13

I don't get how a HTTPS connection over Tor can be insecure. Where's the difference between a normal HTTPS connection and a Tor -> HTTP connection? Many sites recommend to use the Onion-URL instead of the HTTPS-URL. Where is the benefit?

  • 1
    Should the title be "Why is Tor more secure than HTTPS?"? – user253751 Jun 14 '16 at 0:32
11

Tor provides you with anonymity.

HTTPS protects (encrypts) the content of your data.

HTTP provides none of these.

Tor provides anonymity but does not protect the exploitation of an insecure application to reveal the IP address of, or trace, a TCP stream.

Running HTTP over Tor means your communication data could be read and thus compromise your anonymity.

Here are 4 schemas showing the difference between using HTTP, Tor+HTTP, HTTPS, Tor+HTTPS (the green button reflects the used protocol) regarding what an attacker (eavesdropper) may see:

  1. HTTP (the eavesdropper sees everything) HTTP: the eavesdropper sees everything

  2. Tor + HTTP (eavesdropper reads the communicated data) Tor + HTTP: eavesdropper reads the communicated data

  3. HTTPS (eavesdropper can not read your data, that is all) HTTPS: eavesdropper can not read your data, that is all

4: Tor + HTTPS (even safer) Tor + HTTPS: even safer

10

Tor provides anonymity which HTTPS does not provide. HTTPS only provides end-to-end encryption, but a man in the middle can still see where you are connecting to and might find out more (i.e. which sites your are looking at in detail) by doing statistical analysis of the sniffed traffic.

Tor tries its best to hide the meta-information like source and destination of the request. It also provides encryption, but only up to the exit node of the Tor network. So you should better be using HTTPS on top of Tor if you visit a public site. Tor is not able to protect the traffic once it left the exit node.

Onion-URL's are URL's inside the Tor network itself. That is in this case you don't leave the Tor network when accessing the data. Usually only few sites are accessible by an Onion-URL and also by a public HTTPS-URL, but instead they are accessible either by Onion URL or HTTPS-URL only. So the recommendation to use Onion-URL instead of HTTPS can not be applied for most sites.

I hope I could clear up some confusions in your question. In short

  • Tor over HTTPS: there is no such thing (only HTTPS over Tor, see below).
  • Access of Onion-URL: recommend because traffic does not leave the Tor network. Best option if available.
  • HTTPS over Tor: recommended, because it protects traffic after leaving exit node. Second best option.
  • Plain HTTP (not HTTPS) over Tor: not recommended because not safe after the exit node. Use HTTPS if possible.
  • Good points all. In addition, it should be mentioned that an entity that controls both an entry and exit node to the TOR onion can trace any message that enters and exits the onion through these nodes. It is believed that the U.S. Government controls many computers acting as Tor nodes, and so has some ability to trace onion-routed traffic. – KeithS Aug 28 '15 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.