Editing Template:Secure tor browser downloads

==== Preventing SSLStrip Attacks ====

If you click or paste a download link, make sure it is <code>http'''s'''://</code>. The <code>s</code> in <code>http'''s'''://</code> stands for "secure".

Users often mistakenly believe that a secure, green padlock and a <code>http'''s'''://</code> URL makes any download from that particular website secure. This is not the case. The website might be redirecting to <code>http</code>.

In fact, the user may be vulnerable to an attempted [https://security.stackexchange.com/questions/41988/how-does-sslstrip-work SSLstrip attack] if a link is pasted or typed into the address bar without the <code>https://</code> component (e.g. <code>torproject.org</code> instead of <code>https://torproject.org</code>). <ref>And that website does not:

* Use [https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security HTTP Strict Transport Security (HSTS)]. See also: https://security.stackexchange.com/questions/91092/how-does-bypassing-hsts-with-sslstrip-work-exactly. Without HSTS, sites with non-encrypted resources or sub-domains are vulnerable to SSLstrip.
* Have a [https://www.eff.org/https-everywhere HTTPS Everywhere] rule in effect.
* Use [https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ HSTS preloading].
* Use [https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning HTTP Public Key Pinning]. See also: https://news.netcraft.com/archives/2016/03/22/secure-websites-shun-http-public-key-pinning.html. HPKP limits trust to a handful of Certificate Authorities, but is not used by many websites due to the risk of site breakage if keys are not managed vigilantly.
</ref>

In this instance, the user cannot actually confirm if the file is being downloaded over <code>https://</code>. Potentially, a SSLstrip attack might have made the download take place over plain <code>http</code>. The reason is the user cannot see a padlock; it just appears empty.

To avoid the risk of an SSLstrip attack or similar threats, <u>users should always explicitly type or paste <code>https://</code> in the URL / address bar.</u> The SSL certificate button or padlock will not appear in this instance, but that is nothing to be concerned about. Unfortunately, few users follow this sage advice; instead most mistakenly believe pasting or typing www.torproject.org into the address bar is safe.

==== Other Precautions ====

For even greater safety, where possible download files from hidden services (<i>.onion</i> addresses). Greater security is provided by [[Tor_Browser#Onion_Services_Encryption|hidden service]] downloads, since: the connection is encrypted end-to-end (with PFS), targeting of individuals is difficult, and adversaries cannot easily determine where the user is connecting to or from.

Also, if files are already available in repositories, then users should prefer mechanisms which simplify and automate software upgrades and installations (like apt-get functions), rather than download Internet resources. Avoid installing unsigned software and be sure to always [[Security_Guide#Verifying_Software_Signatures|verify key fingerprints and digital signatures of signed software]] from the Internet, <i>before</i> importing keys or completing installations.

Finally, consider using [[Tor_Browser#Multiple_Tor_Browser_Instances_and_Whonix-Workstations|multiple Whonix-Workstations]] when downloading and installing additional software, to better compartmentalize user activities and minimize the threat of misbehaving applications.
Description	What you type	What you get
Italic	''Italic text''	Italic text
Bold	'''Bold text'''	Bold text
Bold & italic	'''''Bold & italic text'''''	*Bold & italic text*
Description	What you type	What you get
Reference	Page text.<ref>[https://www.example.org/ Link text], additional text.</ref>	Page text.^[1]
Named reference	Page text.<ref name="test">[https://www.example.org/ Link text]</ref>	Page text.^[2]
Additional use of the same reference	Page text.<ref name="test" />	Page text.^[2]
Display references	<references />	↑ Link text, additional text. ↑ Link text