Hot answers tagged

11

Tor provides a SOCKS proxy by default. Whatever you've configured to use Tor is trying to use it as an HTTP proxy which is a different kind of proxy protocol. Tor (at least as of 0.3.2.x) can provide an HTTPTunnelPort which provides an HTTP CONNECT proxy interface. If the application is capable of using an HTTP connect proxy (instead of a transparent HTTP ...


8

The Tor Browser Bundle uses the certificate authority list that is created and maintained by the Mozilla Foundation (aka the default certs that come with Firefox). Mozilla has a strict policy for what can and cannot be included in their list, and a large developer base that will hear about breaches, attacks, etc. and can respond fairly quickly to revoke a ...


5

Your connection into the Tor network itself is encrypted, as are connections between Tor nodes. In fact, each hop is encrypted with a new key to avoid back-tracing. What might be unencrypted is the connection from your Exit Node onto the web, if you're connecting over an unencrypted protocol. This means that if you're viewing a standard HTTP webpage then ...


4

Seems like Tor Browser developers are overworked. There is a development ticket, which hasn't been rejected. Too many more important issues. It would help, if someone knew how their certificate could be added to the source code / build process of Tor Browser. And if someone would provide patch to actually add the certificate. Also answering related questions ...


4

As @cacahuatl said you can use that switch, if you want it to be permanent go to /etc/tor/torrc (This is the path for tor config file in Ubuntu and Debian), open it with your favorite text editor and add HTTPTunnelPort 9080 at the end of the file, reset tor service with this command: sudo service tor restart and you're done.


3

If you connect to a remote site (e.g example.com) using the Tor Browser, then strictly speaking there are five "hops" (TCP connections) involved, marked A, B, C, D and E below: browser -A-> Tor client -B-> entry node -C-> middle node -D-> exit node -E-> example.com Of these five hops, "A" is the connection between the Tor browser and the "...


3

If you enter about:config in the address bar and then search for "ssl3" you will get a list of all approved cypher suites in your FF. If you disable all of them except those that contain the strings DHE (including ECDHE) then it SHOULD force PFS on any ssl connection, assuming of course that the website supports PFS.


3

AES256, 256 bit keys is just the type of encryption used. Firefox ESR/Tor browser only shows the encryption used, nothing more. You can't see the key-exhange(for example DHE, ECDHE, RSA.) Newer versions of Firefox show the full cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA_256 This also shows the key-exchange, in this case ECDHE. FPS ciphers are already ...


3

Both browsers using the same cipher suite with PFS for EFF site. ESR-24 decodes used cipher and showing information partially while fresh vanilla Firefox showing cipher suite without decoding (by accident). https://bugzilla.mozilla.org/show_bug.cgi?id=897615


3

Tor Browser doesn't actively disable PFS, but just uses an old Firefox version. The current version of Tor Browser's Firefox is 24.4 and plain Firefox is at 28. If I recall correctly, Firefox enabled PFS by default in version 27. So when the Firefox version from Tor Browser is updated you'll get PFS by default. If you want to use PFS right now, you can ...


3

"Implementation Status: Currently, HSTS state is cleared by New Identity, but we don't defend against the creation of these cookies between New Identity invocations" https://www.torproject.org/projects/torbrowser/design/


3

Is my anonymity at risk by not using HTTPS? Yes; and any information you are sending should be considered compromised. HTTPS (HTTP over TLS/SSL, or HTTP Secure) encrypts the data traveling between your computer and the webserver. Even if you consider your communication being secure between your computer and the exit node, your data will be sent in the ...


2

According to this test site, HSTS information does not survive a reboot on TBB 4.5 nor TBB 5 Alpha supported. This is probably because HSTS can be used to track browsers. It sounds as if the preload list will be supported and should protect users of major websites that enable HSTS.


2

The current version of the Tor browser (4.5) is based on Mozilla Firefox 31. HPKP Were implemented in Firefox 36 according to https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning So the current version doesn't support HPKP But the next one (based on Firefox 38) will probably support it. One last thing : HPKP is not implemented as a ...


2

Polipo is the best choice! Here is an official website and a GitHub repository


2

Encrypted Traffic Tor is agnostic to the data that is routed through the network. Data is protected as it traverses the network but not before it enters or after it leaves. It is the responsibility of the application to ensure that appropriate cryptography is used to ensure communications authenticity, integrity, and confidentiality. If the application is ...


