Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I use a Tor router to browse the regular internet that it has to leave the Tor network through an exit node. Apparently the exit node has all the information from the original user it came from on the network that is unencrypted.

My question is:

  1. Is this true?
  2. If a government agency or a hacker wanted to figure out who I was, wouldn't they just have to subpoena the exit node owner or hack it?
  3. Would a proxy then be about as safe as an exit node, since the same can go for it as well?
share|improve this question
1  
It is quite likely that government agencies own many nodes making it therefore possible to trace you (if you use all or many of those controlled nodes in your path). But the exit node alone won't be enough (without additional data) as pointed out in the answers. –  Omar Kohl Feb 27 '13 at 11:11

5 Answers 5

up vote 15 down vote accepted

In Tor, the user (you) chooses a random path through several nodes for its data. The first node in the path knows your IP address, but not what you send or where. The last node ("exit node") knows the target server address and sees the data (unless SSL is used, of course), but not your IP address. Every node in the path knows only the addresses of the previous and the next nodes in the path.

If a government is intent on unraveling the privacy of Tor, then its best chance is to setup and operate a lot of nodes (which, of course, will not say "provided by your friendly government"). If your computer randomly chooses a path which begins by a government-controlled node and ends with another government-controlled node, then both nodes can correlate their data pretty easily and reveal both your IP and the target server (and sent data, if no SSL). Correlation is simple because while encryption hides the contents of data, it does not hide the length. If node A sees a 4138-byte request entering the Tor network from your IP, and node B sees a 4138-byte request within the next second exiting the Tor network and destined to server www.example.com, then node A and node B, by collating their data, will infer that your IP was involved with a communication to www.example.com.

It can easily be proven that if the hostile party does not eavesdrop on or hijack both the entry and exit nodes, then your privacy is maintained. But if they do, then privacy evaporates like a morning mist under the midday Sun.

share|improve this answer

adding to the other answers

  • Use of a proxy helps you hide your IP address and provides a certain level of anonymity but it does not make you untraceable. you can be tracked by using the logs generated by the proxy.
  • A better approach would be to use a proxy switching tool that keeps on changing the proxy server through which your traffic is getting routed after fixed time intervals. one such tool is Proxy switcher
  • This way you keep switching from one proxy to another around the world. Most of these proxies are up for a very small interval of time hence tracing becomes very difficult.
  • There are websites like anonymizer.com and vtunnel.com which let you access blocked websites (blocked by your administrator or Chinese government ;) ) through a proxy.
share|improve this answer

Adding to other answers as well:

if a government agency or a hacker wanted to figure out who I was, wouldn't they just have to subpoena the exit node owner or hack it?

A government agency would probably find you, no kidding. In the end the traffic going out of the node can betray you. End service prodivers (Gmail, Facebook) cooperate with them and will give out accounts information based on the IP address. Simple.

Implying that if you don't follow best practices when using ToR, it may be useless. Also implying that if I have your gmail account details, I know who you are, and if the same source IP does something I suspect illegal, I have but a few people to investigate (those sharing the exit node's IP).

share|improve this answer
    
This is simply not true, service providers will have no access to your real IP, so they can't give it out. Of course, you can still be stupid enough to share your real name and location to those service providers yourself, or you can login with your real IP, in that case they can forward it if they want. –  Dorus Feb 27 '13 at 13:53
  1. Nope, the exit node can only decrypt the message and make the request, but he is not aware of where the original host is located, the only node that knows where the person is located is the second node. This is due to the layered encryption Tor uses. Every node only knows the next and previous hop, but not the whole path.
  2. Nope because of 1
  3. Nope because of 1

How Tor works is described in one of the blog posts on this very website:

http://security.blogoverflow.com/2012/04/tor-exploiting-the-weakest-link/

share|improve this answer
2  
You should not forget that many users proxy unencrypted connections (e.g. SMTP and POP3) through the TOR network. Even if the exit node does not know the source IP of the connection, the traffic content often contains hints to reliably identify the source, e.g. usernames and passwords. –  jarnbjo Feb 27 '13 at 14:03
    
What do you think I explain in that blogpost ;) –  Lucas Kauffman Feb 27 '13 at 14:06
5  
That sort of attack has gone beyond just the proof of concept level. Back in 07 a security researcher set up 5 exit nodes and intercepted data from multiple embassies and fortune 500 companies: securityfocus.com/news/11486 –  Dan Neely Feb 27 '13 at 14:41

I would like to point you to this answer here on that describes in simple terms how Tor works.

The exit node has no idea where the data originates from, this is the entire point of Tor. The key to Tor is the multiple layers of encryption the data goes through as it travels through the Tor network.

Using a proxy on the other hand, involves a direct connection between your machine and the proxy server. Compromising a proxy can pretty quickly reveal who is connected to it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.