0

Tor is fully secure only if I use HTTPS, right? But not every site supports it, so I had an idea - some online anonymizers support HTTPS, so if I connect via Tor (Tor -> anonymyzer -> site), will that be the same?

  • 1
    Your unencrypted data will still reach the site. It would just add an extra hop to the connection. If the site doesn't support HTTPS there's not a lot you can do. – RoraΖ Mar 29 '15 at 14:03
  • It is important to know where your data could be secured in the first place. In any situation data sent and received is unencrypted at you and at the server. If the server itself doesn't support TLS then your data is unsecure between the server and whatever "anonymizer" you are using. By connecting through other services (anonymizer and TOR) you are hiding your source IP but exposing the transmitted data to other vulnerable points. So... what is the goal here exactly? The way this question is posed seems to assume way to much. An answer in short to your questions... no and no. – Goblinlord Mar 31 '15 at 4:07
  • The "online anonymizer" in this case would effectively be just another exit node. – Ajedi32 Jan 29 '18 at 16:38
1

In that case the connection between anonymizer and webserver would be just as unencrypted as the connection between exit node and webserver. It would still be possible to eavesdrop on it.

All you get from this is that you get an additional layer in your onion circuit (the outer layer is the https connection between you and the anonymizer) and that you shift your trust-relation from your exit-node to the anonymizer service.

There is simply no way to communicate fully-encrypted with a communication-partner who doesn't support encryption. No matter what you do, the last hop must always be unencrypted in that case.

0

No and No to both of your questions. In reference to your first question google TOR DNS leak just as an example. While this is simply an example a good question to pose to yourself is "how secure is acceptable?"

In reference to your second question, in this situation you would simply moving one end-point of the encrypted traffic from your computer to a third-party computer. While this would encrypt your traffic over the TOR network it inherently places someone in the middle of your traffic with full access to unencrypted data.

-3

You should use something like that: https://www.eff.org/https-everywhere It's created in colloboration with Tor developers, so you can rely on that if you already decided to trust Tor itself.

Edited: My bad. Yes, SSL Everywhere addon won't provide you secure connection in case the target website doesn't support SSL at all, thanks to raz for pointing this out. Then some free vpn service will probably be the most affordable and easy to use solution - http://www.vpnbook.com/freevpn or http://www.vpngate.net/en/, to name a few. You can force your vpn connection to be established on top of tor's connection. Please see this link for clarification: https://airvpn.org/tor/. They also offer custom vpn client able to do the trick out of the box. There how to configure this in linux (haven't found anything for ms windows): https://www.whonix.org/wiki/Tunnel_Proxy_or_SSH_or_VPN_through_Tor

  • 1
    This forces the use of HTTPS on sites that do support it, but it doesn't do anything for sites that don't support HTTPS, which is what the question is about. – Gilles Mar 29 '15 at 15:00
  • 1
    Stacking a VPN on top of Tor doesn't help: the connection from the VPN exit point to the destination server is still unencrypted. – Mark Mar 31 '15 at 1:13
  • Original question is somewhat unclear. I've got an impression that user69939 worries about eardropping by mallicious TOR nodes (for a good reason), in that case my edited answer is correct. I assumed that question author's paranoia hasn't yet reached the stage when you would suspect an internet backbone's staff and owners in reading your forum posts. His question implicitly implies that my view is correct - it's obvious that you can't secure your connection if other end point doesn't support encryption. – tis Mar 31 '15 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.