole chain such that you don't need to rely on non-tor access to do the auth

I mean, it's not like Twitter can't see where the traffic is coming from. If you start seeing thousands of users tweeting the same thing over Tor, it's a pretty obvious campaign.

And what about users in countries with hostile governments? Your online posts get you killed in places like Saudi Arabia. The state will literally execute you. If there's a conspiracy here that's why Twitter's 'secure' TOR access is less secure now.

If they really care about free speech and citizen journalism, they totally should have working onion service.

Of course they don’t care, not only because Musk is full of shit, but also because of billions from Saudis.

Serving a valid tls cert takes virtually no effort. It's far more likely that Musk's downsizing killed off infra that was doing this job correctly and inexpensively for many years.

If Musk actually cared about free speech like he says he does, onion services would be a priority. But obviously that's just hot air. You can't have it both ways.

Did they properly remove it or does no one there even know it was/is happening. They didn’t shut it down, the seem to have left the lights on with nobody home.

Bigger picture - given the role news making and sharing in real time has always played in Twitter, it seems logical that services which may not provide obvious returns but which build a platform that journalists find useful would help do that.

Why not? For an international communication service with a "historical" significance on freedom of speech, is this not a natural extension of the platform? Something like this does not cost very much money to operate. "distraction" implies that it does not align with the rest of the company's objectives, and that it costs an inordinate amount of time or resources. A service like this can be administered by a single person as a tertiary function of their role, is it really any significance to their bottom line?

Maybe, but then, why the onion service is still up?

This feels more like uncontrolled infrastructure rot/lack of maintenance rather than a conscious decision to cut unnecessary parts of it.

If you think running an onion service is distracting, wait until you see how distracting trying to become an "everything" app is.

It's so funny to me seeing variations of this post in response to anything related to what could be seen as a weakness to the actions taken after acquisition, while also seeing this in posts promoting twitters relative stability. It's just so transparent to what your motivation is and laughably pathetic how you feel the need to reaffirm and defend your stance on musk (lowercase) at any opportunity that projects any positivity on his decision making.

Oh, right, the topic that neither of us were actually taking about. Yep, I don't think anyone reasonably minded would be using a twitter tor exit node with twitters current reputation. Probably best to remove a service that no one would ever trust you enough to use.

It broke because there's no one left at the company who knows how to keep it online.

This goes for every single website on clearnet though?

If not phone number, they have your IP and location, timezone, likely waking hours, private chats, search queries, who you communicate with and when etc. If not collected by the webmaster then it is automatically collected by whatever government the server sits in (+ whatever governments that government trades data with).

The times of anonymity on the internet/clearnet are long gone.

Accessing Twitter from countries that don't have any way to force Twitter to divulge information is the purpose.

It's not too hard to get a temporary voip phone number if required to sign up for a service, but when I signed up this wasn't needed. Just don't use your phone. You can also get dummy, private, or temporary email addresses. Yeah, the scraping makes things harder, but it's perfectly doable to get these services completely anonymously. I mean hell, NYT, WP, CNN, Reuters, etc all have Signal and most have Secure drop, which is via Tor, to connect to them. Interestingly it looks like Fox is the only major platform not have any method I could find from a single search.

Nonsense. The threat model that onion routing protects against is a middle man intercepting the traffic, not from Twitter knowing who you are. It still offers value.

I think it’s intended to circumvent government blocks in times of unrest to ensure communication