I wonder: If I use a tor connection (e.g. by using Tor Browser) on a site where there is a "deep inspecting" firewall or proxy that "breaks" SSL encryption, am I still anonymous then?

As I understand it, the browser uses SSL to connect to the first node of the tor network, and then the stream is anonymized and safely redirected.

However with such firewall or proxy as mentioned, the traffic is de-anonymized before it actually reaches the tor network, right?

Second question: Is it possible to detect such firewalls or proxys automatically (and preferably warn the user) if confidentiality is compromised?

1 Answer 1


So - at the sequence of questions:

  • If you have an SSL-breaking proxy that is actually breaking SSL - the connection will not start, because Tor can be in two states:

1.1 First run. In this case all the directories' IPs and certificate data is hardcoded into the tor binary itself, no SSL MitM is possible. This kind of attack is a very old one and it was used by censors wide enough so all the privacy-caring software has a workaround about that, not just Tor

1.2 Consequent run. Tor will have it's microdescriptors cache already populated and - to the addition of 1.1 defenses it will have a certificate information for the peers it will try to connect to and the defense routine will be exactly the same

  • Yes, it's possible - every browser with the CA's hardcoded, like a portable ones. The installed ones will have the host OS to verify the CA's and in a censoring case the proxy has its own CA that is pre-installed on all client devices. Any untempered browser will show you a red wall when accessing any HTTPS resource
  • 1
    So if I understood it correctly: Tor has compiled-in "certificate pinning" (or equivalent), so it won't connect unless the tor binary is tampered. But a browser that will connect to tor may be relying on the tampered OS that claims the certificate is the desired one when in fact it's the proxy's or firewall's MITM certificate?
    – U. Windl
    Feb 23, 2023 at 10:21
  • @U.Windl yes, you've got it all correct
    – Alexey Vesnin
    Feb 23, 2023 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .