8

Tor hidden services have an asymmetric key pair. That seems like it ought to do the job of authenticating the server and securing the connection to the client. When Tor clients reach out to normal servers, the final traffic passes through the exit node, so it makes sense to use application-level encryption there. But hidden service traffic stays entirely inside the Tor network, where encryption can be used the whole way, presumably. But occasionally, you see a .onion using HTTPS.

What is the purpose of using HTTPS for darknet web sites? Does it provide any security benefits for the server or client, or is it completely pointless?

Improve this question

2 Answers 2

Reset to default
4

It has it's uses, of course! At least:

  • Integrity you know, that your server is responsible for cipher strength, and a potential malicious node in a chain will have some trouble-time due to that fact for sure
  • Client accounting a very handy option of having client certificates is a powerful tool!
  • Bot protecton lots of HTTP picktools are lacking of strong encryption or HTTPS at all : it will render them useless
Improve this answer
2
  • 1
    Maybe I'm misunderstanding, but doesn't the existing Tor encryption already provide integrity and anti-MitM? Client accounting is a good point, though, I forgot about that.
    – Ben N
    Commented May 22, 2016 at 17:57
  • @BenN Tor's encryption is a transport. Like clearnet routing. And yes - it can be also "played with", even discarded in case of all four chain members are malicious nodes, but even in that case a HTTPS on your side ensures you of MitM-resistance even in this bad screinario
    – Alexey Vesnin ♦
    Commented May 22, 2016 at 18:09
0

Https (or more accurately, TLS) handles transport encryption. However, there's a second very important piece as well, which is verified authentication.

Downsides of the certificate authority system aside, when you connect to, say, https://facebookcorewwwi.onion, not only do you know that your connection is encrypted, but the validity of the presented certificate assures you that the server you're connecting to is actually run by Facebook.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .