12

Do .onion sites encrypt the information going through the exit node? Because a lot of them start with HTTP and not HTTPS.

Improve this question

3 Answers 3

Reset to default
17

No, .onion sites are not using https/ssl by default. But the connection inside the Tor network is always encrypted, so it is not really necessary to use https for .onion sites. Exit nodes aren't used at all with hidden services, because the connection stays inside the Tor network until the hidden service is reached.

Improve this answer
2

Do not mess up using Tor as a transport layer, where encryption is used for your privacy protection primarily, and the HTTP access protection by using SSL(aka HTTPS ). Onion sites may use HTTPS freely by just routing in stunnel-fashion way all the ports they need to a full-featured webserver with HTTPS protection enabled.

Improve this answer
0

By default SSL is not used. But if you like to, you can get a cert and use it on top the tor encryption. Its a ongoing discussion, whether or not SSL should be used. Here are some facts and thoughts about it.

Improve this answer
1
  • 1
    Note that at this point the certificate serves more of a validation purpose than anything.
    – Andrew Lott
    Commented May 7, 2015 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .