Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use XeroBank Browser to access the tor network on windows. For the last few days the default homepage, has a certificate error and always shows my connection as insecure.

Since tor is still working, should it not show as secure regardless of the website itself working?

share|improve this question
What specific certificate error are you receiving? – Patches Mar 6 '11 at 23:31
That it is invalid, this happens even if you go to the address in a normal browser. – Jay White Mar 7 '11 at 0:10
The question was "What specific certificate error are you receiving?". – grawity Mar 7 '11 at 11:02
The certificate error is not relevant yo my question. – Jay White Mar 7 '11 at 12:08

Tor and HTTP/SSL are separate security layers. SSL could be broken even if Tor is working.

Remember that the exit node in a Tor circuit always sees the data you're transferring. If you are not using SSL, then the connection is not secure and your traffic can be read anywhere between the exit node and the HTTP server. (I have even seen exit nodes injecting JavaScript adverts to visited pages.)

As for, it is using a SSL certificate that expired in June 2010, but is otherwise a legitimate certificate issued by GoDaddy. If it showed up only recently, you should suspect trouble at the web server itself.

share|improve this answer
I get all that, what I don't understand is that when I accept the certificate my connection is always shown as insecure. The anonymity checker does not rely on ssl, but on your route through the tor network. Yet while the website is down, every connection is always shown as insecure. Is this a problem with the website itself, or the way the browser is using tor? – Jay White Mar 7 '11 at 12:10
@Jay: Maybe the anonymity checker is relying on this particular site? – grawity Mar 7 '11 at 12:13
How would it be doing that? I used to use that site under linux while using tor, and it would still report as anonymous. It seems to just verify the route through the tor network as secure or not. – Jay White Mar 7 '11 at 17:40
@Jay: However, Xerobank cannot use any random site to do the checking; it must use one it trusts, namely, and it must have a way to verify that it is connecting to the trusted site and can trust its results – this is where SSL comes in. If said site has an invalid SSL certificate, it cannot be trusted to do security-critical checks and Xerobank considers the whole connection "Insecure". Partly it does so because an invalid certificate could be a sign of a man-in-the-middle attack performed by the exit node. – grawity Mar 7 '11 at 23:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .