I am wondering about the anonymity and security differences in visiting an .onion site, from the user's perspective, between one that is ONLY a hidden service, and one that also points the same webserver to clearnet DNS - whether its DNS face has HTTPS or not.

(Also - some .onion sites / URLS offer HTTPS with the .onion URL anyway, and it's a self-signed certificate - I assume - on TOP of the HSP end-to-end encryption that already exists.)

There are many sites which offer an .onion URL counterpart to their clearnet domains:

But when a connection is made between a Tor user and a hidden service that also hosts that same webserver in non-anonymous DNS namespace (i.e. revealing the hidden service's outfacing IP), involving DNS lookups outside Tor, and with security protocols totally separate to Tor, do any of those clearnet 'compromises' somehow translate to the user connecting only to the hidden service side of the webserver? How insulated is the Tor-facing 'side' of the webserver from the clearnet-facing 'side'?

I can't imagine DNS lookups occur (and thus DNS metadata being snoopable by standard backbone sniffing), but I can think of data on the server database (user account details) being more vulnerable due to having less hops (or no hops) between its domain name and its real server IP (and no Tor encryption compared to simple server proxying either), and also wonder whether serving HTTPS on an .onion domain somehow translates to the user downloading the self-signed certificate from the server's DNS space instead of onion space too.

If the service can manage only operating in .onion namespace, is it advantageous, from the users' point of view?

  • // , It's great to read of situations which take more than the mere possible technical errors, but also social concerns (does a regular DNS counterpart to our .onion make it confusing enough for users to be phished). What's going on in the user's head can be just as important as what's going on in their computer memory, and I like to see attention paid to it. Jun 8, 2015 at 6:46

1 Answer 1


If a user connects to the clearnet webservice with Tor - then the webserver sees the exit node used by the user.

If the user connects to the webservice through the .onion domain - the webserver sees the ip as (localhost), and have no idea where the traffic comes from.

The main difference is that if you connect through the onion domain everything is end-to-end encrypted between you and the server, if you connect to the service through the clearnet address through tor then if there is not https on the webserver then the traffic can be sniffed by the exit node.

So thinking about that - then connecting directly to the onion domain is considered safer.

You must log in to answer this question.