Apologies to all, I'm a complete novice.. From what i have read and my understanding is that one must see the https\ before the name of the website to know it was totally "safe" or.... "secure" would perhaps be a better word.. in other words there was little ( or perhaps , fractions of a chance) of outside aliens intercepting typed communications. however i have used the old trusted technique of "copy and Paste" with the https\ with sites such as dream market and every time i penetrate this into tor, it seems to disregard this and it ejaculates without the prefix of the thus said. Resulting in "unsecured connection " relayed via the browser (I) button. so, please advice as to a) the reason for this and B) are these site really secure ?..and maybe my system has been perhaps penetrated without me knowing....hears to wondering.Please advice ..learned ones. Most great full
the reason for this
The .onion addresses themselves are the hash of the public key of the site. This means that the information to connect securely are part of the host name. The browser does not show the HTTPS because it is not involved in securing the connection. Security is instead provided by Tor, it ensures that the connection is properly secured. In short, connection to .onion addresses are secure even without HTTPS.
It is worth noting that there are .onion sites that use HTTPS for additional security, DuckDockGo for example. However, this is not suitable for web sites provided anonymously. You need to verify your identity to get a certificate.
are these site really secure
The connections to the sites are secure but neither .onion nor HTTPS provides any guarantees that the sites themselves are secure.
When using .onion and HTTPS you should be aware that …
a) … the provider of a site may share data you enter with anyone they like. They may not know the source of the connection (in case of .onion) but with help of data you provide it may be possible to deanonymize you.
Data like this can be very unique:
- phone number
- credit card details
- using a login you have used without Tor (they may have recorded your IP)
- posting links that contain a user or session ID
- or using … (one character) instead of ... (three dots), like I do (may guess is that less than 0.01% of the people have that on the keyboard and actually use it, pretty unique)
- … and much, much more
b) … if you provide sensitive data, you have no guarantees that this information is stored securely.
c) … neither .onion nor HTTPS provide any guarantees that the content of the site is true. So, just because the site says "this is the official Tor Project website" or "we won't share any personal data" doesn't mean this is true.
d) … you do not know who controls/operates the site. (This is particularly true for .onion but can also apply to HTTPS.)
e) … you do not know how the infrastructure is secured. (Many sites even neglect to do something as simple as regularly installing security updates.)