15

Assuming I select "check certificates using Tor", can I safely turn this feature on without compromising my anonymity?

Will this protect me against (or warn me about) a malicious exit node trying to perform a mitm attack on TLS connections?

8

I'm the maintainer of HTTPS Everywhere, which includes SSL Observatory (off by default though). I'm not sure where the other commenter got the idea that we're sending anything to Google; we don't.

When you enable SSL Observatory, we POST a copy of the certificate chain you saw to an EFF server, along with the time, server domain, and server IP address. We don't keep logs of your IP address, but for extra anonymity, we try to send the POST request through Tor if you have Tor installed. You don't have to be running Tor browser for this to happen.

HTTPS Everywhere ships with a whitelist of common certificate chain fingerprints, so it doesn't send anything that we've seen enough times before (ex: most Google certificate chains).

Currently it does nothing to inform you in real time whether you've been attacked. This is a feature that we're working on adding.

  • I'm currently trying to enable the Tor option in Firefox (not the browser bundle), but I do have the Browser Bundle installed. The SSL Observatory options page has the Tor option greyed out. What else do I need to do to get the addon to detect that I have Tor installed? – ryanoshea Oct 20 '14 at 4:15
3

According to an entry on the EFF site it sends a copy of the certificate, when used with Tor the EFF does not learn who send the certificate.

If you turn on this feature, it will send anonymous copies of certificates for HTTPS websites to EFF's SSL Observatory database, which will allow us to study them and detect problems with the web's cryptographic and security infrastructure.

Now to the part what it protects against.

The Decentralized SSL Observatory is also capable of giving real-time warnings about these problems.

There doesn't seem to be a description of what it actually tells you when they detect that the certificate for xyz.com does not match with what's known to them.

-1

wireshark will show traffic originating from "HTTPS Everywhere" plug-in going to google. As far as I understand, "HTTPS Everywhere" consults a list hosted by google.com. So by using "HTTPS Everywhere" you tell google all the https site you are visiting.

  • So the "SSL Observatory" is running under control of Google? I am wondering why this important information is not expressed on the HTTPS Everywhere homepage. – pabouk Nov 4 '13 at 8:22
  • 4
    'As far as I understand'. Can you name a source for your claim? – user66 Nov 4 '13 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.