Mozilla Project Fusion: Tor Integration into Firefox
trac.torproject.org
Mozilla Project Fusion: Tor Integration into Firefox
1–10 of 242 posts
Re: Mozilla Project Fusion: Tor Integration into Firefox
#2Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?
Re: Mozilla Project Fusion: Tor Integration into Firefox
#3Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?
This is the biggest misconception about Tor. Tor provides anonymity, but any node (EDIT: any exit node) can read what you're sending if it's not encrypted. You need both.
Re: Mozilla Project Fusion: Tor Integration into Firefox
#4Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?
You -> Tor node -> Tor node -> Tor Exit node -> http/https clearnet -> NSA/GCQH/BND/you name it -> destination server
Re: Mozilla Project Fusion: Tor Integration into Firefox
#5Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?
This is the biggest misconception about Tor. Tor provides anonymity, but any node (EDIT: any exit node) can read what you're sending if it's not encrypted. You need both.
nitpick: exit node. The ones on the way can't, neither can any if you access hidden services.
Re: Mozilla Project Fusion: Tor Integration into Firefox
#6Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?
If you connect to a clearnet website, the clearnet website is fetched by the exit node. If it's not HTTPS, the exit node can change the website however it wants.
Re: Mozilla Project Fusion: Tor Integration into Firefox
#7Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?
https://www.torproject.org/docs/faq.html.en#CanExitNodesEave...
Yes, the guy running the exit node can read the bytes that come in and out there. Tor anonymizes the origin of your traffic, and it makes sure to encrypt everything inside the Tor network, but it does not magically encrypt all traffic throughout the Internet.
This is why you should always use end-to-end encryption such as SSL for sensitive Internet connections.
```
Fortunately HTTPS adoption is much better now :)
Re: Mozilla Project Fusion: Tor Integration into Firefox
#8Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?
This is the biggest misconception about Tor. Tor provides anonymity, but any node (EDIT: any exit node) can read what you're sending if it's not encrypted. You need both.
That's definitely not true if your endpoint you're talking to is an *.onion . A connection to an Onion is encrypted to the destination. That also means if you were running, say NodeRed with authentication, sending credentials "over the clear" (no SSL cert, because stupidity) it's not actually sent over the clear. It's encrypted to the public key relating to your onion address.
Now, if you're using Public Internet->Tor->Public Internet, then absolutely yes the last node CAN read the contents of your packets. In that case, you absolutely need appropriate encryption to hide the contents (sigh, not the metadata) of your packets.
Re: Mozilla Project Fusion: Tor Integration into Firefox
#9Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?
https://www.torproject.org/docs/faq.html.en#CanExitNodesEave... Yes, the guy running the exit node can read the bytes that come in and out there. Tor anonymizes the origin of your traffic, and it makes sure to encrypt everything inside the Tor network, but it does not magically encrypt all traffic throughout the Internet. This is why you should always use end-to-end encryption such as SSL for sensitive Internet conne…
>Fortunately HTTPS adoption is much better now :)
It's HSTS what we need in 2018
Re: Mozilla Project Fusion: Tor Integration into Firefox
#10Earlier quoted context omitted.
https://www.torproject.org/docs/faq.html.en#CanExitNodesEave... Yes, the guy running the exit node can read the bytes that come in and out there. Tor anonymizes the origin of your traffic, and it makes sure to encrypt everything inside the Tor network, but it does not magically encrypt all traffic throughout the Internet. This is why you should always use end-to-end encryption such as SSL for sensitive Internet conne…
>Fortunately HTTPS adoption is much better now :) It's HSTS what we need in 2018
I disagree.
Ive seen HSTS applied to things like Windows 10 updates, to prevent users from seeing what exactly your OS is sending to the mothership.
Ideally, we should be able to see exactly the content being exfiltrated, and choose to allow/disallow. But the moment we use tools like ettercap or mitmssl, it kills the session and we can't see the data.
HSTS seems more "self cutting" than useful at this juncture.