Is a TOR router really safer than a proxy?

Question

If I use a tor router to browse the regular internet that it has to leave the TOR network through an exit node. Apparently the exit node has all the information from the original user it came from on the network that is unencrypted.

My question is:

1. Is this true?
2. If a government agency or a hacker wanted to figure out who I was, wouldn't they just have to subpoena the exit node owner or hack it?
3. Would a proxy then be about as safe as an exit node, since the same can go for it as well?

Answer 1

In Tor, the user (you) chooses a random path through several nodes for its data. The first node in the path knows your IP address, but not what you send or where. The last node ("exit node") knows the target server address and sees the data (unless SSL is used, of course), but not your IP address. Every node in the path knows only the addresses of the previous and the next nodes in the path.

If a government is intent on unraveling the privacy of Tor, then its best chance is to setup and operate a lot of nodes (which, of course, will not say "provided by your friendly government"). If your computer randomly chooses a path which begins by a government-controlled node and ends with another government-controlled node, then both nodes can correlate their data pretty easily and reveal both your IP and the target server (and sent data, if no SSL). Correlation is simple because while encryption hides the contents of data, it does not hide the length. If node A sees a 4138-byte request entering the Tor network from your IP, and node B sees a 4138-byte request within the next second exiting the Tor network and destined to server www.example.com, then node A and node B, by collating their data, will infer that your IP was involved with a communication to www.example.com.

It can easily be proven that if the hostile party does not eavesdrop on or hijack both the entry and exit nodes, then your privacy is maintained. But if they do, then privacy evaporates like a morning mist under the midday Sun.

Answer 2

1. Nope, the exit node can only decrypt the message and make the request, but he is not aware of where the original host is located, the only node that knows where the person is located is the second node. This is due to the layered encryption Tor uses. Every node only knows the next and previous hop, but not the whole path.
2. Nope because of 1
3. Nope because of 1

How Tor works is described in one of the blog posts on this very website:

http://security.blogoverflow.com/2012/04/tor-exploiting-the-weakest-link/

Answer 3

I would like to point you to this answer here on that describes in simple terms how Tor works.

The exit node has no idea where the data originates from, this is the entire point of Tor. The key to Tor is the multiple layers of encryption the data goes through as it travels through the Tor network.

Using a proxy on the other hand, involves a direct connection between your machine and the proxy server. Compromising a proxy can pretty quickly reveal who is connected to it.

Answer 4

Adding to other answers as well:

if a government agency or a hacker wanted to figure out who I was, wouldn't they just have to subpoena the exit node owner or hack it?

A government agency would probably find you, no kidding. In the end the traffic going out of the node can betray you. End service prodivers (Gmail, Facebook) cooperate with them and will give out accounts information based on the IP address. Simple.

Implying that if you don't follow best practices when using ToR, it may be useless. Also implying that if I have your gmail account details, I know who you are, and if the same source IP does something I suspect illegal, I have but a few people to investigate (those sharing the exit node's IP).

Answer 5

adding to the other answers

• Use of a proxy helps you hide your IP address and provides a certain level of anonymity but it does not make you untraceable. you can be tracked by using the logs generated by the proxy.
• A better approach would be to use a proxy switching tool that keeps on changing the proxy server through which your traffic is getting routed after fixed time intervals. one such tool is Proxy switcher
• This way you keep switching from one proxy to another around the world. Most of these proxies are up for a very small interval of time hence tracing becomes very difficult.
• There are websites like anonymizer.com and vtunnel.com which let you access blocked websites (blocked by your administrator or Chinese government ;) ) through a proxy.