Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor and HTTPS

eff.org

Post reply on HN
Print view View original

51–60 of 135 posts

Re: Tor and HTTPS

#51

Post by noerps »

csomar wrote: post #33
ancarda wrote: post #29

Earlier quoted context omitted.

Running a regular node is fine as you're routing encrypted information for the Tor network - your unlikely to get any hassle although check your countries laws on crypto first. Running an exit node may be a different story. You could get false DMCA takedown notices or get charged with someone else's crime. Think of it this way; you're running an open proxy. Uses of Tor can send any traffic through your connection. Th…

Then, maybe, use Bitcoins for payment and Tor+HTTPS while signing up for the hosting provider?

Bitcoin transactions are chained, that may compromise you.

But you could use an anon currency-exchange or currency-bridge like paysafecard.com to obtain some value and obtain bitcoin with that value and never use that bitcoin key again to avoid that.

Re: Tor and HTTPS

#52

Post by Wilya »

csomar wrote: post #33
ancarda wrote: post #29

Earlier quoted context omitted.

Running a regular node is fine as you're routing encrypted information for the Tor network - your unlikely to get any hassle although check your countries laws on crypto first. Running an exit node may be a different story. You could get false DMCA takedown notices or get charged with someone else's crime. Think of it this way; you're running an open proxy. Uses of Tor can send any traffic through your connection. Th…

Then, maybe, use Bitcoins for payment and Tor+HTTPS while signing up for the hosting provider?

That's not the issue, in general. The issue is more that a lot of hosting providers will close your account to cover themselves and avoid having to deal with the potential liability.

Re: Tor and HTTPS

#53

Post by tlrobinson »

mtgx wrote: post #28

Assuming the NSA is tapping ISP cables, and siphoning all unencrypted data of the web, and that they need to ask the big companies in the slides for the encrypted data, would EFF's "HTTPS Everywhere" help with all the websites that are not encrypted, like say Reddit?

As another commenter mentiioned, that tool just automatically switches to HTTPS sites if available (on the same domain name)

FYI: there's https://pay.reddit.com/ but it doesn't work with HTTP Everywhere because its on a different domain.

Re: Tor and HTTPS

#54

Post by noerps »

Achshar wrote: post #35
icebraining wrote: post #5

Earlier quoted context omitted.

By location they mean your IP (from which they can get your address, by asking the ISP). As long as they can't links the two captured packets, they just know that you're using Tor.

I am wondering how that works with dynamic ip allocation by ISP. My ip changes every time I reset my router.

That doesn't matter, since the changes of your endpoints ip are available from your ISP.

Re: Tor and HTTPS

#55

Post by chj »

The problem of HTTPS is that you will need certification from some CAs which may be working with government agents.

Re: Tor and HTTPS

#56

Post by stephen_g »

theboss wrote: post #39
VexXtreme wrote: post #31

What happens if NSA starts operating a number of Tor exit nodes and eavesdropping on the outgoing traffic? What prevents them from doing so?

Security professionals have hypothesized many attacks against the anonymity of the tor onion and what you describe is pretty close to one of them. If the NSA was to create tons Tor nodes (enter, exit, and relay), the onion may be broken. Tor is by no means perfect. It is only obfuscating. It is easy to see how this is broken if you click the TOR button on this thing and then imagine the TOR nodes say NSA on them. I t…

There isn't really such category as a tor 'enter' node. Any node can be the first node of the chain, but it has no idea whether it is the first or one in the middle of the chain. Essentially, it's as if the 'entrance node' is running on your computer.

That means that no node knows the source of the traffic, and only the exit node knows the destination.

For the NSA to effectively monitor Tor, they'd need to run a large proportion of the nodes - one paper thought it would require an attacker to run at least one third of the network.

Re: Tor and HTTPS

#57

Post by buzzkills »

icebraining wrote: post #16
eugene-d wrote: post #12

Earlier quoted context omitted.

I guess "location" means "IP Address". It's not your location in the URL bar, as HTTPS encrypts the connection, not just HTTP request body.

HTTPS doesn't encrypt the domain. That said, Tor does.

https encrypts the host header (indeed all the http headers), so yes it does encrypt the domain in that respect. What it can't encrypt is the destination IP address, which would be reverse looked up to the domain if everything was configured right in the DNS.

Re: Tor and HTTPS

#58

Post by mfenniak »

buzzkills wrote: post #57
icebraining wrote: post #16

Earlier quoted context omitted.

HTTPS doesn't encrypt the domain. That said, Tor does.

https encrypts the host header (indeed all the http headers), so yes it does encrypt the domain in that respect. What it can't encrypt is the destination IP address, which would be reverse looked up to the domain if everything was configured right in the DNS.

Most https clients support server name indication (http://en.wikipedia.org/wiki/Server_Name_Indication), which effectively allows the "Host" header content to be presented before a server-side certificate is chosen (and therefore before the session is encrypted), to supported name-based virtual hosting.

Re: Tor and HTTPS

#59

Post by knome »

buzzkills wrote: post #57
icebraining wrote: post #16

Earlier quoted context omitted.

HTTPS doesn't encrypt the domain. That said, Tor does.

https encrypts the host header (indeed all the http headers), so yes it does encrypt the domain in that respect. What it can't encrypt is the destination IP address, which would be reverse looked up to the domain if everything was configured right in the DNS.

This is no longer true.

Seeing as HTTPS sites could not previously share an IP address, making it obvious which site communications with any given IP address was directed towards, an extension was developed that now sends the desired host unencrypted before the encrypted package.

This doesn't yield any more information that could previously be derived, but does allow you to serve as many HTTPS sites from a single host as you wish.

http://en.wikipedia.org/wiki/Server_Name_Indication

Re: Tor and HTTPS

#60

Post by theboss »

stephen_g wrote: post #56
theboss wrote: post #39

Earlier quoted context omitted.

Security professionals have hypothesized many attacks against the anonymity of the tor onion and what you describe is pretty close to one of them. If the NSA was to create tons Tor nodes (enter, exit, and relay), the onion may be broken. Tor is by no means perfect. It is only obfuscating. It is easy to see how this is broken if you click the TOR button on this thing and then imagine the TOR nodes say NSA on them. I t…

There isn't really such category as a tor 'enter' node. Any node can be the first node of the chain, but it has no idea whether it is the first or one in the middle of the chain. Essentially, it's as if the 'entrance node' is running on your computer. That means that no node knows the source of the traffic, and only the exit node knows the destination. For the NSA to effectively monitor Tor, they'd need to run a larg…

Yes but one third is doable for a perfect attacker with 'unlimited resources'.

It would be really interesting to determine how much this would cost

Post reply on HN