15

I don't get how a HTTPS connection over Tor can be insecure. Where's the difference between a normal HTTPS connection and a Tor -> HTTP connection? Many sites recommend to use the Onion-URL instead of the HTTPS-URL. Where is the benefit?

2
  • 2
    Should the title be "Why is Tor more secure than HTTPS?"? Jun 14, 2016 at 0:32
  • 2
    Where did you see that it is insecure? Did you determine it yourself or did you see somewhere? In the latter case, please link to the resource. Most often, this includes a reason as to why the author makes said recommendation.
    – user163495
    Jan 4, 2022 at 22:25

3 Answers 3

13

Tor provides you with anonymity.

HTTPS protects (encrypts) the content of your data.

HTTP provides none of these.

Tor provides anonymity but does not protect the exploitation of an insecure application to reveal the IP address of, or trace, a TCP stream.

Running HTTP over Tor means your communication data could be read and thus compromise your anonymity.

Here are 4 schemas showing the difference between using HTTP, Tor+HTTP, HTTPS, Tor+HTTPS (the green button reflects the used protocol) regarding what an attacker (eavesdropper) may see (images from EFF):

  1. HTTP (the eavesdropper sees everything) HTTP: the eavesdropper sees everything

  2. Tor + HTTP (eavesdropper reads the communicated data) Tor + HTTP: eavesdropper reads the communicated data

  3. HTTPS (eavesdropper can not read your data, that is all) HTTPS: eavesdropper can not read your data, that is all

4: Tor + HTTPS (even safer) Tor + HTTPS: even safer

1
  • 2
    For your Tor + HTTP diagram, isn't the hacker and ISP supposed to be able to read the data too? Once http traffic leave the exit node, its data is readable by ISP and MITM hackers? Jun 27, 2022 at 6:36
12

Tor provides anonymity which HTTPS does not provide. HTTPS only provides end-to-end encryption, but a man in the middle can still see where you are connecting to and might find out more (i.e. which sites your are looking at in detail) by doing statistical analysis of the sniffed traffic.

Tor tries its best to hide the meta-information like source and destination of the request. It also provides encryption, but only up to the exit node of the Tor network. So you should better be using HTTPS on top of Tor if you visit a public site. Tor is not able to protect the traffic once it left the exit node.

Onion-URL's are URL's inside the Tor network itself. That is in this case you don't leave the Tor network when accessing the data. Usually only few sites are accessible by an Onion-URL and also by a public HTTPS-URL, but instead they are accessible either by Onion URL or HTTPS-URL only. So the recommendation to use Onion-URL instead of HTTPS can not be applied for most sites.

I hope I could clear up some confusions in your question. In short

  • Tor over HTTPS: there is no such thing (only HTTPS over Tor, see below).
  • Access of Onion-URL: recommend because traffic does not leave the Tor network. Best option if available.
  • HTTPS over Tor: recommended, because it protects traffic after leaving exit node. Second best option.
  • Plain HTTP (not HTTPS) over Tor: not recommended because not safe after the exit node. Use HTTPS if possible.
3
  • Good points all. In addition, it should be mentioned that an entity that controls both an entry and exit node to the TOR onion can trace any message that enters and exits the onion through these nodes. It is believed that the U.S. Government controls many computers acting as Tor nodes, and so has some ability to trace onion-routed traffic.
    – KeithS
    Aug 28, 2015 at 18:53
  • Now, after 9 years from the future. I looked exactly "tor over https". Reason is very simple: I want to make hardly discoverable that I am part of the tor network. Sad that it does not exist. I believe, the protocol between the nodes would not need such an improvement, it is probably not only my problem. Yes, I know, that https traffic in such a tor would mean a https-over-tor-over-https embedding, but I think I could live with it.
    – peterh
    3 hours ago
  • Another super important improvement would it be if exit nodes could port forward to darknet sockets. It would be yet more nice if they would forward https requests of name-based virtualhosts to darknet sockets. On this way, one could make a darknet service available on the public internet.
    – peterh
    3 hours ago
-1

When visiting a site over the onion services protocol, the Tor protocol prevents data in transit from being read or manipulated by man in the middle attacks, and the onion service protocol validates that the user is connected to the domain name in the browser address bar. No certificate authority is required for this proof, because the name of the service is the actual public key used to authenticate the underlying connection.

Tor Site

1
  • 2
    This doesn't answer why HTTPS is insecure over Tor.
    – schroeder
    Jan 4, 2022 at 22:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .