4 ms·
> So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// https:// explicitly, as
by vageli 5y ago
> So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// https:// explicitly, as that's your sole protection against getting MITMed.
>Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security.
https://www.torproject.org/download/ https://www.torproject.org/download/
- ryeights 5y agoCaveat: HTTPS Everywhere relies on a manual whitelist of HTTPS-enabled sites. If the website you’re visiting isn’t popular enough to be on their list, you’re out of luck.
- michaelt 5y agoHTTPS Everywhere doesn't have a working rule for bitcoinknots.org And more broadly, neither HSTS preloading or HTTPS Everywhere include a list of every single site on the internet.
- tialaramex 5y agoMentioned below that HTTPS-default (which is an option in ordinary Firefox) is intended to become mandatory in Tor-browser. I use this on my main PC. Once or twice a day I might visit some old or especially cantankerous site that doesn't do HTTPS, I get a full page interstitial explaining the problem, I can decide if I'm OK with that. Otherwise every single link, typed URL, etc. is HTTPS regardless of whether that was what was originally written. I wouldn't recommend it in its current state for my mother, but it's definitely what someone using Tor would want, and it's only getting more ubiquitous.
- aendruk 5y agoI’m surprised to hear it’s not just using the native HTTPS-only mode now.