2

The TOR manual says that the sites I visit should display the blue/green HTTPS insignia. The sites I visit do not. Instead when I hover the mouse over the icon at the beginning in the URL bar, it says:

This Website does not supply identity information.

I don't know what that means.

Is my anonymity at risk by not using HTTPS?

I visit websites merely to view their content. I am not sending any passwords, any email addresses. I am not downloading/uploading anything.

I am just a passive observer and use the Tor Browser Bundle.

3

Is my anonymity at risk by not using HTTPS?

Yes; and any information you are sending should be considered compromised.

HTTPS (HTTP over TLS/SSL, or HTTP Secure) encrypts the data traveling between your computer and the webserver.

Even if you consider your communication being secure between your computer and the exit node, your data will be sent in the clear between the exit node and the webserver. Therefore, anyone monitoring the exit node you are using will see your data. If you want to know more about this, you can read Kim Zetter's article Rogue Nodes Turn Tor Anonymizer Into Eavesdropper's Paradise, 2007.

This does not directly break your anonymity; however, any information you are sending through HTTP might expose you. (Usernames, addresses, passwords, email addresses, etc.)

Indeed, Tor website mentions that you should use the HTTPS versions of websites:

d. Use HTTPS versions of websites

Tor will encrypt your traffic to and within the Tor network, but the encryption of your traffic to the final destination website depends upon on that website. To help ensure private encryption to websites, the Tor Browser includes HTTPS Everywhere to force the use of HTTPS encryption with major websites that support it. However, you should still watch the browser URL bar to ensure that websites you provide sensitive information to display a blue or green URL bar button, include https:// in the URL, and display the proper expected name for the website. Also see EFF's interactive page explaining how Tor and HTTPS relate.

However, it clearly states at the beginning that Tor won't protect you between the exit node and the webserver:

the encryption of your traffic to the final destination website depends upon on that website.

But, I am not sending any passwords or email addresses! I am not downloading/uploading anything! I am just looking at the content!

It doesn't matter.

First, I remind you that between the exit node and the webserver, the communication is not encrypted.

HTTPS uses Digital Certificate. This does not only provides encryption between you and the webserver; it also proves that the webserver has not been impersonated. You can see it as the ID you may have in your wallet: someone looking at it, then at you, should be able to confirm your identity. This is very important in terms of security. The messsage "This website does not supply identity information" means that the website did not provide any certificate. You have to trust that nothing wrong is happening.

It is not only about the data you send; it is also about the data you receive. Someone impersonating the webserver can show you anything he wants. He can put some malicious content inside the source code of the pages to reveal your identity. It has been done by the FBI when they seized Freedom Hosting. I admit that this example might not be the best one: Freedom Hosting was probably using HTTPS and not HTTP; but, as the FBI was able to seize the servers, they had total control over the data that were sent to the users. The point is: if you can control the data you send to the users, you can deanonymize them.

HTTPS makes it really hard.


EDIT: EFF.org has an interactive visualization of Tor and HTTPS.

  • Some comments/questions: Firstly, I do not send any data - no passwords, no emails etc. I merely visit the website and view the material. Does that unmask me as the website I visit has no HTTPS. – SOCK Mar 17 '16 at 11:06
  • I do not deliberately provide any sensitive information to any website. I just visit the website, look at the content, than close it. Does the website somehow record who visited the website ? – SOCK Mar 17 '16 at 11:10
  • What does it mean: This website does not supply identity information. Thanks – SOCK Mar 17 '16 at 11:15
  • Once again, thanks for your comprehensive reply. When I open the websites of Banks and other reliable institutions, I expect to see a HTTPS connection. But I don't. I find that surprising. Is there some adjustment I need to make to TOR to ensure a HTTPS connection ? – SOCK Mar 18 '16 at 11:59
  • If your bank doesn't redirect you to the HTTPS version of their website, it might mean that they don't support it, or that they are not redirecting HTTP to HTTPS automatically. You should try to connect to the URL https://www.my-bank.com/. By specifying https instead of http, you especially ask for their HTTPS version. If it doesn't work (e.g., Unable to connect to the server), try with a regular browser to check if it comes from your Tor browser configuration. If even a regular browser tells you that you can't connect using HTTPS, switch banks right now. – Yuriko Mar 18 '16 at 12:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.