Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

HTTPS is an end-to-end encrypted connection. Given this, does the website I am visiting know my original IP? The website is only available over HTTPS (not unencrypted HTTP).

share|improve this question
1  
On the contrary: When you use TOR it is even more important to use HTTPS, because otherwise the exit node can eavesdrop on your traffic in clear-text. –  Philipp Jan 16 at 12:02
    
Consider also that it is possible for a server to know your IP even when using TOR i.e: using javascript to gather it. That's the reason for TorBrowser desabling javascript by default. It is highly important to know what you are doing and to set up your applications correctly. –  kiBytes Jan 16 at 13:47
2  
@professorTuring TorBrowser doesn't disable Javascript by default. –  ike Jan 16 at 15:01
2  
@Philipp no proof here, but you could intercept the Cerificate anyway and send a new fake one. Users always click 'accept certificate' anyway ;) –  Stolas Jan 16 at 15:19
1  
@professorTuring That is a vulnerability in the browser, not a capability of the javascript environment. Conceptually, browser vulns are not dependent on javascript, although this one was in particular. The only way to avoid that risk entirely is to not use software at all. –  bonsaiviking Jan 16 at 19:48
show 3 more comments

8 Answers

up vote 30 down vote accepted

No, it won't.

The thing is that when you use HTTPs over TOR you:

  1. you use the public key of the server to encipher your message (so nobody except the server will be able to read your message).
  2. then you pass the HTTPs message (which, remember, is encrypted with the public key of the server) to a TOR node,
  3. this TOR node to another, and another and...
  4. finally, the last TOR node will send your encrypted HTTPs message to the server (that includes your key for the session); the response is encrypted by the server with this key and you will be the only one to be able to decrypt the response from the server.1

So the graph should be as follow:

---> "Tor message"  
===> "HTTPs message"
[T]  "Tor Node"
[S]  "Server"
[U]  "User"

[U]-->[T1]-->[T2]-->[T3]-->...[TN]==>[S]  
[S]==>[TN]-->...[T3]-->[T2]-->[T1]-->[U]

And yet still your communication will be secret.

If you want to learn a bit more about how your connection is secret you can learn about the key exchange in this page.

share|improve this answer
    
The confusing terminology "HTTPS connection" is still conflating a TCP connection and an SSL or TLS session. Please use the precise terminology. –  Ben Voigt Jan 16 at 18:09
1  
Point #1 is also incorrect. The asymmetric keys are not used for encryption of data, only during negotiation of the session symmetric key. –  Ben Voigt Jan 16 at 18:10
2  
@BenVoigt Yes you are right, but I believe that going deeper into the SSL algorithm will make the response less human readable. But feel free to "improve the answer" if you feel like there is still something missing. (Also, I missed that "HTTPs connection", sorry). –  kiBytes Jan 16 at 18:13
add comment

No the website does not know your real IP address. This is the point of using TOR. If you have an account on that website and log in they will know it's you, but they will not know your real IP address.

When you use tor, you're passing through relays. These relays encrypt all the communications between them see below:

enter image description here

With HTTPS traffic it goes like this as explained by professorTuring

---> "Tor Connection"  
===> "HTTPs Connection"
[T]  "Tor Node"
[S]  "Server"
[U]  "User"

[U]-->[T1]-->[T2]-->[T3]-->...[TN]==>[S]  
[S]==>[TN]-->...[T3]-->[T2]-->[T1]-->[U]

More information about tor here

share|improve this answer
5  
The image is valid for a HTTP connection and it may lead to an error if someone reads it. Since it is the most voted, I believe you should edit it and change it to show the real scenario the OP is asking for. Also, you should add some comment about "why" his connection is still secret when passing through all the Tor nodes. Without these corrections I would vote it downwards since this response could be misleading. –  kiBytes Jan 16 at 11:54
    
Thank you for your advice but the question was answered, so why would you vote down ? The image is there just to illustrate the way tor works in general. If you like I'll use your little schema to represent it with https usage –  Boogy Jan 16 at 12:06
1  
@Boogy: It did not sufficiently answer the question, which argues that HTTPS, being end-to-end/user-to-service, could prevent Tor from performing magic to mask your IP. The answer is that the Tor magic doesn't work this way, and the secure connection here is not really user-to-service. –  Lightness Races in Orbit Jan 16 at 15:39
add comment

Aside from everyone else's answer, there is another, more simple reason. IP happens at layer 3 (IP layer) whereas SSL happens at layer 6 (session layer). So the SSL encrypted part of our packet is encapsulated by the IP layer, meaning that your IP address itself does not get encrypted by SSL (unless of course your application has a built in function to send along the IP).

Tor actually strips IP headers and does changes them along the route (because every node only knows the previous and next hop).

share|improve this answer
add comment

As others have answered, Tor itself won't deliver your IP address to the web server. However, that does not mean an eavesdropper can't figure something out. Recently there was a case of a student who used the Tor network to send a bomb threat to his school. During the time the threat was sent, the school examined their network logs and discovered that only a very few computers in the school were connected to Tor. All of them were eliminated but one, and when interviewed, the owner of that computer confessed.

share|improve this answer
1  
This doesn't really answer the question. It's definitely good advice, and addresses the same concern that prompted the question, but it doesn't explain anything about the question itself. –  Bobson Jan 16 at 16:47
1  
That is a so-called correlation attack. –  ntoskrnl Jan 16 at 17:17
    
@Bobson, I agree that it's not a direct answer, but it's the answer to the underlying question of "is my anonymity secure with Tor?" The answer to that is "it depends". –  John Deters Jan 16 at 21:17
add comment

HTTPS is an end-to-end encrypted connection

That is true, but it in the Tor model the actual TCP connection is not "end-to-end" in this sense.

The way I have interpreted your question is that you imagine an [unsecured] HTTP session to be protected by Tor by rewriting packets in order to hide your IP. If true, the introduction of SSL to the mix would render Tor unable to read, let alone rewrite your packets.

However the key here is that this is not how Tor works. In the Tor model, responsibility for the connection is left to the final Tor device in the chain; the SSL session still begins on your computer, so you're still secured end-to-end, but there is no need for any "rewriting" to take place anyway, so there is nothing lost by applying SSL to the payloads.

share|improve this answer
1  
I think it's the term "HTTPS connection" that's causing confusion. There is no such thing. An HTTPS transfer consists of a TCP connection and SSL session layered on top. The SSL session is end-to-end, the TCP connection (which results in IP leakage) is not. professorTuring's answer suffers from the same problem. –  Ben Voigt Jan 16 at 17:21
add comment

OK, I have nothing to add that will actually answer your question per se, but I would like to add WHY in a bit more detail. HTTPS is a mathematical process relying on concepts that make it so that a client and a server can work out a key without ever "talking" to each other beforehand - even if an attacker is listening.

HOW SSL WORKS (THE SHORT VERSION): To be concise as to how it actually works, the server generates one number such that it is a factor of two other numbers, and then the client uses that number to operate on his number such that it would be extremely difficult to find his number without knowing the factors generated by the server. Thus, the client is able to send "his number" (the key used for the remainder of the session) without an eavesdropper knowing it.

HOW TOR WORKS: Tor basically uses a cryptography process not too terribly unlike SSL as regards the mathematical procedure described above to share a separate key with each "node" your packet will travel through. Let us say the packet will go through 4 nodes. Node 1 gets key a, node 2 gets key b, etc. You generate x, the packet you want to send. Tor now calculates this: a(2, b(3, c(4, d(x))). 2, 3, and 4 are the address' of the next node. You sent this to node 1, which can decrypt only a. It sees node 2's address and sends it there. Node two can only decrypt... well, you get the point. Before you send all of this, your IP and so on are "stripped" from x, and when 4 sends x to the server, it adds its IP and so on.

WHAT THIS MEANS: The only way HTTPS would stop Tor from "spoofing" your IP would be if a new protocol was added to it so that your IP was put in another layer (especially one that got encrypted by the SSL already). Your IP would be stripped from one layer but potentially read from another.

share|improve this answer
add comment

TOR is a project handled by Nonprofit organization to develop online privacy and anonymity. TOR makes it difficult for anyone to trace internet activity of a user which includes site visit, online post, messages or other forms of communication done by user on web. Main motive of this project is to prevent user’s privacy as well as provide freedom and ability to conduct confidential business activities from their computer without taking any tension of hacking/spam.

So, while using TOR your IP address will not be exposed to HTTPS server.

Take a look how you can check what is visible to eavesdroppers (hackers/spammers) when you use TOR on HTTPS server:

  • Click “TOR Button” to see the data that is visible to eavesdroppers. (Color of the button should be green)
  • Click on “HTTPS Button” to see the data that is visible to eavesdroppers when you access HTTPS site. (Color of the button should be green)
  • When both the buttons are green you can see the data that is visible to any third party monitoring your internet activity.
  • Now turn off these buttons and when color of the button changes to grey, take a look at the data which is visible to eavesdroppers when you don’t use TOR.

This process will indicate the amount of privacy provided by this application to its user. A spammer will never know the exact IP/details of user and hence your data is safe. It works like a scrape prevention service for most of the regular/business users. Services like ScrapeSentry, ScrapeDefender, Distil Networks provide spam prevention to the site owners (webmasters) while services like TOR provide safety to user’s privacy from evil hands.

share|improve this answer
add comment

HTTPS is an encryption protocol. It is used to encrypt content -- make it unreadable except to the person receiving it. It only hides your message content, not your IP address.

The TOR network is used to hide your IP address, and you can use either HTTP or HTTPS over it, and it will hide your IP address ... theoretically. As another answer stated, your IP address can be deduced.

The main vulnerability of the TOR system is the man-in-the-middle approach. Since anyone can add a server to the TOR network, it's in law enforcement's best interest to put their own servers in the network, and attack the encryption of the data that goes through their computers. Plus they get the IPs of the computers that connect to them, and the ones they're directed to connect to. Depending on whose servers your request and response go through, and the amount of interest in discovering you, your IP can still be discovered.

Finally, HTTPS security is questionable right now, because of rumors of a backdoor RSA was paid to put into their algorithms.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.