Also what I haven't seen explored but is actually a logical extension
of using socks to make ordinary browsers talk to .onion sites is
extending the local recursive server to do the TOR lookup rather
than a traditional DNS lookup and return the results in a DNS
message. With dprive this should end up being secure.
Doesn't work because the underlying protocol isn't TCP. It can work in
SOCKS because that's an application layer gateway which can recognize
.onion as special and set up a TOR session rather than a TCP session.
I suppose the recursive server could return an address in 169.254.0.0/16
and run a proxy between a link-local TCP session and TOR, but ugh.
Regards,
John Levine, johnl(_at_)taugh(_dot_)com, Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.