From a security perspective, is visiting via the .onion address more/less secure?
I'm using Facebook as an example, but this question is really about any website which has both a 'normal' and a Tor URL.
2
-
2I am sorry for the probably nonsense question, but does the facebook really provide a service on the tor network?– peterhFeb 13, 2015 at 21:35
-
2Yeah they were in the news recently for this reason, and carried out some clever wizardry to brute-force a facebook onion URL - bbc.co.uk/news/technology-29879851 I guess I'm wondering if this is just a marketing thing, or an actual attempt to help people living under dictatorships etc access Facebook more securely etc etc– JMKFeb 13, 2015 at 21:41
Add a comment
|
3 Answers
Here is what using Tor to access an ordinary, non-onion facebook URL looks like:
You -> Tor... -> facebook.com
Now both of those links (from you to Tor and from Tor to facebook.com) happen on the open internet, so an attacker might watch packets flowing across those links like this:
You -> (attacker) -> Tor... -> (attacker) -> facebook.com
In a timing attack, the attacker watches the flow of packets and eventually correlates the timing of packets flowing between you and Tor with the timing of packets flowing between Tor and facebook, and hence realizes that you're accessing facebook. Note that this only lets the attacker determine that you're using facebook; if you're communicating with facebook over https then a timing attack does not help the attacker decrypt your communications.
More on timing/correlation attacks here: https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRouting
Accessing facebook via a hidden service should prevent trivial timing attacks, since it's then much more difficult for an attacker to identify packets flowing between Tor and facebook.
-
2
-
Visiting the .onion address never leaves the Tor network. Going to facebook.com over Tor exits the network and goes over the clear-net. That clear-net hop allows for an active attacker to get into your traffic.
Now, your Facebook traffic is probably SSLed, right? If so, it doesn't matter much, but there's certainly more risk than not exiting the network (since either choice exposes you to the same risk in the Tor net).
Network traffic destined to the .onion address will only leave the Tor network inside the Facebook datacenter.
Therefore outsiders on hostile networks (e.g. countries with strong censorship, corporate LANs with strict social media policies, malicious Tor exit node) will only see Tor-related traffic going in/out from your computer.
Keep in mind this does not provide anonymity, as every action you do on Facebook is recorded as usual.
