7

Tor hidden services have an asymmetric key pair. That seems like it ought to do the job of authenticating the server and securing the connection to the client. When Tor clients reach out to normal servers, the final traffic passes through the exit node, so it makes sense to use application-level encryption there. But hidden service traffic stays entirely inside the Tor network, where encryption can be used the whole way, presumably. But occasionally, you see a .onion using HTTPS.

What is the purpose of using HTTPS for darknet web sites? Does it provide any security benefits for the server or client, or is it completely pointless?

migrated from deepweb.stackexchange.com Jun 8 '16 at 23:24

4

It has it's uses, of course! At least:

  • Integrity you know, that your server is responsible for cipher strength, and a potential malicious node in a chain will have some trouble-time due to that fact for sure
  • Client accounting a very handy option of having client certificates is a powerful tool!
  • Bot protecton lots of HTTP picktools are lacking of strong encryption or HTTPS at all : it will render them useless
  • 1
    Maybe I'm misunderstanding, but doesn't the existing Tor encryption already provide integrity and anti-MitM? Client accounting is a good point, though, I forgot about that. – Ben N May 22 '16 at 17:57
  • @BenN Tor's encryption is a transport. Like clearnet routing. And yes - it can be also "played with", even discarded in case of all four chain members are malicious nodes, but even in that case a HTTPS on your side ensures you of MitM-resistance even in this bad screinario – Alexey Vesnin May 22 '16 at 18:09
0

Https (or more accurately, TLS) handles transport encryption. However, there's a second very important piece as well, which is verified authentication.

Downsides of the certificate authority system aside, when you connect to, say, https://facebookcorewwwi.onion, not only do you know that your connection is encrypted, but the validity of the presented certificate assures you that the server you're connecting to is actually run by Facebook.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.