The padlock icon

Years of advice trained people to look for the lock. The training was for a different problem and it transfers badly.

What the icon meant on the ordinary web

That a certificate was presented, it was signed by an authority the browser trusts, and it matches the hostname in the bar. Three facts about transport and naming. Whether the people behind the site are honest was never one of them, and certificates are free, so the icon says nothing about who paid for what.

What it means on an onion connection

Less again, because the interesting property came from somewhere else. The connection to an onion service is authenticated and encrypted by the address itself, since the address is the key. There is no certificate authority in the path and nothing for one to add.

A service may still carry a certificate for its own reasons and a browser may still draw the lock. The drawing is a habit of the interface, not a statement about the service.

The reverse error

Some people treat the absence of a lock as a warning. On an onion address it is not. A site without a certificate is not less protected in transit, because the protection was never coming from the certificate. Reading the missing icon as danger leads people to prefer a site that has one, which is the wrong direction entirely.

What people get wrong

They fold the whole question of trust into one glyph. It is a small thing to look at, it appears next to the address, and it is coloured like a verdict. Everything about its placement suggests it is summarising something bigger than transport encryption.

The second error is checking the icon instead of the address. The lock is easy to see and the address is 56 characters of noise. Attention goes to the easy thing, which is the same substitution described in the prefix page.

What to look at instead

The address bar, all of it, compared against a copy you already trusted. That is the only element in the browser interface that carries information about which service you reached. Everything else in the frame was drawn by software that does not know where you meant to go.

Why the lock keeps being drawn

Browsers built their interface around a web where the certificate was the only identity signal available. Onion addresses arrived later and did not fit the frame, so the frame carried on being drawn. Nobody decided the lock should appear next to an awazon onion link, it simply was never taught not to.

Interface habits outlive their reasons. This one is harmless until somebody uses it as a check, at which point it becomes worse than no signal, because it occupies the place where a real check should have gone.

What would move this

A browser feature that displayed something meaningful about an onion address, such as a match against a locally stored trusted copy. That would be a genuinely useful icon and it would be describing the address rather than the transport. Nothing like it ships today.

• The address is the key
• Onion links resolve only inside Tor
• Checking the first characters