Hot answers tagged

15 votes

"This is a SOCKS Proxy, Not An HTTP Proxy"

Tor provides a SOCKS proxy by default. Whatever you've configured to use Tor is trying to use it as an HTTP proxy which is a different kind of proxy protocol. Tor (at least as of 0.3.2.x) can ...
user avatar
  • 10.8k
7 votes

"This is a SOCKS Proxy, Not An HTTP Proxy"

As @cacahuatl said you can use that switch, if you want it to be permanent go to /etc/tor/torrc (This is the path for tor config file in Ubuntu and Debian), open it with your favorite text editor and ...
user avatar
3 votes

TBB disables Perfect Forward secrecy in SSL sites (that provide PFS)?

If you enter about:config in the address bar and then search for "ssl3" you will get a list of all approved cypher suites in your FF. If you disable all of them except those that contain the strings ...
user avatar
3 votes

TBB disables Perfect Forward secrecy in SSL sites (that provide PFS)?

AES256, 256 bit keys is just the type of encryption used. Firefox ESR/Tor browser only shows the encryption used, nothing more. You can't see the key-exhange(for example DHE, ECDHE, RSA.) Newer ...
user avatar
  • 103
3 votes

Does using HTTP break my anonymity?

Is my anonymity at risk by not using HTTPS? Yes; and any information you are sending should be considered compromised. HTTPS (HTTP over TLS/SSL, or HTTP Secure) encrypts the data traveling between ...
user avatar
  • 460
3 votes

Is Tor Browser vulnerable to tracking via HSTS Super Cookies?

"Implementation Status: Currently, HSTS state is cleared by New Identity, but we don't defend against the creation of these cookies between New Identity invocations" https://www.torproject.org/...
user avatar
3 votes
Accepted

Why doesn't Tor browser block HTTP by default?

It's not enabled by default because it would block a significant fraction of the Internet for users. Blocking HTTP-only traffic will likely come in the future once Tor Browser is using a version of ...
user avatar
  • 2,628
2 votes

Tor connecting to HTTP

This can have several reasons: Tor Browser comes with HTTPS Everywhere. This addon has rules for several sites to connect via HTTPS. At https://atlas.eff.org/index.html?tubes you can see all sites ...
user avatar
  • 8,663
2 votes
Accepted

Does strict transport security survive across restarts?

According to this test site, HSTS information does not survive a reboot on TBB 4.5 nor TBB 5 Alpha supported. This is probably because HSTS can be used to track browsers. It sounds as if the preload ...
user avatar
2 votes

Does the TorBrowser support certificate pinning?

The current version of the Tor browser (4.5) is based on Mozilla Firefox 31. HPKP Were implemented in Firefox 36 according to https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning ...
user avatar
  • 121
2 votes
Accepted

HTTP proxy over Tor

Polipo is the best choice! Here is an official website and a GitHub repository
user avatar
  • 5,401
2 votes
Accepted

Tor Dns , Multi Instances

Encrypted Traffic Tor is agnostic to the data that is routed through the network. Data is protected as it traverses the network but not before it enters or after it leaves. It is the responsibility of ...
user avatar
  • 10.8k
2 votes

SSL Requests from a different IP than Non SSL requests

Your SSL Requests come from a different IP than your Non SSL requests. Your Proxy seems not to support SSL, which is dangerous as the proxy can read and modify all your traffic. Looks to me like ...
user avatar
  • 1,342
2 votes

HTTPS Everywhere and Tor

Is the HTTPS not needed on the Tor Browser? HTTPS Everywhere is included by default in Tor Browser Does Tor encrypt one's data like the HTTPS Everywhere add-on? Neither of these tools encrypt the ...
user avatar
  • 10.8k
2 votes

HTTPS Everywhere and Tor

HTTPS Everywhere is already included in Tor Browser. Its button is next to the Firefox menu button. Is the HTTPS not needed on the Tor Browser? It is recommended to always use HTTPS whenever ...
user avatar
  • 138
2 votes

Do tor exit nodes see the URL you're connecting to?

