0

I understand in general how TOR works, with creating a circuit from the client using 3 random nodes in the TOR network - the entry node, some internal node, and an exit node.

My question is about how HTTPS works with TOR, and specifically whether or not the data sent to the end server is actually secure.

The way I assume it works, the HTTPS session is created between the exit node (the 3rd node in the circuit) and the target server, but that means this 3rd node can actually see all the data I'm sending as cleartext, including any form data (e.g. credit card numbers, passwords etc.), it then takes that cleartext data and uses the HTTPS/SSL protocols to send it securely to the target server.

Am I wrong/missing something? Is all the data I'm sending to the end server visible to the TOR exit node, even when browsing to an HTTPS connection?

  • To be 100% clear - I'm talking about a case where I'm using TOR to connect to an HTTPS website OUTSIDE of TOR, as connecting to .onion addresses already ensures e2e encryption without the need for HTTPS.
Improve this question
3
  • no, the exit node (and everything between it and the server) can only read your data when using HTTP, like without Tor. -- and also like without Tor, when using HTTPS everything is encrypted on your machine and decrypted on the server. that's why you should definitively use HTTPS when surfing clearweb-sites via Tor resp. also prefer HTTPS in general. || Tor just adds layers of encryption on top of that.
    – DJCrashdummy
    Jul 17, 2019 at 12:31
  • So the SSL handshake is done between my machine and the target server, transmitted over the TOR circuit?
    – Avi Sasson
    Jul 17, 2019 at 14:29
  • added a full blown answer, because this exceeds the scope of comments and i'm hoping this answers your question (and comment) as a whole...
    – DJCrashdummy
    Jul 18, 2019 at 10:56

1 Answer 1

Reset to default
1

[...] the HTTPS session is created between the exit node [...] and the target server [...]

that's the point where your thinking/assumption gets wrong.

Tor does not change the principle how HTTP, HTTPS, SSL (and DNS etc.) works.
the SSL handshake is always done between your machine and the target server and Tor does not manipulate your traffic resp. encryption, else it would be a MITM attack itself.
Tor just adds some layers of additional encryption - you can imagine it as the outer shell of an onion, and then acts like a (resp. some) proxys. this system is called onion routing and that's why Tor was initially an abbreviation of The onion routing.

so when using HTTPS the exit node just sees encrypted traffic and that someone from the Tor network is surfing the site "domain.tld"... and yes, when only using HTTP the exit node (and every attacker between it and the server) can read and manipulate the whole traffic.
usually without Tor, your ISP sees the same and additionally knowing that you are surfing "domain.tld".

that's why you should definitively use HTTPS when surfing clearweb-sites (via Tor) resp. also prefer HTTPS in general whenever possible.

well, perhaps this eases the whole explanation... a very good site to play a little bit around "who sees what with and without Tor and HTTPS": https://www.eff.org/pages/tor-and-https

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .