2

Why doesn't torproject.org have an official onion address?

The TBB "Check for Updates" should happen over an onion. It's seems plausible that nation state actors have the ability to mitm such clearnet updates and possibly inject there own "updates".

  • 1
    The updates are signed and fetched over TLS. They'd need to defeat a CA-pinned TLS connection, then the signature verification on the MAR file itself. – cacahuatl Aug 17 '16 at 2:00
6

Actually, there is an onion address for Tor: http://expyuzz4wqqyqhjn.onion/

The Tor Project runs quite a few onion addresses: https://onion.torproject.org/

I can't confirm if the Tor Browser uses this onion address for updating though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.