15
No, .onion sites are not using https/ssl by default. But the connection inside the Tor network is always encrypted, so it is not really necessary to use https for .onion sites. Exit nodes aren't used at all with hidden services, because the connection stays inside the Tor network until the hidden service is reached.
8
The circuit:
[ Tor user <-> Guard node <-> Middle node <-> Exit node <-> Server ]
Sending data to server:
The Tor client always encrypt the data for the exit node
And then encrypts it again (another layer) for the middle node
And then again (yet another layer) for the guard node
This way one layer need to be peeled of at each hop in the ...
8
The Tor Project Wiki has a good article covering this: A Childs Garden Of Pluggable Transports.
The pluggable transport is used as a proxy for tors traffic, it provides an extra layer of transformation that exists around the core OR protocol traffic to mask it from censors or eavesdroppers trying to discover it's true nature. In truth, pluggable transports ...
6
The simplest (relative term) method of breaking onion routing is a correlation attack performed by a global adversary that controls a majority of nodes in the network.
What that means is that somebody watching your entry and exit node can correlate requests coming in from your computer to their entry node at time n and leaving their exit node at time n1 for ...
6
Your connection into the Tor network itself is encrypted, as are connections between Tor nodes. In fact, each hop is encrypted with a new key to avoid back-tracing.
What might be unencrypted is the connection from your Exit Node onto the web, if you're connecting over an unencrypted protocol. This means that if you're viewing a standard HTTP webpage then ...
5
This is a common question that everyone stumbles upon while understanding TOR Design. When the data is sent back to the user, each relay encrypts the data using the session key which was exchanged with the user and then only when it reaches the user, it decrypts it using the session keys and retrieves the original data.
Using your example,
Server ...
5
What encryption algorithms does Tor use?
See the following sections of the Tor Protocol Specification:
0.2 Security parameters
0.3 Ciphers
Isn't RSA 1024 considered weak?
1024 hasn't been broken (yet... ), and you'd find moving to anything bigger makes things generally slower.
There's a useful discussion in this old thread.
With regards to rolling ...
5
This setup may, or may not, be completely anonymous, depending on a whole bunch of factors, some extremely subtle. Adding a VPN to Tor basically never improves anonymity, though. Exactly how someone would trace you back to your real IP is in many cases more about how you use Tor, than Tor itself.
4
If you're running a hidden service all connections from a Tor client to it are encrypted end-to-end
4
This is a tough question for any operating system. And it's especially tough for operating systems, such as Windows and OS X, that are largely closed-source.
It's arguable that Windows' logging capabilities are largely undocumented, at least in public. My favorite example is "shellbags". It's my understanding that, prior to mid 2012, these registry entries ...
4
It has it's uses, of course! At least:
Integrity you know, that your server is responsible for cipher strength, and a potential malicious node in a chain will have some trouble-time due to that fact for sure
Client accounting a very handy option of having client certificates is a powerful tool!
Bot protecton lots of HTTP picktools are lacking of strong ...
3
Answer 0:
There is always a way to be monitored by your ISP, because your information (packets) goes through its physical infrastructure (usually fiber cable)
at least there is a way to know if you are connected to a tor relay (not the information going inside the packets that is encrypted),
some ISPs do that in order to prevent their clients to connect ...
3
Yes, Tor clients encrypt connections to entry nodes (relays). Indeed, they successively encrypt to all relays in the circuits that they specify. The required public keys for all relays are available from Tor's directory servers.
3
Tor is the 2nd generation of onion routing. In onion routing, the message is encrypted multiple times with a different key for each layer of encryption. In Tor as long as Alice (the client) has established a circuit with 3 nodes, the entry node, the middle node and the exit node, that means that the original message to Bob(the destination) will be encrypted ...
3
Sorry, I don't really understand your main question, but I'll do my best to answer the others.
How actually a descriptor look like (encoding) ? is there any format or size limit for descriptor on HSdir?
Descriptors are encoded as plain text and are fetched via regular HTTP (performed over a Tor circuit, ofcourse).
