4 ms·

Isn’t Tor designed to ensure anonymity despite a snooping exit relay? I thought that even if you compromise an exit you can’t do much without compromising the i

Isn’t Tor designed to ensure anonymity despite a snooping exit relay? I thought that even if you compromise an exit you can’t do much without compromising the in-between relays.

bawolff 5y ago
Its designed so that a snooping exit node can't identify you, but it can see all traffic. Which is why you should generally only use https when using tor. The last leg may be snooped on so you need to use encryption during it. (http is fine with hidden services though) Its important to keep in mind that anonoyminity and data integrity are separate properties. You can have one without the others.
- windy_willow 5y ago
  Hmm, just trying to make sure then. If they can see all traffic would using a tool hide this in combination with Tor help?
  - bawolff 5y ago
    Using https would help. If you totally disable http (or only use http on .onion sites) the described attack won't work. Similarly, if the site in question enabled HSTS the attack would be prevented. Think of tor like the open wifi network of dubious origin at a black hat hacker convention. You are probably fine if using https, but plain http is a bad idea. Using a vpn is more questionable. Generally a paid vpn already knows who you are so hiding you origin ip with tor would be pointless. Also sometimes combining vpn technologies can cause traffic congestion algorithms to interact poorly and make things really slow, but that will depend on which technologies are in use.
Lammy 5y ago
Designed by the US Navy to ensure anonymity of US agents abroad from other countries via the DoD-birthed Internet, sure.
- nick__m 5y ago
  DARPA's also brought us the Total Information Awareness project. Those project ran concurrently and they had diametrically opposed goals. But it doesn't mean much as DARPA's seems to fund a lots of projects with seemingly opposite goals.
schoen 5y ago
My colleagues and I made a chart about this issue when I was working at EFF: https://www.eff.org/pages/tor-and-https https://www.eff.org/pages/tor-and-https

Isn’t Tor designed to ensure anonymity despite a snooping exit relay? I thought that even if you compromise an exit you can’t do much without compromising the in-between relays.

bawolff 5y ago

Its designed so that a snooping exit node can't identify you, but it can see all traffic. Which is why you should generally only use https when using tor. The last leg may be snooped on so you need to use encryption during it. (http is fine with hidden services though) Its important to keep in mind that anonoyminity and data integrity are separate properties. You can have one without the others.

windy_willow 5y ago
Hmm, just trying to make sure then. If they can see all traffic would using a tool hide this in combination with Tor help?
- bawolff 5y ago
  Using https would help. If you totally disable http (or only use http on .onion sites) the described attack won't work. Similarly, if the site in question enabled HSTS the attack would be prevented. Think of tor like the open wifi network of dubious origin at a black hat hacker convention. You are probably fine if using https, but plain http is a bad idea. Using a vpn is more questionable. Generally a paid vpn already knows who you are so hiding you origin ip with tor would be pointless. Also sometimes combining vpn technologies can cause traffic congestion algorithms to interact poorly and make things really slow, but that will depend on which technologies are in use.

Lammy 5y ago

nick__m 5y ago
DARPA's also brought us the Total Information Awareness project. Those project ran concurrently and they had diametrically opposed goals. But it doesn't mean much as DARPA's seems to fund a lots of projects with seemingly opposite goals.

schoen 5y ago

My colleagues and I made a chart about this issue when I was working at EFF: https://www.eff.org/pages/tor-and-https https://www.eff.org/pages/tor-and-https