The Onion embeds incorrectly


I get that HTTP transport error if I go to the last URL scheme FWIW in plain firefox. It's a firefox error about a bad certificate, maybe the sign of a man in the middle attack.

FWIW, when I click 'advanced' on mine I get:
Code:
The certificate is only valid for the following names: support5.cdnetworks.net, www.orrickconnect.com, medyanet.doracdn.com, www.forexchinese.com, sefamervessl.doracdn.com, medyanetssl.doracdn.com, cdn-img.auone.jp, apply.forex.com, myaccount.forex.com, cdn.cdnmanager.info, stream.svc.7digital.net, script.auction.co.kr, static.ncsoft.com, static.aiononline.com, www.hella.com, cdn.social-hyundai.com, www.marubeni.com, www.marubeni-msplus.com, edipur02.kyods.com, images.containerstore.com, www.nielsen.com, uat.cbgrus.staticcontent.uatglobalrewards.com, pat.cbgrus.staticcontent.uatglobalrewards.com, www.qa.nielsen.com, cdn.game37.klabgames.net, cdn-dev.game37.klabgames.net, forums.wildstar-online.com, www.fantastic-eleven.com, www.aoewd.com, iphones1.ahanet.net, mobet.staticcache.org, auth.staticcache.org, cachescoreboards.williamhill.com, surveys.dev.summitenergy.com, higg.dev.summitenergy.com, stg1surveys.resourceadvisor.schneider-electric.com, interface.demo.gta-travel.com, www.revenuegiants.com, ssl.secure-cashier.net, www.livechathelp.net, adminnew.secure-cashier.net, www.superanalytics.net, static-ad.homepackbuzz.com, static.wildstar-online.com, cdn.dev.teaser.klabgames.net, mobetcache.williamhill.es, cache.net-a-porter.com, www.newport.com, assets.newport.com, cachestreaming.williamhill.com, svcffe-https-live.mycmc.co.uk, svcprc-https-live.mycmc.co.uk, ad.about.co.kr, secdn.whgaming-pp1.com, core.stg1.resourceadvisor.schneider-electric.com, imagessl.evidea.com, modanisa.doracdn.com, imageserver.kitapyurdu.com, wwwcachept.eurogrand.com, tcd.hwstatic.com, grouptravel.kuoni.com, stg.cdn-img.auone.jp, img.buyma.com, cdn.stylehaus.jp, medyanetsslfo.doracdn.com, intranet.cognolink.com, ja.100-options.com, en.tozlu.com, cdn.ticimax.com, image.laneigebbcusion-beautyroad.com, cachestreaming.williamhill.es, cachestreaming.williamhill.it, www.visitdubai.com, www.evidea.com, www1.fft.fr, mon-espace-tennis.cdn.fft.fr, images.casinosplendido.com, images.roxypalace.com, cachedownload1.eurogrand.com, www.christiedigital.com, www.forex.com, cachedy.williamhillcasino.com, pronet.doracdn.com, cdnd.koctas.com.tr, www2.fft.fr, www3.fft.fr, cdn.korayspor.com, tickets.cdn.bnpparibasmasters.com, tickets.cdn.rolandgarros.com, static.playmxm.com, tradercdn.iforex.com, traderstaticcdn.iforex.com, ga1.game-program.com, assets.game-program.com, my.st.com, my2.st.com, preview.forex.com, cdn.ucakbileti.com, eppap.hella.com, n7ya1xpb.sketchesaroundtheworld.com, www.babil.com, cdn.avansas.com, www.tozlu.com, imagessl.etstur.com, mobil.tozlu.com, mcdn.modanisa.doracdn.com, fcdn.modanisa.doracdn.com, m.modanisa.doracdn.com, cdn.tooplay.com, cdn2.tooplay.com, www.englishhome.com.tr, delta.newport.com, cdnvideo.sozcu.com.tr, cdn.hepfly.com, www.tv8.com.tr, www.acunn.com, img.acunn.com, api.acunn.com, m.acunn.com, img.tv8.com.tr, www.gsstore.org, www.markatesettur.com, qa-my.st.com, feo.rnd-cdn.com, www.uat.forex.com, www.qa.forex.com, cachescoreboards.williamhill.es, cachescoreboards.williamhill.it, www.preview.forex.com, cdn.cms-res.com, *.forex.com, cachevegasgs5.williamhill.com, cachevegasgs5.williamhill-pp2.com, cdnd.anadolusaglik.org, cdnd.toyzzshop.com, cdnd.secilstore.com, r.cdn.acunn.com, sateen.ticimaxcdn.com, cdn.borajet.com.tr, image.evidea.com, www.poemhunter.com, *.popguide.me, na-imgfiles.ncsoft.com, *.africa-newsroom.com

That's an odd selection of urls belonging to a number of different brands that I wasn't aware were all related to the onion (but with the way multinationals work, maybe I'm wrong). Or perhaps there's a tech that maintains all those sites and has blindly used it on this one, despite it not being valid there.

Either way, the onion has misconfigured it's TLS certs, or been hacked. It's not a failure at this end, it seems to me.

Edit if I got to poemhunter-dot-com, one of the URLs claimed by that certificate, it doesn't look like a spam site to me, and it looks like it's using the same certificate (though firefox doesn't seem to actually want to show me enough of the certificate to prove it) so I'm leaning towards techie screw-up personally.
 
Back
Top