The question almost says it all. Are their some disadvantages when being on whether HTTP or HTTPS while using tor with the purpose of having anonymous traffic or is it all working equally optimal? Thanks!
2 Answers
In the way tor treats the traffic, there is no difference,
Using HTTP and in some cases HTTPS ( if it is not properly configured ref. HSTS ) is hazardous in many situations. Because traffic is going to chokepoints in the tor system unencrypted (exit nodes), changing the traffic aka Man in the Middle attacks are possible.
Always use HTTPS (at least) when on Tor !
-
Thanks for the answer buddy! But does this also mean that they would know my REAL ip or just the all the exit nodes of the circuit?– nppCommented Jan 29, 2017 at 19:28
-
Just the exit nodes are visible if they backtrace it (through TCP/IP). The danger for javascript and other exploitation techniques is exactly this, discovering your real IP. You're welcome Commented Jan 30, 2017 at 19:56
Tor works on OSI layers 3 and 4 in TCP, it does not care at all the stuff layers above. It's walking through tor equally, as I previously said, but even considering a middle node not being a malicious one - if your plaintext/unsecured traffic leaves Tor encryption - it's still itself, i.e. an insecure one. Using HTTP is OK if you're using dot-onion hidden service, because traffic does not leave the Tor network, but otherwise - using an encryption and decentralized DNS, certificate validation and signature checking is crucial nowdays. Take a look at Project perspectives, for example.
answered Jan 29, 2017 at 22:33
