Search code examples
ssltor

Need for SSL in Tor?


Some time ago, I read about Facebook being accessible over Tor and I couldn't ignore that their official URL https://facebookcorewwwi.onion/ not only shows HTTPS but a valid certificate issued for a .onion domain (actually the first in history).

Then the question came: given the nature of the Tor protocol, encrypting peer-to-peer communication, why using HTTPS? What advantages does it add to plain HTTP?

I'll share my conclusions in the answer


Solution

  • Facebook give reasons for this in their blog when annoucing the TOR address

    We decided to use SSL atop this service due in part to architectural considerations - for example, we use the Tor daemon as a reverse proxy into a load balancer and Facebook traffic requires the protection of SSL over that link. As a result, we have provided an SSL certificate which cites our onion address; this mechanism removes the Tor Browser's “SSL Certificate Warning” for that onion address and increases confidence that this service really is run by Facebook. Issuing an SSL certificate for a Tor implementation is - in the Tor world - a novel solution to attribute ownership of an onion address; other solutions for attribution are ripe for consideration, but we believe that this one provides an appropriate starting point for such discussion.