2

HTTPS Everywhere is already included in Tor Browser. Its button is next to the Firefox menu button. Is the HTTPS not needed on the Tor Browser? It is recommended to always use HTTPS whenever possible over Tor, except on .onion sites. Browsing over HTTP over Tor could actually be dangerous, as there is a higher risk of man-in-the-middle (MITM) attacks. ...


2

Is the HTTPS not needed on the Tor Browser? HTTPS Everywhere is included by default in Tor Browser Does Tor encrypt one's data like the HTTPS Everywhere add-on? Neither of these tools encrypt the application data. HTTPS Everywhere has a set of policies for websites that ensure that for those websites it will use HTTPS where possible. It will still ...


2

Your SSL Requests come from a different IP than your Non SSL requests. Your Proxy seems not to support SSL, which is dangerous as the proxy can read and modify all your traffic. Looks to me like Doileak hasn't been designed for the use with Tor Browser. When I look at the results, it shows me 2 or more different IPs. If I check them on atlas, they are all ...


2

The Tor-Network works trough Onion Routing which encrypts your Message with your Target Address, so no one can read the original message on the way to the Exit Relay. But since the Exit Relay is the last node before sending it to the target, it needs to know the target address with the original message. The Exit-Relay works as a "Man-in-the-Middle" ...


1

You cannot send signal NEWNYM using port 9050. Usually, the default controllport for tor is 9051. You have to use 9051 to send signal NEWNYM. Port 9050 is used to have anonymous traffic. Here is telnet example to send signal using telnet Leelas-MacBook-Pro:~ Pediredla$ telnet localhost 9051 Trying ::1... telnet: connect to address ::1: Connection refused ...


1

At the moment the only way to get a trusted SSL certificate for a .onion domain is to buy an EV (extended validation) certificate. For more info see: https://www.digicert.com/blog/ordering-a-onion-certificate-from-digicert/


1

You would need to chain some HTTP proxy to Tor's SOCKSPort. This is generally not recommended, it acts as another possible means of leaking DNS (the HTTP proxy may decide to resolve it and I think firefox, the last I heard, was doing it's resolves before making requests through the HTTP proxy). Polipo and Privoxy seem to be two of the most popular for this ...


1

Define safe. If you're worried about your boss being able to see what you're doing in Tor, then yes, Tor will be safe. Your Tor traffic will still be intercepted by your boss, but since the connection from you to the Tor network is triple-encrypted, your boss will only see a bunch of encrypted data going from you to whichever guard relay you're connected to....


1

Here are your pyCURL and a howto UPDATE: Copy-pasting by request - copyright to code to sources mentioned upstrings: amnesia@amnesia: ~$ cat checkTor.py #!/usr/bin/env python import pycurl curl = pycurl.Curl() curl.setopt( pycurl.URL, 'https://check.torproject.org/' ) curl.setopt( pycurl.PROXY, '127.0.0.1' ) curl.setopt( pycurl.PROXYPORT, 9050 ) curl....


1

This sounds like a false negative. ip-check.info (or any similar site) doesn't know "your own IP", it can detect that a different IP was used and assume it was a "leak", but this could just mean that your circuit broke mid-use and a new one was built in it's place, resulting in a new/different IP address. These tests are fragile, even https://check....


1

This can have several reasons: Tor Browser comes with HTTPS Everywhere. This addon has rules for several sites to connect via HTTPS. At https://atlas.eff.org/index.html?tubes you can see all sites which contain tubes. Your site is not among them. There is a chance that the site itself redirects your request to the HTTPS. You can check it with curl. Just ...


1

That link requires JavaScript. Enable it and it should work. Alternatively just visit the link https://www.tripadvisor.com/Register. Also, HTTPS works fine on Tor. TBB actually has HTTPS Everywhere installed which automatically uses https on all known sites to support HTTPS.


1

TBB by default won't maintain a record of which sites' self-signed certs you've chosen to trust similar to how it does not keep track of your browser history for privacy sake. You can go to Privacy Settings>Remember History to override this which would keep a record of the sites you've visited and therefore possibly keep track of your site certificates.


1

The Tor Browser Bundle ships the plugin HTTPS Everywhere. This plugin tries to access many sites via HTTPS. However the plugin works on a list of sites. When a site is not listed or has some weaknesses it is not accessed through HTTPS. When you use another browser (other than Tor Browser) and this browser has no plugin installed, you are be able to access ...


Only top voted, non community-wiki answers of a minimum length are eligible