Are contents of a hidden service secure if the service is HTTP?

Question

If I host a hidden service without HTTPS, can a compromised exit node (on either server side or client side), read or write any contents of the site?
Also, is it more secure to use HTTPS on a hidden service than pure-HTTP?

Answer 1

I'll tackle the easy question first:

is it more secure to use HTTPS on a hidden service than pure-HTTP?

https provides one thing for onion services that http does not. It provides proof that the service is legitimate and not fake. You can tell this by the fact that you get the green lock when you go to an onion service with an legit https certificate. facebook's onion service is the prime example for this.

OK, for the more difficult part.

Let's look first at the simple explanation provided by the Tor Project.

1. Exit nodes do not connect to onion services. That connection is handled by relays which are middle or guard nodes.

2. The Tor circuit between the nodes and the onion service is always encrypted. This provides a secure way to visit an http site because Tor provides the encryption that https would provide on the normal internet. It also means that you can run other non-secure services like telnet over Tor without worry because Tor provides encryption that would normally not be there.

3. Let's say that I am running a middle node and I find a way to harvest onion services that connect through my node. Could I then read that onion service or scrape it for information? Sure. If you put up a password interface would I then be able to bypass that and see everything anyway, no. I would have the same ability as any other user.

I hope this makes sense. If you need more in depth explanations. Read the documentation on the Tor Website on how Tor works.