4 ms·
> I'm not sure if this is generally considered acceptable within the Tor network Tor is already encrypted, that’s why you don’t need TLS. Some services (Like t
by dewey 1y ago
> I'm not sure if this is generally considered acceptable within the Tor network
Tor is already encrypted, that’s why you don’t need TLS. Some services (Like the hidden service from Facebook back in the days) have https but that was more of a vanity from what I remember.
- aspenmayer 1y agoProton also uses HTTPS for their onion site, and they used the same certificate provider as Facebook did for theirs, Digicert, per this page: https://proton.me/blog/tor-encrypted-email https://proton.me/blog/tor-encrypted-email In the above blog post, they seem to imply that they made HTTPS mandatory for Proton Mail over Tor for security reasons.
- adobrawy 1y agoThe best is to refer to official Tor project documentation for .onion over https: https://community.torproject.org/onion-services/advanced/https/ https://community.torproject.org/onion-services/advanced/htt... tl;dr: Pressure from browsers, enterprise, and the overall ecosystem to use HTTPS (e.g., unavailability of advanced web features without HTTPS) is pushing for the use of HTTPS without exception, even for .onion sites with no significant technical advantage.
- jszymborski 1y agoTor browser doesn't warn on http though and I feel like 90% of folks use it exclusively.
- orbisvicis 1y agoWithout https can't the last relay snoop the traffic? edit: oh, is the last relay the onion service? So the entire chain is encrypted?
- rendx 1y agoThe key used to encrypt traffic is in the URL, everything including path is encrypted from client to the onion service end. What you are saying is true for non-onion HTTP sites, not for onions.
- edm0nd 1y agoside note: there is a built in flag mechanism called BadExit for Tor that if a relay or exit is detected to be malicious, it is quickly removed from being used.
- embedding-shape 1y ago> have https but that was more of a vanity from what I remember It has a functional difference as well, lots of new client-side features (like webcrypto) only work on "Secure Origins" which .onion isn't, but websites behind TLS are. So if you wanna deploy say something that encrypts/decrypts something client-side on .onion, you unfortunately need TLS today otherwise the APIs aren't available. Of course browsers could fix this, but I don't think they have any incentives to do so. I guess Tor Browser could in fact fix this, and maybe they already do, but it'd be a patch on top of Firefox I think, something they probably want to do less off, not more.
- crtasm 1y agoMy understanding is Tor Browser already treats .onion as a secure origin, could anyone confirm?
- bauruine 1y agoYes it does but you can use Tor with other browsers too so it can make sense if you want to support them.
- bragr 1y agoI wouldn't recommend using Tor with anything other than Tor browser because there are so many browser features that will expose you now. If you don't need the Tor browser protections, you probably don't need Tor either.
- dewey 1y agoFair point but using Tor even if you don't need it, just to put more legit traffic noise in the network is a valid use case.
- bragr 1y agoGiven the actual correlations attacks governments have done on Tor traffic, I don't think more traffic moves the needle in any appreciable way. Ultimately the Tor architecture is very vulnerable to timing and correlation attacks (never use something like IRC over Tor), and the kinds of changes that would be needed to mitigate those would probably slow it down past the point of usability. One could argue, given the limited bandwidth of the Tor network, that by using it when you don't need it, you make the experience for those that do need it worse (looking at you everyone who tries to torrent over tor).
- Ajedi32 1y agoBack when EV certificates were widely supported by browsers, HTTPS was a great way of cryptographically associating a .onion service with a real legal entity, for sites like Facebook which didn't care about being anonymous.