3 ms·
You can read your Gmail over HTTPS, but Tor hidden services generally do not use SSL/TLS (since they _are_ the exit node for that connection).
by yuvadam 13y ago
You can read your Gmail over HTTPS, but Tor hidden services generally do not use SSL/TLS (since they _are_ the exit node for that connection).
- owenmarshall 13y agoAh, that seems sensible - because if the chain is me -> a -> b -> badsite.onion, and the NSA owns a & b, I'm encrypting to each of those node's keys; and in the absence of a central Torland CA, I can't trust anything but what's visible. So even if badsite.onion used TLS, I'd be forced to verify their certificate offline or risk me -> a -> b -> badsite.onion (NSA fakery) <=> torchain -> badsite.onion (real) Am I tracking? That's tricky.
- nwh 13y agoRemember that the URL acts as the public key. If you got the URL from a reputable source then there's no way that you could manage tot get into that situation. Just like SSL you're assured that the destination is who you think it is.
- crumblan 13y agoSurely the TOR protocol is equivalent encryption to SSL/TLS and thus only the exit node or one with the exit node's private key can read any traffic for the hidden service?
- owenmarshall 13y agoTLS works for me going to google.com because a central CA has signed the certificate presented by google.com Apparently there are directory servers that sign the public keys for each node, mitigating this MITM attack: https://news.ycombinator.com/item?id=6888307 https://news.ycombinator.com/item?id=6888307 Without those servers, if we assume the NSA owned the network the entire point would be moot. With those servers... I guess the NSA would have to fuck with your Tor client or steal those server's private keys.