The Tor-Network works trough Onion Routing which encrypts your Message with your Target Address, so no one can read the original message on the way to the Exit Relay. But since the Exit Relay is the ...
user avatar
  • 31
2 votes

Are contents of a hidden service secure if the service is HTTP?

I'll tackle the easy question first: is it more secure to use HTTPS on a hidden service than pure-HTTP? https provides one thing for onion services that http does not. It provides proof that the ...
user avatar
  • 2,141
2 votes
Accepted

Connecting to Tor Directory Authority via Proxy Server (Protocol Question)

Tor processes (client proxies, relays, bridges, etc) do not communicate over HTTP. They use a custom link protocol within a TLS connection. You must use a tor proxy (or generally, a proxy that speaks ...
user avatar
  • 2,628
1 vote
Accepted

How sending form data over HTTPS using TOR works

[...] the HTTPS session is created between the exit node [...] and the target server [...] that's the point where your thinking/assumption gets wrong. Tor does not change the principle how HTTP, ...
user avatar
1 vote

Fetching JSON via Tor

If you have VM setup with all network traffic routed through tor then you do not need to run torsocks.
user avatar
1 vote

Set a tor server behind http proxy

First of all that isn't how you make Tor use an HTTP proxy. HTTPProxy host[:port] Tor will make all its directory requests through this host:port (or host:80 if port is not specified), rather than ...
user avatar
  • 10.8k
1 vote

HTTPS, HTTP Headers, Privacy and Tor

Are the HTTPS headers encrypted? Yes, in HTTPS the headers and the requested resource are part of the "content" that is encrypted. I am browsing with a normal browser but through an HTTPS page, ...
user avatar
  • 10.8k
1 vote
Accepted

TBB Sec Error Unknown Issuer (Comodo CA)

This is likely unrelated to Tor Browser (except that Tor Browser is being more strict about TLS being properly configured on the server side, it seems...), the server itself is at fault, the ...
user avatar
  • 10.8k
1 vote

Tor Dns , Multi Instances

You cannot send signal NEWNYM using port 9050. Usually, the default controllport for tor is 9051. You have to use 9051 to send signal NEWNYM. Port 9050 is used to have anonymous traffic. Here is ...
user avatar
1 vote

SSL certificate for Tor

At the moment the only way to get a trusted SSL certificate for a .onion domain is to buy an EV (extended validation) certificate. For more info see: https://www.digicert.com/blog/ordering-a-onion-...
user avatar
  • 426
1 vote
Accepted

how to force tor to use just Http(s) Not socks5

You would need to chain some HTTP proxy to Tor's SOCKSPort. This is generally not recommended, it acts as another possible means of leaking DNS (the HTTP proxy may decide to resolve it and I think ...
user avatar
  • 10.8k
1 vote

Is Tor still safe to use if my boss intercepts HTTPS?

Define safe. If you're worried about your boss being able to see what you're doing in Tor, then yes, Tor will be safe. Your Tor traffic will still be intercepted by your boss, but since the ...
user avatar
1 vote

Using Tor to make HTTPS requests in Python

Here are your pyCURL and a howto UPDATE: Copy-pasting by request - copyright to code to sources mentioned upstrings: amnesia@amnesia: ~$ cat checkTor.py #!/usr/bin/env python import pycurl curl = ...
user avatar
  • 5,401
1 vote

Proxy settings issue/HTTPS issue - warning message

This sounds like a false negative. ip-check.info (or any similar site) doesn't know "your own IP", it can detect that a different IP was used and assume it was a "leak", but this could just mean that ...
user avatar
  • 10.8k
1 vote

Clicking on "Join" link in TripAdvisor does not work!

That link requires JavaScript. Enable it and it should work. Alternatively just visit the link https://www.tripadvisor.com/Register. Also, HTTPS works fine on Tor. TBB actually has HTTPS Everywhere ...
user avatar
  • 933

Only top scored, non community-wiki answers of a minimum length are eligible