I don't get how a HTTPS connection over Tor can be insecure. Where's the difference between a normal HTTPS connection and a Tor -> HTTP connection? Many sites recommend to use the Onion-URL instead of the HTTPS-URL. Where is the benefit?
-
2Should the title be "Why is Tor more secure than HTTPS?"?– user253751Jun 14, 2016 at 0:32
-
2Where did you see that it is insecure? Did you determine it yourself or did you see somewhere? In the latter case, please link to the resource. Most often, this includes a reason as to why the author makes said recommendation.– user163495Jan 4, 2022 at 22:25
Add a comment
|
3 Answers
Tor provides you with anonymity.
HTTPS protects (encrypts) the content of your data.
HTTP provides none of these.
Tor provides anonymity but does not protect the exploitation of an insecure application to reveal the IP address of, or trace, a TCP stream.
Running HTTP over Tor means your communication data could be read and thus compromise your anonymity.
Here are 4 schemas showing the difference between using HTTP, Tor+HTTP, HTTPS, Tor+HTTPS (the green button reflects the used protocol) regarding what an attacker (eavesdropper) may see (images from EFF):
HTTP (the eavesdropper sees everything)
Tor + HTTP (eavesdropper reads the communicated data)
HTTPS (eavesdropper can not read your data, that is all)
4: Tor + HTTPS (even safer)
-
1For your Tor + HTTP diagram, isn't the hacker and ISP supposed to be able to read the data too? Once http traffic leave the exit node, its data is readable by ISP and MITM hackers? Jun 27, 2022 at 6:36
Tor provides anonymity which HTTPS does not provide. HTTPS only provides end-to-end encryption, but a man in the middle can still see where you are connecting to and might find out more (i.e. which sites your are looking at in detail) by doing statistical analysis of the sniffed traffic.
Tor tries its best to hide the meta-information like source and destination of the request. It also provides encryption, but only up to the exit node of the Tor network. So you should better be using HTTPS on top of Tor if you visit a public site. Tor is not able to protect the traffic once it left the exit node.
Onion-URL's are URL's inside the Tor network itself. That is in this case you don't leave the Tor network when accessing the data. Usually only few sites are accessible by an Onion-URL and also by a public HTTPS-URL, but instead they are accessible either by Onion URL or HTTPS-URL only. So the recommendation to use Onion-URL instead of HTTPS can not be applied for most sites.
I hope I could clear up some confusions in your question. In short
- Tor over HTTPS: there is no such thing (only HTTPS over Tor, see below).
- Access of Onion-URL: recommend because traffic does not leave the Tor network. Best option if available.
- HTTPS over Tor: recommended, because it protects traffic after leaving exit node. Second best option.
- Plain HTTP (not HTTPS) over Tor: not recommended because not safe after the exit node. Use HTTPS if possible.
answered Aug 28, 2015 at 18:37
-
Good points all. In addition, it should be mentioned that an entity that controls both an entry and exit node to the TOR onion can trace any message that enters and exits the onion through these nodes. It is believed that the U.S. Government controls many computers acting as Tor nodes, and so has some ability to trace onion-routed traffic.– KeithSAug 28, 2015 at 18:53
When visiting a site over the onion services protocol, the Tor protocol prevents data in transit from being read or manipulated by man in the middle attacks, and the onion service protocol validates that the user is connected to the domain name in the browser address bar. No certificate authority is required for this proof, because the name of the service is the actual public key used to authenticate the underlying connection.
-
2