3 ms·

How is malicious interference by exit nodes prevented for plaint-text HTTP requests?

• mrlala 6y ago
  I would have to say "it's not".. anything non-encrypted you risk being manipulated by a node of the TOR network. I bet there are people who act as relays just to try to sniff out any good non-HTTPS traffic.. although, I suppose generally anyone using TOR is mostly aware of this so there's probably not that much to gain. Complete side note.. but this just reminds me of back when I was in college in the late 90s, and our entire apartment buildings traffic was a hub (not a switch).. so I had a packet sniffer running for fun on linux and could see everything from everyones internet since every single packet was rounting to every machine on the network, and lots of stuff had no encryption... nuts to think how open stuff was back in the day.
  • justinclift 6y ago
    Pretty sure some switches (to this day) can be tricked into doing similar. eg send them a few specially crafted packets, and they fall back into broadcasting ~everything like a hub for some period of time. Not from the point of view of "legal intercept" stuff, more like "switch gets confused and doesn't know how to route, so broadcasts as a workaround".
• freemint 6y ago
  It can't be prevented on a technological level. However there are attempts to detect bad nodes and ban them. Since the exit node doesn't know "who" is accessing the website it can't just temper with your content. So it would be detected asymptomatically.
• alkyl 6y ago
  A subset of relay operators & other volunteers monitor the network for bad actors and report them to Tor Project who will then direct directory authority operators to blacklist those relays. One of those volunteers is nusenu: https://medium.com/@nusenu/the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548 https://medium.com/@nusenu/the-growing-problem-of-malicious-...