1

I am trying to install Tor on a certain PC, but the firewall at the gateway does not allow me to do so.

I obtained my instructions to install Tor from https://www.torproject.org/docs/debian

In that, entries to sources.list are HTTP and not HTTPS.

deb http://deb.torproject.org/torproject.org xenial main
deb-src http://deb.torproject.org/torproject.org xenial main 

This was the reason for the firewall to block the installation. Therefore I changed it to HTTPS i.e.

deb https://deb.torproject.org/torproject.org xenial main
deb-src https://deb.torproject.org/torproject.org xenial main 

and tried to install Tor again. It worked!

I would like to know if this is a good method. If so, I would like to know why is it not listed in the Tor website.

2

You have different possibilities to download Tor. Each comes with different advantages or disadvantages:

  1. HTTP: This is the default method which is offered through the Tor website. Usually HTTP works for most users. Packages are digitally signed so the package manager can check if the correct version was downloaded.
  2. HTTPS: If you use HTTPS, it might be a good idea to also install apt-transport-https. This allows you to enter HTTPS links and certificates are checked.
  3. Tor Onion Service: You can also use a Tor Onion Service to download Tor itself. You'll need apt-transport-tor for this. At onion.torproject.org you'll find all available onion addresses for the Tor website. Currently http://sdscoq7snqtznauu.onion/ is the onion for https://deb.torproject.org/. So you can add this URL to your sources.list and download everything over Tor. This will work as long as you have a working Tor connection.

If you want to change the default URL to HTTPS for http://deb.torproject.org/ please go to Tor's Bug tracker and add an entry. The developers will consider this and maybe change it. However as I explained above HTTP might give more availability, so it could be that the HTTP URL is there by intention.

  • Thank for for this answer. I truly appreciate it. I tried to file a bug and created an account at the place you suggested. However their login capcha is impossible for me to get through. So I gave up. Anyway, I truly appreciate your effort. – Dina Oct 11 '16 at 9:09
1

Generally speaking, HTTPS is better than HTTP. But in case of the deb-packages it actually makes no sense at all : all the packages are digitally signed by the publisher's key. And - regardless of the safety of transport they were obtained - using a package manager enforces preliminary signature check. So if it was tampered with - it will fail, regardless of the transport method. And if it's integrity is not tainted - it's no problem if they're fetched via plain HTTP.

  • 1
    if packages are downloaded via HTTP then the firewalls knows the exact URL requested by the user. If we request via HTTPS then its more secure in the sense that firewalls cannot "know" which package is being downloaded. – Dina Oct 12 '16 at 6:04
  • If you have to be such secret - yes, HTTPS will be better in that case – Alexey Vesnin Oct 12 '16 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.