Hacker News new | ask | show | jobs
by unsignedint 3888 days ago
Yes, within a Tor, if you access certain hidden service, you are pulling data from the node that has the corresponding private key. I guess the threat model is when there's some MITM between a user agent and Tor, perhaps via some type of malware. (Because your browser can't tell if you are really accessing hidden service or not.) At this least verifying against certificate coming from a hidden service server would verify that it is coming from the host intended.
1 comments

Usually the Tor client runs on the same machine as the browser, so if you have a MITM, you probably already lost (e.g. the malware probably could have simply injected its own CA root cert into your browser).
It's somewhat of rhetorical, indeed. But it does give at least additional checks in the place. (Also potentially helps to prevent a certain class of vulnerability with hidden service, whether they are caused by a bug or attacks.)