15

Assuming I select "check certificates using Tor", can I safely turn this feature on without compromising my anonymity?

Will this protect me against (or warn me about) a malicious exit node trying to perform a mitm attack on TLS connections?

Improve this question

3 Answers 3

Reset to default
8

I'm the maintainer of HTTPS Everywhere, which includes SSL Observatory (off by default though). I'm not sure where the other commenter got the idea that we're sending anything to Google; we don't.

When you enable SSL Observatory, we POST a copy of the certificate chain you saw to an EFF server, along with the time, server domain, and server IP address. We don't keep logs of your IP address, but for extra anonymity, we try to send the POST request through Tor if you have Tor installed. You don't have to be running Tor browser for this to happen.

HTTPS Everywhere ships with a whitelist of common certificate chain fingerprints, so it doesn't send anything that we've seen enough times before (ex: most Google certificate chains).

Currently it does nothing to inform you in real time whether you've been attacked. This is a feature that we're working on adding.

Improve this answer
1
  • I'm currently trying to enable the Tor option in Firefox (not the browser bundle), but I do have the Browser Bundle installed. The SSL Observatory options page has the Tor option greyed out. What else do I need to do to get the addon to detect that I have Tor installed?
    – ryanoshea
    Oct 20, 2014 at 4:15
3

According to an entry on the EFF site it sends a copy of the certificate, when used with Tor the EFF does not learn who send the certificate.

If you turn on this feature, it will send anonymous copies of certificates for HTTPS websites to EFF's SSL Observatory database, which will allow us to study them and detect problems with the web's cryptographic and security infrastructure.

Now to the part what it protects against.

The Decentralized SSL Observatory is also capable of giving real-time warnings about these problems.

There doesn't seem to be a description of what it actually tells you when they detect that the certificate for xyz.com does not match with what's known to them.

Improve this answer
-1

wireshark will show traffic originating from "HTTPS Everywhere" plug-in going to google. As far as I understand, "HTTPS Everywhere" consults a list hosted by google.com. So by using "HTTPS Everywhere" you tell google all the https site you are visiting.

Improve this answer
2
  • So the "SSL Observatory" is running under control of Google? I am wondering why this important information is not expressed on the HTTPS Everywhere homepage.
    – pabouk - Ukraine stay strong
    Nov 4, 2013 at 8:22
  • 4
    'As far as I understand'. Can you name a source for your claim?
    – user66
    Nov 4, 2013 at 21:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .