If tor and tor .onion sites are more private than clearnet, why does no online banking use .oinon or https .onion websites? Wouldn't internet banking want the most private websites available, or do banks need to be able to record clearnet IP's, as part of anti fraud measures.
3 Answers
Reason 1: Banks are businesses and need customers. Only a fraction of internet users use Tor hidden services and this would severely limit how many people use a bank's hidden service. Most people wouldn't go out of their way to download the Tor browser and try to find the bank. Operating the hidden service would be a waste of effort and time and wouldn't help the bank at all.
Reason 2: One of the main reasons for a Tor hidden service is to either keep the hidden service anonymous/private, the client anonymous/private, or both. However, banks and their clients don't need to be anonymous/private, they just need to be secure and encrypted. Using HTTPS, secure connections and transactions, and removing vulnerabilities from the websites' code, etc. is what is truly required.
Reason 3: Since Tor users are anonymous, spammers and cyber attackers could threaten the banks' hidden service. The bank would have put in additional effort into making sure only authentic users are accessing their hidden service such as by using a Captcha. Sure there are cyber attacks and spamming over the clearnet, but Tor can make some of these incidents untraceable.
As you can see, banks don't need hidden services and operating one wouldn't really help their business.
-
Fact: Millions of people use Tor every day, and the most popular site running an Onion Service is Facebook. Also, Tor obviously doesn't provide you anonymity when you're using it to authenticate with an account at a bank that's tied to your identity lol Jun 20 at 20:16
Banks are interested in security, not in privacy.
A bank needs to verify that someone trying to connect is really the account holder that they claim to be. That can't be done privately.
The whole point of Tor is to disguise your identity. Anathema to banks.
-
This answer is misinformation because Onion Services provide better Security than https (pinned certificates unlike X.509), and zero privacy (when logging into your account tied to your identity). Banks often block Tor because very few of their users demand it and many bad actors will use it. Jun 20 at 20:14
This is a very good question. It's something I've thought a lot about -- both as [a] a customer of a bank and [b] while I was working as a security consultant for a bank.
Onion Services are more Secure
To expand a bit on your question, there are numerous security benefits for why millions of people use tor every day. Besides the obvious privacy benefits (which are not at all relevant in the scope of a customer authenticating with their bank ) -- Tor has a fundamentally different approach to encryption (read: it's more secure).
Fun fact: the most popular website on the darknet is facebook. There are hundreds of other popular sites on the darknet, including debian, the CIA, the NYT, the BBC, ProPublica, etc.
Instead of using the untrustworthy X.509 PKI model, all connections to a v3 .onion address is made to a single pinned certificate that is directly correlated to the domain itself (the domain is just a hash of the public key + some metadata).
Moreover, some of the most secure operating systems send all the user's Internet traffic through the Tor network -- for the ultimate data security & privacy of its users.
All of this means that users who connect to a website (eg online banking) have much greater confidentiality and integrity because the authentication of Onion Services is magnitudes stronger than https with X.509.
Client-side Security
Indeed, arguably the most secure Operating Systems today forces all traffic through Tor, for security.
There was a time when I would only do online banking through TAILS, but eventually my credit union started blocking Tor. I wrote them several letters to fix this issue, but the support team claimed to escalate it; it never got anywhere.
Outsourcing
Most banks outsource their online banking.
The fact is that most banks aren't tech companies. They don't want to hire teams of developers, system administrators, and security engineers. There's a lot of risk when you develop your own banking software in-house.
One very popular Online Banking Software that's used by numerous Credit Unions in the US is Alogent. When I was escalating to my bank that they were erroneously blocking Tor (and that was preventing me from being able to log into online banking from TAILS), they likely didn't have a single employee in-house that understood the issue. They had to escalate to Alogent. And, most likely, the customer support representative couldn't speak the tech jargon required to explain the issue. And since very few customers complained, it likely just got swept under the rug.
So why not do the Most Secure thing?
So why don't companies like Alogent deploy Onion Services to their customers online banking presence, if it would greatly improve the security of their customers who use Tor?
The answer is largely:
- Because the customers aren't asking for it, and
- Most security engineers aren't trained on the security benefits of Tor
When designing security systems, banks intentionally do not choose the most secure architectural design. Consider, for example, SEPA or ACH or Credit Card transactions. All of these are systems where you share your private keys with a third party. This is fundamentally backwards from how cryptographers design secure systems. But banks do it this way because it's lower friction and an easier system to build. They accept the risk and losses of some fraud and shore-up that risk with humans to reverse transactions.
They could, of-course, switch to a push-based system that's fundamentally more secure, but that's harder and almost none of their customers demand this (even B2B).
When I was employed as a security engineer for a bank, I did initiate a project to put our online presence behind an Onion Service. This would have greatly reduced the risk to some of our larger API customers. Unfortunately I left to start my own company before the project was finished, and I'm sure the ball was dropped because no customers were asking for it as a feature.
