up vote 0 down vote favorite
share [g+] share [fb]

I use XeroBank Browser to access the tor network on windows. For the last few days the default homepage, start.xerobank.com has a certificate error and always shows my connection as insecure.

Since tor is still working, should it not show as secure regardless of the website itself working?

link|improve this question
50% accept rate
What specific certificate error are you receiving? – Patches Mar 6 '11 at 23:31
That it is invalid, this happens even if you go to the address in a normal browser. – Jay White Mar 7 '11 at 0:10
The question was "What specific certificate error are you receiving?". – grawity Mar 7 '11 at 11:02
The certificate error is not relevant yo my question. – Jay White Mar 7 '11 at 12:08
feedback

1 Answer

up vote 2 down vote

Tor and HTTP/SSL are separate security layers. SSL could be broken even if Tor is working.

Remember that the exit node in a Tor circuit always sees the data you're transferring. If you are not using SSL, then the connection is not secure and your traffic can be read anywhere between the exit node and the HTTP server. (I have even seen exit nodes injecting JavaScript adverts to visited pages.)

As for https://start.xerobank.com, it is using a SSL certificate that expired in June 2010, but is otherwise a legitimate certificate issued by GoDaddy. If it showed up only recently, you should suspect trouble at the web server itself.

link|improve this answer
I get all that, what I don't understand is that when I accept the certificate my connection is always shown as insecure. The anonymity checker does not rely on ssl, but on your route through the tor network. Yet while the website is down, every connection is always shown as insecure. Is this a problem with the website itself, or the way the browser is using tor? – Jay White Mar 7 '11 at 12:10
@Jay: Maybe the anonymity checker is relying on this particular site? – grawity Mar 7 '11 at 12:13
How would it be doing that? I used to use that site under linux while using tor, and it would still report as anonymous. It seems to just verify the route through the tor network as secure or not. – Jay White Mar 7 '11 at 17:40
@Jay: However, Xerobank cannot use any random site to do the checking; it must use one it trusts, namely something.xerobank.com, and it must have a way to verify that it is connecting to the trusted site and can trust its results – this is where SSL comes in. If said site has an invalid SSL certificate, it cannot be trusted to do security-critical checks and Xerobank considers the whole connection "Insecure". Partly it does so because an invalid certificate could be a sign of a man-in-the-middle attack performed by the exit node. – grawity Mar 7 '11 at 23:21
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.