User:Nanite/Onion linking guidelines draft

(I'm saving this in user space due to draft quality, but if anyone wants to edit, feel free!)

Draft to be titled: "Wikipedia:How-to on .onion linking" or something like that?

Background —

The Tor network allows the creation of hidden services at a .onion top-level-domain, that can only be accessed anonymously via the Tor software. The 16-character names of these sites are a form of public key fingerprint, making it easy to acquire a gibberish-looking address (eqt5g4fuenphqinx.onion) or, with considerably more difficulty, a more memorable address (facebookcorewwwi.onion). Because it is effectively impossible to choose all 16 characters, only someone who holds the associated private key can serve up content on that domain name.

If operated with extreme care, a .onion site can stay under the owner's full control while neither revealing either the owner's identity, nor the server's location. In practice, .onion sites often slip up and reveal their identity (and if associated with illegal activity, the site goes down), or they lose control of the private key allowing hijackers to take over the domain. In addition, even when run perfectly, phishers will also create similar-looking domain names and try to bait users (see section #Always give a reference below).

In general, .onion addresses are not good external links on wikipedia, for a variety of reasons, and due to persistent spamming/phishing problems they have been generally blacklisted from being hyperlinks (see "Blacklist" section below). That said, in some cases there are good reasons to mention a .onion address and even to hyperlink them (after obtaining a whitelist exemption).

When to include an .onion address

The usage of .onion links should always follow the general External links guideline; this article highlights some special issues that pertain to .onion addresses. Where unclear, the general external links guideline takes precedence over this guideline. In particular it is important to pay attention to the "What not to link" section concerns over inaccessibility (.onion links require special software), functionality (.onion sites frequently go down), and appropriateness (.onion sites tend to more often be low quality, offensive, or outright illegal).

In the case of official sites, many of the concerns over .onion links are exempted. Thus we have the following examples:

• The article facebookcorewwwi.onion concerns a legitimate and ordinary site run by Facebook, which provides practical access to Facebook as well as being a pioneer of Tor-related technologies. (whitelisted)
• The Daily Stormer article during the time when it the site is kicked off the clear web ([1]) contains hyperlinks to the .onion domain. Although the site is extremely vulgar, wikipedia is not censored. (whitelisted)
• Several defunct darknet markets like Silk Road and AlphaBay have their old .onion address listed for reference. (not whitelisted because they don't need to be hyperlinked)

Rotten onions

It is frequently the case that a .onion site has become notable (or notorious) by due to its illegality (e.g., internet piracy), its tendency to inspire moral outrage (e.g., The Daily Stormer), or a combination of both (e.g., assassination, drug, and human trafficking markets; rape/child porn/snuff media sites). Should these be linked?

Illegality

Disclaimer: The following is not a legal opinion. In some jurisdictions, it can be illegal to simply provide a link to a website containing illegal material. However, in keeping consistent with our articles on clearweb sites hosting illegal content (e.g., Sci-hub, The Pirate Bay, etc.), it is considered acceptable to provide websites' addresses only as official links on their articles, and to only present the address in hyperlink form when clicking will bring the reader to a 'neutral' landing page that is legally viewable. Note that it is in very poor form for an encyclopedia (and possibly illegal) to encourage people to perform an illegal act, for example hinting that someone else should try to find a particular copyrighted work illegally distributed at some location (see WP:COPYLINK).

Morally outrageous / immoral content

Because wikipedia is not censored, it is not relevant that a website contains offensive content, in deciding whether or not to link to it.

In the case of illegal pornography, many discussions have been had and it is not settled whether the addresses of these sites should ever be provided on wikipedia, even as official links on notable articles (e.g., Lolita City). Best to avoid.

Defunct / hijacked sites

See also: WP:ELDEAD

Onion sites have notoriously short lifetimes and frequent downtime, and are often in the news for being raided, hijacked, shut down, and so on. As soon as reliable sources can be found that declares the shutdown of the site or owner's loss of control, you should un-hyperlink the URL and mark it as defunct.

Rumours are not sufficient reason to declare a site as defunct. If a site is inaccessible, wait for a reliable source to declare the site as being shut down, since it may be temporary downtime.

If you visit a site and find malware or very obvious signs of hijacking, you should immediately de-hyperlink, and possibly mark it defunct.

Always give a reference

A special concern for .onion sites is that the garbled appearance of the domain name makes them a prime target for phishing and spamming edits that redirect readers to an impostor site. Which is the real Silk Road -- silkroadbdcmw7rj.onion or silkroadcqgi4von.onion? Neither, actually. For this reason, all onion addresses, whether they are hyperlinked or put as plain text, should be reliably sourced to a website that confirms the true address. For an official link, the current preferred way to do this is with a citation in the {{Infobox website}} box.

Templates

A few templates are available for the formatting of onion links, whether they are defunct, blacklisted, or whitelisted.

• {{Onion URL}} and {{Onion defunct}} for use in siteboxes.
• {{Onion Official site}} for use in External links sections.

Blacklist

Presently, most .onion links cannot be turned into hyperlinks due to a general blacklist (at MediaWiki_talk:Spam-blacklist) of the form \b[_\-0-9a-z]+\.onion\b. According to the Blacklist module documentation, this forbids all hyperlinks containing strings of the form "<alphanumeric characters or _->.onion" except where it is immediately preceded or followed by a letter. Some special exceptions are however made in the whitelist (at MediaWiki_talk:Spam-whitelist).

Reason for blacklist

It is desirable that .onion links (as well as proxy sites .onion.link, .onion.cab, .hiddenservice.net, etc.) are generally blacklisted for the following reasons (see also the general list reasons for to normally be avoided):

1. Most importantly: Impostor/phishing sites and hijacked sites. We have had persistent issues with editors modifying the links on various articles to try to phish readers. See #Always give a reference above.
2. Spam, malware, and illegal content are much more common on the darkweb than on the clearweb.
3. The low stability of many sites makes them generall useless

Although .onion links also violate WP:ELNO#7 (difficulty of access due to requiring special software), there are clearweb onion proxy sites that work around this. These proxy sites are, however, blacklisted due to the other reasons listed above.

How to get a .onion site whitelisted

Whitelisting a .onion site will allow you to create hyperlinks to it. This whitelisting is handled on a case-by-case basis and it needs to have a good reason. For example, a good reason for whitelisting a site would be that it is the only official website for a notable article.

1. If you do not have a good source and citation for the authenticity of the onion domain name, your request will be turned down. See #Always give a reference above.
2. When accessed, the landing page does not immediately present illegal content, nor does it deceive the user into accessing illegal content. See #Rotten onions above.

To request a whitelisting exemption, go to MediaWiki_talk:Spam-whitelist and carefully follow the instructions.