2

I don't see an option to install the HTTPS Everywhere add-on on the Tor Browser. Is the HTTPS not needed on the Tor Browser?
Does Tor encrypt one's data like the HTTPS Everywhere add-on? I'm new to safe browsing (have read FAQs and other information, but not understanding a much of it at the moment).
Suggestions and direction are appreciated. Thank you.

2

Is the HTTPS not needed on the Tor Browser?

HTTPS Everywhere is included by default in Tor Browser

Does Tor encrypt one's data like the HTTPS Everywhere add-on?

Neither of these tools encrypt the application data.

HTTPS Everywhere has a set of policies for websites that ensure that for those websites it will use HTTPS where possible. It will still result in data being sent in plaintext in cases where either the website doesn't support HTTPS or it does not have a policy defined.

Tor encrypts your data when it's inside the Tor network. If the traffic exits the Tor network then the final layer of encryption is removed by the exit relay. If the data sent into the Tor network (e.g. your HTTP request) isn't encrypted then the data that leaves the Tor network won't be encrypted.

2

HTTPS Everywhere is already included in Tor Browser. Its button is next to the Firefox menu button.

Is the HTTPS not needed on the Tor Browser?

It is recommended to always use HTTPS whenever possible over Tor, except on .onion sites.

Browsing over HTTP over Tor could actually be dangerous, as there is a higher risk of man-in-the-middle (MITM) attacks. These could come from either the exit node or anyone who is able to tamper with the connection after that.

Most dangerous of these would be javascript exploits, which would target possible unpatched vulnerabilities in Firefox. This is why you should have your Tor Browser on at least the medium (on untrusted sites, high) security setting using Torbutton, which disables javascript being used over HTTP connections, or set HTTPS Everywhere to block unencrypted connections while you don't need to use them.

If you send any data to a site over HTTP, it can be captured.

Does Tor encrypt one's data like the HTTPS Everywhere add-on?

No, the connection is still the same as would be used without Tor. Tor cannot force sites to use encryption or encrypt connections once they come out of the Tor network.

  • eff.org/pages/tor-and-https – Anonymous May 29 '17 at 11:27
  • The focus on "Most dangerous...javascript exploits" is a little misleading, there are many other forms on input an attacker could have an exploit for...and they're all equally dangerous if exploited. Setting the security slider to 'medium' to defend against one kind of exploit deployed from one posible position on the connection isn't exactly thorough security advice. First of all the question doesn't ask about it and second of all the "solution" is wholly insufficient. – cacahuatl May 29 '17 at 13:55
  • @canonizing ironize Depends on the threat model. Other exploits are relatively rare. My advice would at least limit the source of the exploit to the site being visited (good point about other types of exploits that might happen over HTTP, though) and assuming an unbroken encrypted connection and that the site doesn't target Tor users at least not enable additional adversaries compared to browsing without Tor. – Anonymous May 29 '17 at 17:02
  • "Other exploits are relatively rare" <- No. – cacahuatl May 29 '17 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.