Tor and HTTPS
eff.org
Tor and HTTPS
1–10 of 135 posts
Re: Tor and HTTPS
#2When using Tor+HTTPS, the first NSA eavesdropper can see location. How serious is that?
Re: Tor and HTTPS
#3An excellent illustration for those already familiar with the concepts.
However, I not sure its that easy to understand for those who don't know what "location" means, and the text is slightly small and hard to read. It would be a great improvement if they showed a small help text if one hovered over a label inside one of the yellow boxes.
Still, a very excellent job of EFF.
Re: Tor and HTTPS
#4How secure is ssl? Can't NSA fake a certificate?
Re: Tor and HTTPS
#5When using Tor+HTTPS, the first NSA eavesdropper can see location. How serious is that?
By location they mean your IP (from which they can get your address, by asking the ISP). As long as they can't links the two captured packets, they just know that you're using Tor.
Re: Tor and HTTPS
#6When using Tor+HTTPS, the first NSA eavesdropper can see location. How serious is that?
Well only if its from your ISP.
And the illustration should add that both the NSA eavesdropper(s) would get that information actually. Since data is shared.
Re: Tor and HTTPS
#7When using Tor+HTTPS, the first NSA eavesdropper can see location. How serious is that?
They only see the location of the user entering Tor, which is only really an issue if using Tor itself is illegal, or they also control the exit node you are using. In the second case, it would be possible (though unlikely) for them to correlate the entry and exit through bandwidth and timing.
Re: Tor and HTTPS
#8How secure is ssl? Can't NSA fake a certificate?
Do they really need to fake it? It surely might be a part of the famous indirectly accessed data.
Re: Tor and HTTPS
#9An excellent illustration for those already familiar with the concepts. However, I not sure its that easy to understand for those who don't know what "location" means, and the text is slightly small and hard to read. It would be a great improvement if they showed a small help text if one hovered over a label inside one of the yellow boxes. Still, a very excellent job of EFF.
There’s a little description text at the top explaining the meaning of the various labels, including ‘location’ (the last bullet point).
Re: Tor and HTTPS
#10How secure is ssl? Can't NSA fake a certificate?
I would continue under the assumption that they can and do. If confidentiality and authenticity is mission critical, you need to be using a hidden service rather than relying on SSL. A hidden service does not exit the network and does not rely on external validation.