Where descriptors are hosted? who are ...
3
If you connect to a remote site (e.g example.com) using the Tor Browser, then strictly speaking there are five "hops" (TCP connections) involved, marked A, B, C, D and E below:
browser -A-> Tor client -B-> entry node -C-> middle node -D-> exit node -E-> example.com
Of these five hops,
"A" is the connection between the Tor browser and the "...
2
A significant threat to onion routing is a correlation attack performed by an adversary that is able to observe the start and end nodes in your connection.
If somebody is watching you or your entry node, and the website you are visiting or your exit node - they can correlate the traffic. They see the website sending a large javascript file, and a few ...
2
If you enable tcp-upstream: yes in your unbound configuration, the remote DNS server should also be able to reply to TCP requests, in other words, to be listening on port 53 TCP. I couldn't find a free DNSSEC enabled server that does this, all of them talk only UDP.
2
The 3 configuration examples given offer different benefits and drawbacks. Our preference would be towards #1, as this minimizes latency while offering security on the transportation layer (and with a DNSSEC validating cache, validation of the origin and answer itself).
From a security standpoint, this should allow the same level of protection that Tor ...
2
When running the Tor Browser, only the Tor Browser connects through the Tor network. Other applications are not affected and will connect in the same way they always do.
2
If strong anonymity is what you want, use Tor. Reaching the Tor network through a VPN does not increase privacy or anonymity. It merely shifts knowledge about Tor usage from your ISP (and relevant government) to the VPN (and relevant government). You choose based on which you trust more (or distrust less).
Tunneling a VPN through Tor decreases anonymity in ...
2
If I understand your question right, you're wondering about the link protocol that relays use to talk to each other. This protocol ensures that relays establish exactly one connection to each other, not a new connection per circuit they carry. Doing it that way has two advantages. One is anonymity: Multiple circuits are multiplexed over such a connection ...
2
Every step is done in reverse when the data is sent back to you from the exit relay, using the same relays. The relay knows which connection some data it receives belongs to, so it can link the data from Rob or the webserver to the original request. It then, instead of decrypting the data you sent it, encrypts it so only you can read it. Then it forwards the ...
2
I have worked on finding ALL Onion Addresses in TOR service and as I found, there is no clear way of finding all the Onions. Actually in the next generation of Onion Addresses, HSDirs can not see the Onion Addresses. You may see the full question HERE. As Alexey Vesnin said, you may get a portion of addresses not all of them, because the addresses are put ...
2
There wouldn't really be any benefit to the attacker sniffing the exit traffic and then routing it over Tor again. Theoretically it would be possible. They can run an exit node, and configure their system to then tunnel all outbound traffic through another Tor client using SOCKS. This wouldn't make them more "anonymous" in this attack. If anything it'd ...
2
If you are using an external client (such as an onion pi) and then connect to the internet over that client, then yes you can use any browser you want and your traffic will be encrypted and sent over Tor. There are some drawbacks in regards to anonymity when doing this that the Tor Browser Bundle takes care of for you.
2
If you create an encrypted folder and put Tor Browser inside of it:
Remote - You will gain no security advantage against a remote attacker: exploits will still work fine.
Local Offline - You will gain some advantage against an offline local attacker if the encrypted folder isn't mounted/decrypted: they would have issues meaningfully tampering with the Tor ...
2
Whenever your client makes a connection to a bridge or any other Tor relay it negotiates an individual key. So this key if different from a key which another client uses and also from a key which your client negotiates in the next twenty minutes.
2
HTTPS Everywhere is already included in Tor Browser. Its button is next to the Firefox menu button.
Is the HTTPS not needed on the Tor Browser?
It is recommended to always use HTTPS whenever possible over Tor, except on .onion sites.
Browsing over HTTP over Tor could actually be dangerous, as there is a higher risk of man-in-the-middle (MITM) attacks. ...
Only top voted, non community-wiki answers of a minimum length are eligible
