Tor and Onion Rouitring work whilst SSL is out on my network

Question

I have a weird problem going on: Between 6 and 8 pm I am unable to make any ssl connections through my router - and it effects various devices using a range of operating systems and but wifi and Ethernet connections.

I have had the line and checked and the ISP can find no errors on the line or router. Stranger still, Tor seems to work fine, which is making me think that something very strange is going on and either my Tor is fake and not using SSL at all, or the onion routing is helping Tor evade what ever is interfering with SSL connections.

I did have some problems with someone hacking some things through an old email account with a poor password a while before this started - but I don't think they managed to get into anything on my personal network, just access an FB account, and I have hardened my security a lot since then. However, I do make some politically sensitive posts and could be the subject of unwanted attention by. I don't mind if they can see my stuff, but not being able to us SSL connections is a real pain :)

If anyone has an suggestions about why I might have problems with SSL for a regular two hour block each day, or why Tor and Onion routing should seem to to avoid the problem, it would be much appreciated.

Answer 1

This question has a broader scope than Tor.SE has. Maybe InfoSec.SE is a better place to ask.

Between 6 and 8 pm I am unable to make any ssl connections through my router

There could be numerous reasons. You may need a packet capture and a few tests (like using OONI) to determine what happened behind the scene.

• Your router has configurable firewall rules, and someone has somehow managed to add a "disallow 443 port from 6 pm to 8 pm" rule. Note that not all Tor relays listen on port 443.
• It is some sort of SNI-based censorship. Since Tor puts random value in the SNI field, it evades such censorship.
• A man-in-the-middle box is on the line, but it only performs MITM when the server gives out well-known certificates.
• Multiple issues added together could also lead to such situation. For example, assume there is a flawed surveillance box with a broken TCP stack. Legitimate HTTPS certificates are so big that they do not fit in a single TCP segment. The device could think something like "I want to record the server certificate, but I can't reassemble those segments, so let's kill that connection." This scenario is pretty contrived, but faulty devices are everywhere.
• Your Tor binary could be fake. That is to say, Trojan horses are cheaper than MITM boxes, so why not?
• And many more possibilities ... Maybe I missed some obvious ones.