1

Apparently, any exit relay may steal some private data from HTTP requests (like auth data / cookies / credit card information), if the connection itself is not encrypted.

Does HTTPS provide a reliable protection against this? AFAIK HTTPS is vulnerable to Man-In-The-Middle attacks. Is there either a way to ensure that any particular exit node does not perform this kind of attacks or a reliable mechanics that prevents exit relays from doing that?

Improve this question

2 Answers 2

Reset to default
1

use a certificate checks for your HTTPs like Perspectives Project

Improve this answer
3
  • Will this help if the hacker has his own valid certificate and uses it while he's tampering with my connection?
    – Diligent Key Presser
    Commented Mar 2, 2016 at 12:09
  • @DiligentKeyPresser no it won't help him : you'll be able to know that the site is using another certificate
    – Alexey Vesnin ♦
    Commented Mar 2, 2016 at 12:28
  • Well, seems legit. Hope SSL expiration is not causing a vulnerability in Perspectives. I will probably drill into this deeper, but later... Thank you!
    – Diligent Key Presser
    Commented Mar 2, 2016 at 13:04
2

The Tor Project also does exit scanning to find exit relays who do man in the middle attacks. Exitmap is such a scanner. You can also download and run it. If you or another person finds such bad relays, please report them to Tor so that they can be banned from the network.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .