0

Unencrypted HTTP protocol does not protect data from being modified or intercepted. Without a secure connection, the user could be tracked and monitored, deanonymizing them. However, the Tor browser does not enable by default HTTPS connections after installation. It's only advised to make sure that the user is using an HTTPS connection in the Tor Project manual. Some users may not realize this and this could potentially expose them. The HTTPS Everywhere addon already comes pre-intsalled and it contains an option to block unencrypted requests. So why isn't this enabled by default or why isn't the Tor browser blocking HTTP connections without using the addon?

Improve this question

3 Answers 3

Reset to default
3

It's not enabled by default because it would block a significant fraction of the Internet for users. Blocking HTTP-only traffic will likely come in the future once Tor Browser is using a version of Firefox with HTTPS-only mode, and once the developers feel they can do it while minimizing the usability impact (for example providing documentation to explain why it was blocked, allowing the user to bypass the block, etc).

https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40294
https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/19850#note_2723899

Edit: The Tor Browser now uses HTTPS-only mode on desktop by default: https://blog.torproject.org/new-release-tor-browser-115/

Starting in Tor Browser 11.5, HTTPS-Only Mode is enabled by default for desktop, and HTTPS-Everywhere will no longer be bundled with Tor Browser.

Why now? Research by Mozilla indicates that the fraction of insecure pages visited by the average users is very low – limiting the disruption caused to the user experience. Additionally, this change will help protect our users from SSL stripping attacks by malicious exit relays, and strongly reduces the incentive to spin up exit relays for Man-in-the-Middle attacks in the first place.

Improve this answer
4
  • Steve, this is a great answer, but the latest statistics show that almost 90% of the web is HTTPS, so very few websites have HTTP right?
    – Swangie
    Apr 25, 2021 at 23:37
  • @Swangie Breaking even 10% of the web is still a large fraction. I personally would enable an HTTPS-only mode for myself, but my browsing is biased towards English-focused websites run by big tech companies, so I don't know how making this change as a default would affect other people in the world. I'm not sure what the current Mozilla and Tor Project plans are, but my guess is that they want to be careful about this.
    – Steve
    Apr 26, 2021 at 3:26
  • I understand now, thank you for explaining!
    – Swangie
    Apr 26, 2021 at 11:20
  • @Swangie The browsers are like a swiss-knife tools nowdays - like using WebRTC and other features, see my answer for details, the question is not that simple...
    – Alexey Vesnin ♦
    Aug 8, 2022 at 18:00
0

10% out of 1 billion of web sites is not chicken feet's 100.000 millions users say "go **** (away) Tor for good". Never mind this is up to me to keep my data, passwords etc. protected and as bad it is Google making you jump every time its turn on music, now Internet Community have to deal with overzealous developers who are believing they have to help us to be protected as if we don't know how to do so if we needed. Yes our website uses HTTP and NO we don't have nothing to protect. No passwords, no pay system nothing that need even basic inscription in which case while Tor crowed thinks they doing us a favor, 100.000 millions of Internet users removing Tor from their devices.

Improve this answer
1
  • HTTPS isn't just about hiding sensitive data. It's also about preventing someone from modifying the webpage contents, for example inserting malicious javascript into an HTTP webpage. HTTPS should always be preferred over HTTP, even if the website doesn't transmit sensitive information.
    – Steve
    Apr 1, 2022 at 0:36
0

The answer is - actually - inside the Tor network design. It is safe to use plaintext protocols, including HTTP, when you're using a hidden service, because the encryption part is already done by Tor. The only two reasons to use HTTPS via Tor are:

  • Utilizing HTTP/2.0 multi-pipe architecture. By design HTTP/2.0 can not work inside a simple plaintext HTTP
  • Using client certificates as an authentication token by exporting the environment variables via standard HTTP or email services. It's quite a handy tool, especially when properly integrated with PKI infrastructure

So it's totally not up to the tool - like Tor Browser - to think for/instead-of the user that is using it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .