Apparently, any exit relay may steal some private data from HTTP requests (like auth data / cookies / credit card information), if the connection itself is not encrypted.

Does HTTPS provide a reliable protection against this? AFAIK HTTPS is vulnerable to Man-In-The-Middle attacks. Is there either a way to ensure that any particular exit node does not perform this kind of attacks or a reliable mechanics that prevents exit relays from doing that?


use a certificate checks for your HTTPs like Perspectives Project

| improve this answer | |
  • Will this help if the hacker has his own valid certificate and uses it while he's tampering with my connection? – Diligent Key Presser Mar 2 '16 at 12:09
  • @DiligentKeyPresser no it won't help him : you'll be able to know that the site is using another certificate – Alexey Vesnin Mar 2 '16 at 12:28
  • Well, seems legit. Hope SSL expiration is not causing a vulnerability in Perspectives. I will probably drill into this deeper, but later... Thank you! – Diligent Key Presser Mar 2 '16 at 13:04

The Tor Project also does exit scanning to find exit relays who do man in the middle attacks. Exitmap is such a scanner. You can also download and run it. If you or another person finds such bad relays, please report them to Tor so that they can be banned from the network.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.