Template:Secure tor browser downloads
Preventing SSLStrip Attacks[edit]
If clicking or pasting a download link, make sure it is https://. The s in https:// stands for "secure".
Users often mistakenly believe that a secure, green padlock and a https:// URL makes any download from that particular website secure. This is not the case because the website might be redirecting to http. In fact, an SSLstrip attack
might succeed if a link is pasted or typed into the address bar without the https:// component (e.g. torproject.org instead of https://torproject.org). [1]
In this instance, it is impossible to confirm if the file is being downloaded over https://. Potentially, a SSLstrip attack might have made the download take place over plain http. The reason is a padlock is not visible; it just appears empty.
To avoid this risk and similar threats, always explicitly type or paste https:// in the URL / address bar. The SSL certificate button or padlock will not appear in this instance, but that is nothing to be concerned about. Unfortunately, few users follow this sage advice; instead most mistakenly believe pasting or typing www.torproject.org into the address bar is safe.
Other Precautions[edit]
For even greater safety, download files from onion services (.onion addresses) whenever possible. Improved security is provided by onion service downloads, since the connection is encrypted end-to-end (with PFS), targeting of individuals is difficult, and adversaries cannot easily determine where the user is connecting to or from.
Also, if files are already available in repositories, then prefer mechanisms which simplify and automate software upgrades and installations (like apt functions), rather than download Internet resources. Avoid installing unsigned software and be sure to always verify key fingerprints and digital signatures of signed software from the Internet, before importing keys or completing installations. For more on this topic, see: Installing Software Best Practices.
Finally, consider using Multiple Kicksecures when downloading and installing additional software, to better compartmentalize user activities and minimize the threat of misbehaving applications.
- ↑ And that website does not:
- Use HTTP Strict Transport Security (HSTS). See also: https://security.stackexchange.com/questions/91092/how-does-bypassing-hsts-with-sslstrip-work-exactly. Without HSTS, sites with non-encrypted resources or sub-domains are vulnerable to SSLstrip.
- Have a HTTPS Everywhere rule in effect.
- Use HSTS preloading.
- Use HTTP Public Key Pinning. See also: https://news.netcraft.com/archives/2016/03/22/secure-websites-shun-http-public-key-pinning.html. HPKP limits trust to a handful of Certificate Authorities, but is not used by many websites due to the risk of site breakage if keys are not managed vigilantly.
- Use HTTP Strict Transport Security (HSTS)