This is a reminder to all our readers that onion service v2 will be deactivated by Tor on October 15th. This means that all v2 onion addresses will be invalid after this deadline.
Consequently every Tor user should be making sure that he is using v3 onion addresses for all the sites that he is visiting. The difference is easy to spot: v2 onion domains have 16 characters while the new v3 onion domains consist of 56 characters; so you can easily spot the difference simply by looking at the length of an onion domain.
While the migration to onion v3 increases security (namely better cryptography) it does carry some risk that unsuspecting users are being fooled by the new domains and may be falling for phishing links. So make sure to get the new v3 addresses for your favorite sites from a trusted source – ideally from the site itself.
In July 2020, the Tor Project published a timeline for the deprecation of Tor V2 Onion support and services (The Onion Router Version 3 services). This step was performed in order to integrate the more secure Version 3 or V3 of Tor’s onion services. By the 16th of October 2021, Tor’s brief encrypted services, or V2 services, will no longer be functional. David Goulet (Tor Develeoper) statement from the mailing list:
“Onion service v2 uses RSA1024 and 80 bit SHA1 (truncated) addresses. It also still uses the TAP handshake which has been entirely removed from Tor for many years now except v2 services. Its simplistic directory system poses a variety of enumeration and location-prediction attacks that give HSDir relays too much power to enumerate or even block v2 services. Finally, v2 services are not being developed nor maintained anymore. Only the most severe security issues are being addressed.”
As mentioned above, the new v3 standard means better security. Namely, v3 finally replaced SHA1/DH/RSA1024 with SHA3/ed25519/curve25519 providing better cryptographic algorithms.
For more details please check the blog post of the Tor project as well as the announcement on their mailing list. We will remind our readers of the deadline again a few weeks before it expires but we encourage everyone to already start using v3 onion links exclusively for all sites on the darknet.