HTTPS Everywhere and Tor

Question

I don't see an option to install the HTTPS Everywhere add-on on the Tor Browser. Is the HTTPS not needed on the Tor Browser?
Does Tor encrypt one's data like the HTTPS Everywhere add-on? I'm new to safe browsing (have read FAQs and other information, but not understanding a much of it at the moment).
Suggestions and direction are appreciated. Thank you.

Answer 1

HTTPS Everywhere is already included in Tor Browser. Its button is next to the Firefox menu button.

Is the HTTPS not needed on the Tor Browser?

It is recommended to always use HTTPS whenever possible over Tor, except on .onion sites.

Browsing over HTTP over Tor could actually be dangerous, as there is a higher risk of man-in-the-middle (MITM) attacks. These could come from either the exit node or anyone who is able to tamper with the connection after that.

Most dangerous of these would be javascript exploits, which would target possible unpatched vulnerabilities in Firefox. This is why you should have your Tor Browser on at least the medium (on untrusted sites, high) security setting using Torbutton, which disables javascript being used over HTTP connections, or set HTTPS Everywhere to block unencrypted connections while you don't need to use them.

If you send any data to a site over HTTP, it can be captured.

Does Tor encrypt one's data like the HTTPS Everywhere add-on?

No, the connection is still the same as would be used without Tor. Tor cannot force sites to use encryption or encrypt connections once they come out of the Tor network.

Answer 2

Is the HTTPS not needed on the Tor Browser?

HTTPS Everywhere is included by default in Tor Browser

Does Tor encrypt one's data like the HTTPS Everywhere add-on?

Neither of these tools encrypt the application data.

HTTPS Everywhere has a set of policies for websites that ensure that for those websites it will use HTTPS where possible. It will still result in data being sent in plaintext in cases where either the website doesn't support HTTPS or it does not have a policy defined.

Tor encrypts your data when it's inside the Tor network. If the traffic exits the Tor network then the final layer of encryption is removed by the exit relay. If the data sent into the Tor network (e.g. your HTTP request) isn't encrypted then the data that leaves the Tor network won't be encrypted.