<p>With Blockchain.info, only encrypted private keys are stored on their server. Decryption of private keys and signing is done in the browser. You don't even need to worry about sending your data over HTTPS, let alone TOR because any data that leaves your browser is securely encrypted before it even leaves your computer.</p>

<p>There's one caveat, however; it's difficult to determine whether or not Blockchain.info (or any site, really) is doing exactly what they claim unless you <em>constantly</em> monitor traffic between them and your browser. Ultimately, the most dangerous attack vector would be for Blockchain.info to behave dishonestly, or for a website to impersonate them and do the same. </p>

CC BY-SA 3.0
2014-09-12T17:25:24.987Z
2014-09-12T18:21:23.737Z
2014-09-12T18:21:23.737Z
John Henry
<p>Possible attack vectors from the exit node include:</p>

<ul>
<li>Exit node getting its hands on a valid SSL certificate recognised and trusted by the Tor Browser Bundle</li>
<li>Exit node only returning http not https data so HTTPSEverywhere will not be able to connect via https so it falls back without encryption</li>
</ul>

CC BY-SA 3.0
2014-09-07T17:17:21.863Z
Note: HTTPS Everywhere does not fall back on http when unable to connect.
Nick ODell
CC BY-SA 3.0
2014-06-14T15:23:07.027Z
2014-06-14T15:32:15.633Z
2014-06-14T15:32:15.633Z
UndergroundVault
<p>Your Blockchain.info wallet is inherently safe due to the way wallets are generated by Blockchain. Blockchain.info only sends encrypted payloads to and from that are decryptable by the pass phrase you use. </p>

<p>Don't use the API if you don't want to rely on the SSL, which should be pretty strong if used properly but the standard web interface should be safe.</p>

CC BY-SA 3.0
2014-03-15T04:23:43.023Z
2014-03-15T04:23:43.023Z
John T
<p>I seem to find conflicting information regarding the possibility of a TOR exit node stealing my data even while using HTTPS.  How possible/likely is this?</p>

<p>Let's assume user implements strong security on his personal system/network (no keyloggers, malware, etc.) and the blockchain.info is honest.  For this example, <strong>I am concerned about the attack vector of the TOR exit node even while using HTTPS.</strong> </p>

<security><blockchain.info><tor>
TorBrowser + HTTPSEverywhere Blockchain.info wallet safe?
HotBaklava
# TorBrowser + HTTPSEverywhere Blockchain.info wallet safe?

(Asked by: username_0 on 2014-03-14)

I seem to find conflicting information regarding the possibility of a TOR exit node stealing my data even while using HTTPS. How possible/likely is this?

Let's assume user implements strong security on his personal system/network (no keyloggers, malware, etc.) and the blockchain.info is honest. For this example, **I am concerned about the attack vector of the TOR exit node even while using HTTPS.**

**Tags:** security, blockchain.info, tor


---

## 3 answers

### Answer by username_1 on 2014-09-12. Score: 1

With Blockchain.info, only encrypted private keys are stored on their server. Decryption of private keys and signing is done in the browser. You don't even need to worry about sending your data over HTTPS, let alone TOR because any data that leaves your browser is securely encrypted before it even leaves your computer.

There's one caveat, however; it's difficult to determine whether or not Blockchain.info (or any site, really) is doing exactly what they claim unless you *constantly* monitor traffic between them and your browser. Ultimately, the most dangerous attack vector would be for Blockchain.info to behave dishonestly, or for a website to impersonate them and do the same.


---

### Answer by username_2 on 2014-06-14. Score: 0

Possible attack vectors from the exit node include:

* Exit node getting its hands on a valid SSL certificate recognised and trusted by the Tor Browser Bundle
* Exit node only returning http not https data so HTTPSEverywhere will not be able to connect via https so it falls back without encryption

> **Comments:**
> **username_3**: Note: HTTPS Everywhere does not fall back on http when unable to connect.  

---

### Answer by username_4 on 2014-03-15. Score: 0

Your Blockchain.info wallet is inherently safe due to the way wallets are generated by Blockchain. Blockchain.info only sends encrypted payloads to and from that are decryptable by the pass phrase you use.

Don't use the API if you don't want to rely on the SSL, which should be pretty strong if used properly but the standard web interface should be safe.


---

