Given an app configured to use Orbot's Apps VPN Mode, I am trying to determine how the VPN works. Most of the app's traffic is sent directly to a Tor hidden service the user controls, but some pieces of data are retrieved over https.
- Can I be sure that all Internet traffic from the app is going through Tor?
- If the app is forwarding some traffic (Bitcoin transactions) to a Tor hidden service (a
.onion
URL under the user's control), am I correct that there is no MITM concern for that portion of the data?
FYI: I am trying to verify the information in this guide is correct with regards to Orbot: https://github.com/jonathancross/jc-docs/blob/master/Bitcoin_mobile_privacy.md