If tor and tor .onion sites are more private than clearnet, why does no online banking use .oinon or https .onion websites? Wouldn't internet banking want the most private websites available, or do banks need to be able to record clearnet IP's, as part of anti fraud measures.
2 Answers
Banks are interested in security, not in privacy.
A bank needs to verify that someone trying to connect is really the account holder that they claim to be. That can't be done privately.
The whole point of Tor is to disguise your identity. Anathema to banks.
Reason 1: Banks are businesses and need customers. Only a fraction of internet users use Tor hidden services and this would severely limit how many people use a bank's hidden service. Most people wouldn't go out of their way to download the Tor browser and try to find the bank. Operating the hidden service would be a waste of effort and time and wouldn't help the bank at all.
Reason 2: One of the main reasons for a Tor hidden service is to either keep the hidden service anonymous/private, the client anonymous/private, or both. However, banks and their clients don't need to be anonymous/private, they just need to be secure and encrypted. Using HTTPS, secure connections and transactions, and removing vulnerabilities from the websites' code, etc. is what is truly required.
Reason 3: Since Tor users are anonymous, spammers and cyber attackers could threaten the banks' hidden service. The bank would have put in additional effort into making sure only authentic users are accessing their hidden service such as by using a Captcha. Sure there are cyber attacks and spamming over the clearnet, but Tor can make some of these incidents untraceable.
As you can see, banks don't need hidden services and operating one wouldn't really help their business.
