From a security perspective, is visiting via the .onion address more/less secure?

I'm using Facebook as an example, but this question is really about any website which has both a 'normal' and a Tor URL.

  • 2
    I am sorry for the probably nonsense question, but does the facebook really provide a service on the tor network? – peterh Feb 13 '15 at 21:35
  • 2
    Yeah they were in the news recently for this reason, and carried out some clever wizardry to brute-force a facebook onion URL - bbc.co.uk/news/technology-29879851 I guess I'm wondering if this is just a marketing thing, or an actual attempt to help people living under dictatorships etc access Facebook more securely etc etc – JMK Feb 13 '15 at 21:41
up vote 14 down vote accepted

Here is what using Tor to access an ordinary, non-onion facebook URL looks like:

You -> Tor... -> facebook.com

Now both of those links (from you to Tor and from Tor to facebook.com) happen on the open internet, so an attacker might watch packets flowing across those links like this:

You -> (attacker) -> Tor... -> (attacker) -> facebook.com

In a timing attack, the attacker watches the flow of packets and eventually correlates the timing of packets flowing between you and Tor with the timing of packets flowing between Tor and facebook, and hence realizes that you're accessing facebook. Note that this only lets the attacker determine that you're using facebook; if you're communicating with facebook over https then a timing attack does not help the attacker decrypt your communications.

More on timing/correlation attacks here: https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRouting

Accessing facebook via a hidden service should prevent trivial timing attacks, since it's then much more difficult for an attacker to identify packets flowing between Tor and facebook.

  • 2
    This is a better answer than mine :) – Bill Weiss Feb 16 '15 at 20:54
  • Go ahead. As I said, it's better than mine! – Bill Weiss Feb 17 '15 at 20:00

Visiting the .onion address never leaves the Tor network. Going to facebook.com over Tor exits the network and goes over the clear-net. That clear-net hop allows for an active attacker to get into your traffic.

Now, your Facebook traffic is probably SSLed, right? If so, it doesn't matter much, but there's certainly more risk than not exiting the network (since either choice exposes you to the same risk in the Tor net).

Network traffic destined to the .onion address will only leave the Tor network inside the Facebook datacenter.

Therefore outsiders on hostile networks (e.g. countries with strong censorship, corporate LANs with strict social media policies, malicious Tor exit node) will only see Tor-related traffic going in/out from your computer.

Keep in mind this does not provide anonymity, as every action you do on Facebook is recorded as usual.

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.