5 ms·
By using a Tor-network internal address rather than an DNS/IP address, a Tor hidden service can provide integrity and confidentiality assurance over the Tor net
by tedks 10y ago
By using a Tor-network internal address rather than an DNS/IP address, a Tor hidden service can provide integrity and confidentiality assurance over the Tor network's protocol rather than HTTPS.
- Daviey 10y agobut.. for apt archives, the integrity is provided by gpg.. TLS doesn't really add value for this.. However, it does provide confidentiality, such that an actor MITM'ing can't see what software is being downloaded.
- xena 10y agoThere are multiple layers of encryption you get for free by using a tor hidden service.
- M2Ys4U 10y agoLooking at the actual list of packages being requested isn't the only way to see what software is being downloaded. An attacker could also see the size of the packages being transferred. Using the dependency tree would help in determining what packages have been downloaded. Though I admit this is a higher barrier than just reading the list of packages.
- tedks 10y agoDefense in depth.