<br><br><div class="gmail_quote">On Wed, Oct 27, 2010 at 11:50 AM, Sebastian Hahn <span dir="ltr"><<a href="mailto:mail@sebastianhahn.net">mail@sebastianhahn.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><div></div><div class="h5"><br>
On Oct 27, 2010, at 8:19 PM, Matthew wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello,<br>
<br>
There is a “Hints and Tips for Whistleblowers Guide” available at <a href="http://ht4w.co.uk/" target="_blank">http://ht4w.co.uk/</a>.<br>
<br>
The section on proxies includes Tor-related information which I fail to understand:<br>
<br>
<br>
"You may actually get more anonymity when using the Tor cloud by not using the https:// version of a web page (if there is an alternative, unencrypted version available), since all the Tor traffic is encrypted anyway between your PC and the final exit node in the Tor cloud, which will probably not be physically in the United Kingdom."<br>
<br>
<br>
---I have no idea what this means. I thought the whole point of using https:// was to prevent Tor exit nodes from snooping and / or potentially injecting content.<br>
<br>
<br>
"This applies especially to websites like the reasonably anonymous whistleblowing website <a href="http://wikileaks.org" target="_blank">wikileaks.org</a> (based in Sweden) , which offer both http://, https:/and Tor Hidden Service methods of uploading whistleblower leak documents, but who tend to, mistakenly, insist on using https:// encryption for when someone comments on their wiki discussion pages. When (not if) the <a href="http://wikileaks.org" target="_blank">wikileaks.org</a> servers, or a blog or a discussion forum like the activist news site Indymedia UK are physically seized (this happened to IndyMedia UK at least 3 times now) , this may, in some circumstances, betray the real IP addresses of commentators with inside knowledge of a whistleblower leak i.e. suspects for a leak investigation."<br>
<br>
<br>
-----How on earth can it be “mistaken” to insist on using https:// encryption? Why would using https:// "betray the real IP addresses"<br>
<br>
</blockquote>
<br></div></div>
Hi,<br>
<br>
Wow. This is really dangerous misinformation, and I'm wondering what<br>
kind of person would give such intentionally harmful advice, marketing<br>
it at whistleblowers. Tor explicitly recommends using https wherever<br>
possible, whether you are using Tor or not. You're right to be<br>
suspicious of their advice. Attacking wikileaks for forcing the use of<br>
https is also just ridiculous.<br><font color="#888888">
<br>
Sebastian***********************************************************************</font><div><div></div><div class="h5"><br>
To unsubscribe, send an e-mail to <a href="mailto:majordomo@torproject.org" target="_blank">majordomo@torproject.org</a> with<br>
unsubscribe or-talk in the body. <a href="http://archives.seul.org/or/talk/" target="_blank">http://archives.seul.org/or/talk/</a><br>
</div></div></blockquote></div><br><div>The person(s) who wrote that article appear to not have a full understanding of Tor, or security for that matter. </div><div>We all know that HTTPS is preferred to regular HTTP.</div>