Apparently, any exit relay may steal some private data from HTTP requests (like auth data / cookies / credit card information), if the connection itself is not encrypted.

Does HTTPS provide a reliable protection against this? AFAIK HTTPS is vulnerable to Man-In-The-Middle attacks. Is there either a way to ensure that any particular exit node does not perform this kind of attacks or a reliable mechanics that prevents exit relays from doing that?


use a certificate checks for your HTTPs like Perspectives Project

  • Will this help if the hacker has his own valid certificate and uses it while he's tampering with my connection? Mar 2 '16 at 12:09
  • @DiligentKeyPresser no it won't help him : you'll be able to know that the site is using another certificate
    – Alexey Vesnin
    Mar 2 '16 at 12:28
  • Well, seems legit. Hope SSL expiration is not causing a vulnerability in Perspectives. I will probably drill into this deeper, but later... Thank you! Mar 2 '16 at 13:04

The Tor Project also does exit scanning to find exit relays who do man in the middle attacks. Exitmap is such a scanner. You can also download and run it. If you or another person finds such bad relays, please report them to Tor so that they can be banned from the network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.