Is there any added value in using https with a hidden service, such as Facebook is doing?
Does the SSL provide any more security than regular http?
Indeed it is, like these:
- Client SSL certificates for personalized accounting
- Enforcing of strong crypto : by the tor protocol specs a cipherset is negotiated, and can be not a stron one. But regardless of the transporting onion crypto - a strong 256-bit AES can be enforced during HTTPS handshake
- Server authenticity verification: if the Tor HS keys are hijacked, it does not mean that the HTTPS keys are stolen too. Even if they are on the same server.
answered Apr 2 '16 at 14:26
