If I visit a HTTPS website when using Tor, is my IP exposed?

Question

HTTPS is an end-to-end encrypted connection. Given this, does the website I am visiting know my original IP? The website is only available over HTTPS (not unencrypted HTTP).

Answer 1

No, it won't.

The thing is that when you use HTTPs over TOR you:

1. you use the public key of the server to encipher your message (so nobody except the server will be able to read your message).
2. then you pass the HTTPs message (which, remember, is encrypted with the public key of the server) to a TOR node,
3. this TOR node to another, and another and...
4. finally, the last TOR node will send your encrypted HTTPs message to the server (that includes your key for the session); the response is encrypted by the server with this key and you will be the only one to be able to decrypt the response from the server.1

So the graph should be as follow:

---> "Tor message"  
===> "HTTPs message"
[T]  "Tor Node"
[S]  "Server"
[U]  "User"

[U]-->[T1]-->[T2]-->[T3]-->...[TN]==>[S]  
[S]==>[TN]-->...[T3]-->[T2]-->[T1]-->[U]

And yet still your communication will be secret.

If you want to learn a bit more about how your connection is secret you can learn about the key exchange in this page.

Answer 2

No the website does not know your real IP address. This is the point of using TOR. If you have an account on that website and log in they will know it's you, but they will not know your real IP address.

When you use tor, you're passing through relays. These relays encrypt all the communications between them see below:

With HTTPS traffic it goes like this as explained by professorTuring

---> "Tor Connection"  
===> "HTTPs Connection"
[T]  "Tor Node"
[S]  "Server"
[U]  "User"

[U]-->[T1]-->[T2]-->[T3]-->...[TN]==>[S]  
[S]==>[TN]-->...[T3]-->[T2]-->[T1]-->[U]

More information about tor here

Answer 3

Aside from everyone else's answer, there is another, more simple reason. IP happens at layer 3 (IP layer) whereas SSL happens at layer 6 (session layer). So the SSL encrypted part of our packet is encapsulated by the IP layer, meaning that your IP address itself does not get encrypted by SSL (unless of course your application has a built in function to send along the IP).

Tor actually strips IP headers and does changes them along the route (because every node only knows the previous and next hop).

Answer 4

HTTPS is an end-to-end encrypted connection

That is true, but it in the Tor model the actual TCP connection is not "end-to-end" in this sense.

The way I have interpreted your question is that you imagine an [unsecured] HTTP session to be protected by Tor by rewriting packets in order to hide your IP. If true, the introduction of SSL to the mix would render Tor unable to read, let alone rewrite your packets.

However the key here is that this is not how Tor works. In the Tor model, responsibility for the connection is left to the final Tor device in the chain; the SSL session still begins on your computer, so you're still secured end-to-end, but there is no need for any "rewriting" to take place anyway, so there is nothing lost by applying SSL to the payloads.

Answer 5

As others have answered, Tor itself won't deliver your IP address to the web server. However, that does not mean an eavesdropper can't figure something out. Recently there was a case of a student who used the Tor network to send a bomb threat to his school. During the time the threat was sent, the school examined their network logs and discovered that only a very few computers in the school were connected to Tor. All of them were eliminated but one, and when interviewed, the owner of that computer confessed.

Answer 6

OK, I have nothing to add that will actually answer your question per se, but I would like to add WHY in a bit more detail. HTTPS is a mathematical process relying on concepts that make it so that a client and a server can work out a key without ever "talking" to each other beforehand - even if an attacker is listening.

HOW SSL WORKS (THE SHORT VERSION): To be concise as to how it actually works, the server generates one number such that it is a factor of two other numbers, and then the client uses that number to operate on his number such that it would be extremely difficult to find his number without knowing the factors generated by the server. Thus, the client is able to send "his number" (the key used for the remainder of the session) without an eavesdropper knowing it.

HOW TOR WORKS: Tor basically uses a cryptography process not too terribly unlike SSL as regards the mathematical procedure described above to share a separate key with each "node" your packet will travel through. Let us say the packet will go through 4 nodes. Node 1 gets key a, node 2 gets key b, etc. You generate x, the packet you want to send. Tor now calculates this: a(2, b(3, c(4, d(x))). 2, 3, and 4 are the address' of the next node. You sent this to node 1, which can decrypt only a. It sees node 2's address and sends it there. Node two can only decrypt... well, you get the point. Before you send all of this, your IP and so on are "stripped" from x, and when 4 sends x to the server, it adds its IP and so on.

WHAT THIS MEANS: The only way HTTPS would stop Tor from "spoofing" your IP would be if a new protocol was added to it so that your IP was put in another layer (especially one that got encrypted by the SSL already). Your IP would be stripped from one layer but potentially read from another.

Answer 7

TOR is a project handled by Nonprofit organization to develop online privacy and anonymity. TOR makes it difficult for anyone to trace internet activity of a user which includes site visit, online post, messages or other forms of communication done by user on web. Main motive of this project is to prevent user’s privacy as well as provide freedom and ability to conduct confidential business activities from their computer without taking any tension of hacking/spam.

So, while using TOR your IP address will not be exposed to HTTPS server.

Take a look how you can check what is visible to eavesdroppers (hackers/spammers) when you use TOR on HTTPS server:

• Click “TOR Button” to see the data that is visible to eavesdroppers. (Color of the button should be green)
• Click on “HTTPS Button” to see the data that is visible to eavesdroppers when you access HTTPS site. (Color of the button should be green)
• When both the buttons are green you can see the data that is visible to any third party monitoring your internet activity.
• Now turn off these buttons and when color of the button changes to grey, take a look at the data which is visible to eavesdroppers when you don’t use TOR.

This process will indicate the amount of privacy provided by this application to its user. A spammer will never know the exact IP/details of user and hence your data is safe. It works like a scrape prevention service for most of the regular/business users. Services like ScrapeSentry, ScrapeDefender, Distil Networks provide spam prevention to the site owners (webmasters) while services like TOR provide safety to user’s privacy from evil hands.

Answer 8

HTTPS is an encryption protocol. It is used to encrypt content -- make it unreadable except to the person receiving it. It only hides your message content, not your IP address.

The TOR network is used to hide your IP address, and you can use either HTTP or HTTPS over it, and it will hide your IP address ... theoretically. As another answer stated, your IP address can be deduced.

The main vulnerability of the TOR system is the man-in-the-middle approach. Since anyone can add a server to the TOR network, it's in law enforcement's best interest to put their own servers in the network, and attack the encryption of the data that goes through their computers. Plus they get the IPs of the computers that connect to them, and the ones they're directed to connect to. Depending on whose servers your request and response go through, and the amount of interest in discovering you, your IP can still be discovered.

Finally, HTTPS security is questionable right now, because of rumors of a backdoor RSA was paid to put into their algorithms.