[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #24922 [- Select a component]: Misleading Help
#24922: Misleading Help
----------------------------------------------+-------------------------
Reporter: RogerMont | Owner: (none)
Type: defect | Status: closed
Priority: Medium | Milestone:
Component: - Select a component | Version:
Severity: Normal | Resolution: invalid
Keywords: HTTPS, Self-Signed Certificates | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
----------------------------------------------+-------------------------
Comment (by RogerMont):
Hello NickM.
Onion Services (Hidden Services) are NOT end-to-end encrypted. Did you
read the description of the problem?
The exit node does the final decryption. If the onion service does not
provide HTTPS, thinking it is unneeded, the user and onion service
provider communication is completely visible to their respective exit
node.
I would change the text to be something like:
Onion services using HTTPS should be preferred because the final
communication between the user and the tor network is unencrypted.
Connecting with an onion service without HTTPS will eventually allow
others to discover your usernames, passwords, and any other sensitive
information. It is common for attackers to operate exit nodes to learn
your personal information.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/24922#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs