3 ms·
Tor Browser has ‘HTTPS Everywhere’ bundled, and I would hope that it's set up to opt for https by default, since http is pretty much no-go with Tor.
by aasasd 6y ago
Tor Browser has ‘HTTPS Everywhere’ bundled, and I would hope that it's set up to opt for https by default, since http is pretty much no-go with Tor.
- TedDoesntTalk 6y agoBut that is not always effective: “They (selectively) remove HTTP-to-HTTPS redirects to gain full access to plain unencrypted HTTP traffic without causing TLS certificate warnings. It is hard to detect for Tor Browser users that do not specifically look for the “https://” https://xn--ivg in the URL bar. This is a well known attack called “ssl stripping” that exploits the fact that user rarely type in the full domain starting with “https://” https://xn--ivg. There are established countermeasures, namely HSTS Preloading and HTTPS Everywhere, but in practice many website operators do not implement them and leave their users vulnerable to this kind of attack.”
- 0x00000000 6y agoI’m amazed the tor browser itself even allows any http connections, ever. Seems like a terrible idea 100% of the time to allow them at all when the whole thing relies on passing your data through an untrusted party.
- bilegeek 6y agoProbably because hidden services don't need (or usually use) HTTPS, and they haven't bothered to find an easy way to automatically switch it on and off when alternating to the clearnet.
- MauranKilom 6y agoI don't understand how HTTPS Everywhere would be insufficient. In my understanding you cannot visit any HTTP site while HTTPS Everywhere is active. You would have to turn it off or add an exception. What am I missing? Is this only an option in HTTPS Everywhere (that is not on by default)?
- bilegeek 6y agoSomething like that. By default, HTTPS Everywhere uses a list of HTTPS-capable sites. It doesn't automatically HTTPS-ize the sites outside of that list or block HTTP connections. You have to click the "Encrypt All Sites Eligible" option for that, and only then will it throw an error if the site doesn't have an HTTPS version. Tor Browser doesn't have this enabled by default, probably because hidden services don't require HTTPS and it would be a pain as a default.
- hcs 6y agoEncrypt All Sites Eligible doesn't prevent http to .onion sites. See the check here: https://github.com/EFForg/https-everywhere/blob/bcaf7bdecf147c2a46d7ed73bce64389d828d865/chromium/background-scripts/background.js#L370 https://github.com/EFForg/https-everywhere/blob/bcaf7bdecf14... Edit: Which is not to say that there aren't rules forcing some .onion sites to https, there are. Encrypt All Sites Eligible (httpNowhereOn) just knows it doesn't have to worry about un-rewritten http .onion addresses. So it really is a good idea to turn it on, and think hard before allowing an exception.
- bilegeek 6y agoHuh. TIL. I guess it also depends on your threat model. If you are only browsing and in "Safest" mode, I suppose it's tolerable. But I agree that logging into anything requires EASE to be on.
- aasasd 6y ago> many website operators do not implement them I don't think that a site must do anything for HTTPS Everywhere to work, since it is (or should be) entirely client-side. Obviously, if you had to fetch something over HTTP before switching to HTTPS then a proxy could slip you forged info. So, I don't know if Tor Browser works this way, but—just don't allow plain HTTP unless explicitly requested by the user? (Instead of requiring to specify HTTPS.) Weird if TB doesn't do this.