Apologies to all, I'm a complete novice.. From what i have read and my understanding is that one must see the https\ before the name of the website to know it was totally "safe" or.... "secure" would perhaps be a better word.. in other words there was little ( or perhaps , fractions of a chance) of outside aliens intercepting typed communications. however i have used the old trusted technique of "copy and Paste" with the https\ with sites such as dream market and every time i penetrate this into tor, it seems to disregard this and it ejaculates without the prefix of the thus said. Resulting in "unsecured connection " relayed via the browser (I) button. so, please advice as to a) the reason for this and B) are these site really secure ?..and maybe my system has been perhaps penetrated without me knowing....hears to wondering.Please advice ..learned ones. Most great full


the reason for this

The .onion addresses themselves are the hash of the public key of the site. This means that the information to connect securely are part of the host name. The browser does not show the HTTPS because it is not involved in securing the connection. Security is instead provided by Tor, it ensures that the connection is properly secured. In short, connection to .onion addresses are secure even without HTTPS.

It is worth noting that there are .onion sites that use HTTPS for additional security, DuckDockGo for example. However, this is not suitable for web sites provided anonymously. You need to verify your identity to get a certificate.

are these site really secure

The connections to the sites are secure but neither .onion nor HTTPS provides any guarantees that the sites themselves are secure.

When using .onion and HTTPS you should be aware that …

a) … the provider of a site may share data you enter with anyone they like. They may not know the source of the connection (in case of .onion) but with help of data you provide it may be possible to deanonymize you.

Data like this can be very unique:

  • e-mail
  • address
  • phone number
  • credit card details
  • using a login you have used without Tor (they may have recorded your IP)
  • posting links that contain a user or session ID
  • or using … (one character) instead of ... (three dots), like I do (may guess is that less than 0.01% of the people have that on the keyboard and actually use it, pretty unique)
  • … and much, much more

b) … if you provide sensitive data, you have no guarantees that this information is stored securely.

c) … neither .onion nor HTTPS provide any guarantees that the content of the site is true. So, just because the site says "this is the official Tor Project website" or "we won't share any personal data" doesn't mean this is true.

d) … you do not know who controls/operates the site. (This is particularly true for .onion but can also apply to HTTPS.)

e) … you do not know how the infrastructure is secured. (Many sites even neglect to do something as simple as regularly installing security updates.)

  • Thank you so much for your super response. clarity has be had. i had noticed that duckduckgo had https thus my question.
    – spoofer
    Mar 22 '17 at 16:08
  • Thank you so much for your super response. clarity has be had. i had noticed that duckduckgo had https thus my question. I wounder if you could elaborate on what you mean by ""secure ( as I'm not entirely sure what i mean by it)... if the site isn't secure ..does that mean that any transactions that take place within it can be a) observed? and b) thus compromised and be traceable back to the source?
    – spoofer
    Mar 22 '17 at 16:15
  • Security advice Please check the url in the browser to start with 'lchudifyeqm4ldjj.onion'. If the address is different you should logout and login again with the correct url. In case of a phishing attempt please also change your password and contact the support team. In case you experienced something strange during the login procedure please change your password.
    – spoofer
    Mar 22 '17 at 16:20
  • ..this is the advice from the site itself... so still a bit confused..
    – spoofer
    Mar 22 '17 at 16:22
  • @spoofer updated the answer. I'm not sure about the advice you found on the page though. If you ask me, you should verify the address before logging in (especially if you click on a link somewhere that says it redirect to the store.) Mar 22 '17 at 17:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.