Is there any added value in using https with a hidden service, such as Facebook is doing?

Does the SSL provide any more security than regular http?

1 Answer 1


Indeed it is, like these:

  • Client SSL certificates for personalized accounting
  • Enforcing of strong crypto : by the tor protocol specs a cipherset is negotiated, and can be not a stron one. But regardless of the transporting onion crypto - a strong 256-bit AES can be enforced during HTTPS handshake
  • Server authenticity verification: if the Tor HS keys are hijacked, it does not mean that the HTTPS keys are stolen too. Even if they are on the same server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .