I am somewhat new to Tor and am now using it for everything.

I have seen old posts recommending it not be used for online banking etc.

From my experience with cryptography, this seems ludicrous except for one point: certificate authorization spoofing.

Can certificate authorization be spoofed? If not, how is this prevented?

  • I personally recommend you do NOT use Tor for personal banking, probably shouldn't use it with your email either. There is no point in using it for online banking as the bank already knows its you and using Tor provides no anonymity. Also your bank may have protections against Tor installed.
    – cubecubed
    Sep 19 '14 at 3:34
  • Agree with all that point out authenticating as the bank/account customer confirms your identity so benefit in using TOR is lost, imo. With regard to certs, the book, "Cybersecurity and CyberWar", by P.W. Singer and Allan Friedman on p.114, describes the Stuxnet worm that, according to the book, "... utilized digital signatures with the private keys of two certificates stolen from seperate well-known companies, ...". But I don't think that this would fall under "spoofing" as the certs were legitimate; just used illegitimately (according to the book).
    – user3721
    Sep 26 '14 at 18:43

As it has been some time since I have had any experience with this sort of thing, it is unclear what exactly you mean by "certificate spoofing". However, from my understanding of MITM attacks, the implementation of the more secure HSTS protocol used by Google et al. mitigates against many of the attacks using methods such as sslstrip. I'm not sure if banks also employ this protocol, although they most certainly should.

Moreover, the addon HTTPS Everywhere comes standard with the TBB and you may want to review your configuration of this addon if this is a concern.

I'm not sure both of these implementations in tandem obviate the threat you speak of, and I'm not entirely sure that they protect you from quality forged certificates bought on the black market.

However, you may wish to the assess the strength of your own bank's SSL implementation at the Quallys SSL Labs website.

The above concerns notwithstanding, I believe that this comment of yours may be the far more relevant reason as to why you shouldn't be accessing your online banking account.

I am somewhat new to Tor and am now using it for everything.

The purpose of Tor is to protect your anonymity, something that is completely undermined by your use of any account linked to your real-world identity. If some person were to connect to, say, your Facebook account using Tor, then we could be almost certain that this hitherto anonymous individual was actually... well, none other than you.

  • Thank you. Banking was only an ab absurdum reference. However, for extreme circumstances such as a web cryptocurrency wallet or a numbered bank account, anonymity is still valuable. To that end, how can the SSL handshake via Tor be compromised?
    – Jim Bob
    Dec 2 '14 at 5:54
  • Briefly, in the same way any SSL handshake can be compromised: by the exit relay performing a MITM attack using something like SSLStrip. To my knowledge, most of the threat can be mitigated by having HTTPS Everywhere enabled, and if receiving an unknown certificate warning by your browser, never manually accepting it. The people at Tor actively monitor for bad relays. The section of their blog broadly dealing with HTTPS may also be useful.
    – simulacrum
    Dec 10 '14 at 13:40
  • Simplifying, are you saying that so long as a site has a properly implemented certificate, sufficient cryptography etc, combined with HTTPS anywhere, an exit node has no more advantage than an ISP for MITM?
    – Jim Bob
    Dec 13 '14 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.