Git-Mirrors/real-world-onion-sites
1
0
Fork 0
mirror of https://github.com/alecmuffett/real-world-onion-sites.git synced 2024-10-01 01:06:18 -04:00
Code Issues Packages Projects Releases Wiki Activity
This is a list of substantial, commercial-or-social-good mainstream websites which provide onion services.
2,152 Commits 1 Branch 0 Tags 37 MiB
Python 84.8%
Shell 13.3%
Makefile 1.9%
a20b0cec54
Go to file
Alec Muffett a20b0cec54 auto-update on Fri Oct 29 17:26:25 UTC 2021
2021-10-29 17:26:25 +00:00
.gitignore commit: last update of ct-log.txt. 2021-06-01 20:38:34 +00:00
01-preamble.md auto-update on Tue Jun 1 21:23:30 UTC 2021 2021-06-01 21:23:30 +00:00
02-footnotes.md auto-update on Tue Jun 1 21:23:30 UTC 2021 2021-06-01 21:23:30 +00:00
ct-log.md auto-update on Wed Oct 27 10:53:21 UTC 2021 2021-10-27 10:53:21 +00:00
ct-log.txt auto-update on Tue Jun 1 21:23:30 UTC 2021 2021-06-01 21:23:30 +00:00
get-ct-log.sh auto-update on Wed Jul 21 23:51:50 UTC 2021 2021-07-21 23:51:50 +00:00
get-fresh-csv.sh move v2 to legacy 2021-06-01 09:43:02 +00:00
get-securedrop-csv.py auto-update on Tue Sep 28 07:25:48 UTC 2021 2021-09-28 07:25:49 +00:00
Makefile auto-update on Tue 4 Feb 07:25:54 UTC 2020 2020-02-04 07:25:55 +00:00
manual-check.sh auto-update on Sat Nov 21 09:27:49 UTC 2020 2020-11-21 09:27:49 +00:00
master.csv auto-update on Tue Sep 28 07:25:48 UTC 2021 2021-09-28 07:25:49 +00:00
onion-ctlog.py auto-update on Thu Jul 22 14:15:48 UTC 2021 2021-07-22 14:15:48 +00:00
README.md auto-update on Fri Oct 29 17:26:25 UTC 2021 2021-10-29 17:26:25 +00:00
rwos-db.py auto-update on Wed Sep 29 11:09:26 UTC 2021 2021-09-29 11:09:26 +00:00
securedrop-api.csv auto-update on Wed Oct 27 10:53:21 UTC 2021 2021-10-27 10:53:21 +00:00
wrapper.sh auto-update on Thu Jun 24 16:28:31 UTC 2021 2021-06-24 16:28:31 +00:00

README.md

Real-World Onion Sites (v3-addresses only)

This is a list of substantial, commercial-or-social-good mainstream websites which provide onion services.

  • no sites with an "onion-only" presence
  • no sites for tech with less than (arbitrary) 10,000 users
  • no nudity, exploitation, drugs, copyright infringement or sketchy-content sites
  • the editor reserves all rights to annotate or drop any or all entries as deemed fit
  • licensed: cc-by-sa
  • author/editor: alec muffett

You can find techical details and the legend/key for symbols in the footnotes section, below.

Index

Blogs

Alexander Færøy 🔐

Ctrl blog 🔺 HTTP

Dropsafe 🔐

Kushal Das 🔐

Ming Di Leom 🔐

Nick Frichette 🔐

treacherous.tech 🔐

Civil Society And Community

Privacy International 🔐

Riseup Home 🔺 HTTP

Riseup Onion Index 🔺 HTTP

provides shared notepad, file sharing, code hosting, and other services

Systemli Home 🔺 HTTP

Systemli Onion Index 🔺 HTTP

provides shared notepad, spreadsheet, pastebin, and other services

Companies And Services

decoded:Legal 🔺 HTTP

english law firm

Education

BBC Learning English 🔐

includes resources for many languages

BBC Learning English: Mandarin 🔐

Government

US Central Intelligence Agency 🔺 HTTP

News And Media

BBC News 🔐

BBC News Arabic | عربى 🔐

BBC News Chinese | 中文 🔐

BBC News Persian | فارسی 🔐

BBC News Pidgin 🔐

BBC News Russian | Русская 🔐

BBC News Turkish | Türkçe 🔐

BBC News Vietnamese | Tiếng Việt 🔐

BBC News | In Your Language 🔐

language index

Deutsche Welle 🔐

also, see language index in titlebar

Deutsche Welle Arabic 🔐

Deutsche Welle Chinese 🔐

Deutsche Welle Persian 🔐

Deutsche Welle Russian 🔐

Deutsche Welle Turkish 🔐

ProPublica 🔐

Radio Free Europe 🔐

https://www.rfa.org/about/releases/mirror_websites-04172020105949.html

The Intercept 🔐

Tech And Software

Ablative Hosting 🔐

DEF CON Groups 🔺 HTTP

DEF CON Home 🔺 HTTP

DEF CON Media 🔺 HTTP

Hardened BSD Onion Index 🔺 HTTP

Impreza Hosting 🔐

OnionShare 🔺 HTTP

Qubes OS 🔺 HTTP

Tor Project Home 🔺 HTTP

Tor Project Onion Index 🔺 HTTP

everything tor

Whonix Forums 🔺 HTTP

Whonix Home 🔺 HTTP

keybase.io 🔺 HTTP

Web And Internet

Cloudflare Public DNS 1.1.1.1 🔐

DuckDuckGo 🔐

Facebook 🔐

Facebook Mobile 🔐

HARICA Certificate Authority 🔐

Protonmail 🔐

Globaleaks

Securedrop

2600: The Hacker Quarterly 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

ABC 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Aftenposten AS 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Aftonbladet 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Al Jazeera Media Network 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Apache 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Bloomberg News 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

CBC 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Dagbladet 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Forbidden Stories 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

HuffPost 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Institute for Quantitative Social Science at Harvard University 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Investigace.cz 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

NRK 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

New York Times 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

ProPublica 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Public Intelligence 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Stefania Maurizi 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Süddeutsche Zeitung 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

TV2 Denmark 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

TechCrunch 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

The Center for Public Integrity 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

The Globe and Mail 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

The Guardian 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

The Intercept 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

The Washington Post 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Toronto Star 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

VICE Media 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Whistleblower Aid 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

iROZHLAS 🔺 HTTP

via: https://securedrop.org/api/v1/directory/

Legacy Sites

These sites have "legacy" v2 onion addresses.

ALAT / Allerta AntiCorruzione 🔺 HTTP

italian whistleblowing

Afrileaks 🔺 HTTP

Archive Today (archive.is) 🔺 HTTP

Atlatszo MagyarLeaks 🔺 HTTP

hungarian leaks

Bezkorupce.cz 🔺 HTTP

czech anticorruption reporting site

Brave (Web Browser) 🔐

BuzzFeed News 🔐

Debian Home 🔺 HTTP

Debian Onion Index 🔺 HTTP

everything debian

ExpressVPN 🔺 HTTP

IRPILeaks 🔺 HTTP

italian investigative reporting project

Mail2Tor 🔺 HTTP

Mailpile 🔺 HTTP

Mexico Leaks 🔺 HTTP

Pistaljka.rs Whistleblowing 🔺 HTTP

Radio Free Asia: Cantonese 🔐

https://www.rfa.org/about/releases/mirror_websites-04172020105949.html

Radio Free Asia: English 🔐

https://www.rfa.org/about/releases/mirror_websites-04172020105949.html

Radio Free Asia: Mandarin 🔐

https://www.rfa.org/about/releases/mirror_websites-04172020105949.html

Reporters Without Borders Helpdesk 🔐

The New York Times 🔐

Wildleaks 🔺 HTTP

elephant action league

XNet Activism 🔺 HTTP

anticorruption whistleblowing

taz 🔺 HTTP

Flaky Sites

These sites have apparently stopped responding.

Impffrei.work 🔐

job agency

Internet Archive (archive.org) 🔐

Footnotes

  • This file (README.md) is auto-generated
    • Do NOT submit changes NOR pull-requests for it
    • Please submit an Issue for consideration / change requests
  • If both v2 and v3 addresses are provided for a service, the v3 address will be preferred / cited
  • At the moment where an organisation runs 2+ onion addresses for closely related services that do not reflect distinct languages / national interests, I am posting a link to an index of their onions. Examples: Riseup, Systemli, TorProject, ...
  • The master list of Onion SSL EV Certificates may be viewed at https://crt.sh/?q=.onion

RWOS Status Detector

  • ✅ site up
  • ✳️ site up, and redirected to another page
  • 🚫 site up, but could not access the page
  • 🛑 site up, but reported a system error
  • 🆘 site returned no data, or is down, or curl experienced a transient network error (may be a problem with the RWOS server connection)
  • 🆕 site is newly added, no data yet

You can also see the history of updates.

Codes & Exit Statuses

Mouse-over the icons for details of HTTP codes, curl exit statuses, and the number of attempts made on each site.

TLS Security

Due to the fundamental protocol differences between HTTP and HTTPS, it is not wise to consider HTTP-over-Onion to be "as secure as HTTPS"; web browsers do and must treat HTTPS requests in ways that are fundamentally different to HTTP, e.g.:

  • with respect to cookie handling, or
  • where the trusted connection terminates, or
  • how to deal with loading embedded insecure content, or
  • whether to permit access to camera and microphone devices (WebRTC)

...and the necessity of broad adherence to web standards would make it harmful to attempt to optimise just one browser (e.g. Tor Browser) to elevate HTTP-over-Onion to the same levels of trust as HTTPS-over-TCP, let alone HTTPS-over-Onion. Doubtless some browsers will attempt to implement "better-than-default trust and security via HTTP over onions", but this behaviour will not be standard, cannot be relied upon by clients/users, and will therefore be risky.

tl;dr - HTTP-over-Onion should not be considered as secure as HTTPS-over-Onion, and attempting to force it thusly will create a future compatibility mess for the ecosystem of onion-capable browsers.

  • 🔧 semi-secure HTTP Onion site, protected by Onion circuits at best; will not respect browser secure/HTTPS behaviour
  • 🔐 secure HTTPS Onion site, protected by both Onion circuits and TLS, will respect browser secure/HTTPS behaviour

Feedback

The issues page is the fastest and most effective way to submit a suggestion; if you lack a Github account, try messaging @alecmuffett on Twitter.

Back to Top