1

I read on the documentation about the security issues on TOR, that it is ok if the website is running on HTTPS, but how about on Orbot and site that is not running on HTTPS?

Even if it is running on HTTPS is it 100% sure that the end node can not expose data that is sent out?

I am just wondering for the Orbot app maybe even TOR, what if an encryption is added for the data passing back and forth.

For example:

1.)Encryption for data

2.)Onion layers are added

3.)Onion layer removed

4.)Decryption

It is similar to what the "HTTPS" is doing, but about for Orbot? And if for example a unique private key is used and AES-256 encrypt dynamically for each browser? Even if a server is compromised, or malicious end node, would it make it more secure?

I am just trying to understand and look at why the security part is mentioned a lot through out the internet. And if there are anyway to improve the structure for a more secure experience.

Improve this question

1 Answer 1

Reset to default
1

No matter how many encryption layers you add, the exit node must always send the data to the final destination (web server) in the same form as your Tor client received it from your application (browser).

Extra end-to-end encryption is only possible if the final destination is 'in on it'. (i.e. https)

Improve this answer
1
  • Hi, yer what i was thinking if slightly different to push the end node into a server instance, and have only around 5 or 10 sever instance, so the unwrapping of the last layer will be within a server within the private control environment, so encryption might still work?? So the end node will never be public.... just a thought
    – John
    Commented Jan 5, 2016 at 7:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .