2

Why doesn't torproject.org have an official onion address?

The TBB "Check for Updates" should happen over an onion. It's seems plausible that nation state actors have the ability to mitm such clearnet updates and possibly inject there own "updates".

Improve this question
1
  • 1
    The updates are signed and fetched over TLS. They'd need to defeat a CA-pinned TLS connection, then the signature verification on the MAR file itself.
    – cacahuatl
    Aug 17, 2016 at 2:00

1 Answer 1

Reset to default
6

Actually, there is an onion address for Tor: http://expyuzz4wqqyqhjn.onion/

The Tor Project runs quite a few onion addresses: https://onion.torproject.org/

I can't confirm if the Tor Browser uses this onion address for updating though.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .