0

Unencrypted HTTP protocol does not protect data from being modified or intercepted. Without a secure connection, the user could be tracked and monitored, deanonymizing them. However, the Tor browser does not enable by default HTTPS connections after installation. It's only advised to make sure that the user is using an HTTPS connection in the Tor Project manual. Some users may not realize this and this could potentially expose them. The HTTPS Everywhere addon already comes pre-intsalled and it contains an option to block unencrypted requests. So why isn't this enabled by default or why isn't the Tor browser blocking HTTP connections without using the addon?

3

It's not enabled by default because it would block a significant fraction of the Internet for users. Blocking HTTP-only traffic will likely come in the future once Tor Browser is using a version of Firefox with HTTPS-only mode, and once the developers feel they can do it while minimizing the usability impact (for example providing documentation to explain why it was blocked, allowing the user to bypass the block, etc).

https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40294
https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/19850#note_2723899

3
  • Steve, this is a great answer, but the latest statistics show that almost 90% of the web is HTTPS, so very few websites have HTTP right?
    – Swangie
    Apr 25 at 23:37
  • @Swangie Breaking even 10% of the web is still a large fraction. I personally would enable an HTTPS-only mode for myself, but my browsing is biased towards English-focused websites run by big tech companies, so I don't know how making this change as a default would affect other people in the world. I'm not sure what the current Mozilla and Tor Project plans are, but my guess is that they want to be careful about this.
    – Steve
    Apr 26 at 3:26
  • I understand now, thank you for explaining!
    – Swangie
    Apr 26 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.