1

I am somewhat new to Tor and am now using it for everything.

I have seen old posts recommending it not be used for online banking etc.

From my experience with cryptography, this seems ludicrous except for one point: certificate authorization spoofing.

Can certificate authorization be spoofed? If not, how is this prevented?

Improve this question
2
  • I personally recommend you do NOT use Tor for personal banking, probably shouldn't use it with your email either. There is no point in using it for online banking as the bank already knows its you and using Tor provides no anonymity. Also your bank may have protections against Tor installed.
    – cubecubed
    Commented Sep 19, 2014 at 3:34
  • Agree with all that point out authenticating as the bank/account customer confirms your identity so benefit in using TOR is lost, imo. With regard to certs, the book, "Cybersecurity and CyberWar", by P.W. Singer and Allan Friedman on p.114, describes the Stuxnet worm that, according to the book, "... utilized digital signatures with the private keys of two certificates stolen from seperate well-known companies, ...". But I don't think that this would fall under "spoofing" as the certs were legitimate; just used illegitimately (according to the book).
    – user3721
    Commented Sep 26, 2014 at 18:43

1 Answer 1

Reset to default
1

As it has been some time since I have had any experience with this sort of thing, it is unclear what exactly you mean by "certificate spoofing". However, from my understanding of MITM attacks, the implementation of the more secure HSTS protocol used by Google et al. mitigates against many of the attacks using methods such as sslstrip. I'm not sure if banks also employ this protocol, although they most certainly should.

Moreover, the addon HTTPS Everywhere comes standard with the TBB and you may want to review your configuration of this addon if this is a concern.

I'm not sure both of these implementations in tandem obviate the threat you speak of, and I'm not entirely sure that they protect you from quality forged certificates bought on the black market.

However, you may wish to the assess the strength of your own bank's SSL implementation at the Quallys SSL Labs website.

The above concerns notwithstanding, I believe that this comment of yours may be the far more relevant reason as to why you shouldn't be accessing your online banking account.

I am somewhat new to Tor and am now using it for everything.

The purpose of Tor is to protect your anonymity, something that is completely undermined by your use of any account linked to your real-world identity. If some person were to connect to, say, your Facebook account using Tor, then we could be almost certain that this hitherto anonymous individual was actually... well, none other than you.

Improve this answer
3
  • Thank you. Banking was only an ab absurdum reference. However, for extreme circumstances such as a web cryptocurrency wallet or a numbered bank account, anonymity is still valuable. To that end, how can the SSL handshake via Tor be compromised?
    – Jim Bob
    Commented Dec 2, 2014 at 5:54
  • Briefly, in the same way any SSL handshake can be compromised: by the exit relay performing a MITM attack using something like SSLStrip. To my knowledge, most of the threat can be mitigated by having HTTPS Everywhere enabled, and if receiving an unknown certificate warning by your browser, never manually accepting it. The people at Tor actively monitor for bad relays. The section of their blog broadly dealing with HTTPS may also be useful.
    – simulacrum
    Commented Dec 10, 2014 at 13:40
  • Simplifying, are you saying that so long as a site has a properly implemented certificate, sufficient cryptography etc, combined with HTTPS anywhere, an exit node has no more advantage than an ISP for MITM?
    – Jim Bob
    Commented Dec 13, 2014 at 23:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .