Tor (short for The onion router) is a system intended to enable online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers in order to conceal a user's location or usage from anyone conducting network surveillance or traffic analysis.

learn more… | top users | synonyms

32
votes
6answers
19k views

Differences between using Tor browser and VPN

I can't quite figure out the differences between using the Tor browser and using a VPN (like concretely proXPN). From what I understand the idea is the same, that they both hide the IP address. The ...
94
votes
6answers
17k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
9
votes
4answers
8k views

How is Tor secure despite being open source?

If Tor is open source (and thus its process of concealing your IP is known), then how does it keep anything secure? Couldn't someone look at the source code and figure out how to reverse the routing ...
68
votes
2answers
15k views

Best practices for Tor use, in light of released NSA slides

It has been known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor ...
28
votes
3answers
6k views

Why can a Tor exit node decrypt data, but not the entry node?

Me -> Node A -> Node B -> Node C -> destination The documentation on Tor always states that only the exit node C can see plain text data. How is this possible without me talking to Node C ...
12
votes
8answers
9k views

How anonymous is my setup?

my friend and I are trying to make the most anonymous setup for a computer to do things across the internet without being known the location from which it came. Our setup is as follows: A windows ...
12
votes
3answers
9k views

Detecting Tor proxy by reading request headers

I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
10
votes
2answers
6k views

How safe is Tor from MITM/snooping attacks?

I am behind an HTTP proxy, and I frequently tunnel out via an ssh -D SOCKS proxy (I have access to a couple of outside servers which I can tunnel to) when the HTTP proxy causes problems1. Now, this ...
5
votes
1answer
336 views

About onion packet and onion routing?

I was just wondering if anyone has a diagram showing what is encrypted inside an onion packet when it leaves the sender? When a Tor client sends the packet out, wouldn't the entry onion node know ...
3
votes
2answers
431 views

Tor exit node can know my IP address?

I have read some articles about how Tor works. I know about layer by layer decryption, but there is something that I cannot understand: If the exit node is the one that does the last decryption and ...
3
votes
4answers
484 views

Is using Tor and VPN combination more secure?

I have been reading more about Tor and its risks to personal data leakage to the exit nodes in the chain. This last node can snatch encryption keys or log in information of websites I may have ...
105
votes
4answers
16k views

How would a resourceful government block Tor?

I came across this article saying that after the November 2015 Paris attacks, some French police officers proposed to ban Tor. Tor is used to circumvent censorship! What security techniques would ...
38
votes
2answers
8k views

Why hasn't anyone taken over Tor yet?

Tor is known to encrypt the transferred content and the meta information by layering the encryption. I know there have been correlation attacks that deanonymized some users by federal agencies. Why ...
11
votes
2answers
8k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
15
votes
4answers
13k views

Tor and regular browser side by side. Does that make sense?

Can I use a Tor browser session and a regular Firefox session side by side without corrupting the security of the Tor session? E.g. when I download a new Eclipse version or when I'm searching for ...
11
votes
1answer
3k views

How are tor hidden nodes/services found?

Tor has "hidden services", which have an address like duskgytldkxiuqc6.onion. Now I was wondering: how is this duskgytldkxiuqc6.onion name mapped to the real server? I don't think there's a central ...
12
votes
5answers
11k views

Why is Tor safer than a proxy?

If I use a Tor router to browse the regular internet, my traffic must leave the Tor network through an exit node. Apparently the exit node can see the data originally sent. Is this true? If an ...
8
votes
3answers
25k views

Downloading files using Tor

I have the Tor Browser Bundle installed and have been using the Firefox Tor browser. If I attempt to download a file or email attachment I get the following warning I understand that if I download ...
7
votes
3answers
361 views

In Tor, what stops the end server from following the breadcrumbs back to their origin?

This would probably require knocking on people's doors, but — couldn't the endpoint ask the exit node what the relay node was, and then ask the relay node what the entry node was, and then ask the ...
1
vote
1answer
891 views

“VPN -> Tor: Go to jail” - What's the logic behind this?

The VPN won't see anymore than your ISP already is. So even if the VPN was logging everything you did, shouldn't it just leave you in status quo? How can it ever compromise your identity, that you ...
2
votes
2answers
359 views

How to recognize TOR traffic

Having a PCAP file with TOR traffic, is there a way fast enough to recognize if any of the packets are part of TOR traffic/sessions? Some tools speak about "protocol identification via statistical ...
4
votes
3answers
11k views

Why is JavaScript disabled in the Tor Browser Bundle?

Didn't Tor create a local socks proxy? Why doesn't all the Web traffic go over this local socks proxy and why is JavaScript disabled in the Tor Browser bundle? If you would connect with firefox for ...
3
votes
3answers
902 views

Is it safe to access http sites from Tor?

Somewhere I read that you should only open HTTPS links on Tor because otherwise your ISP for example could read the webpages you visit. I searched on the subject and somewhere else I read that the ...
2
votes
3answers
537 views

Is there an anti-proxy detection available?

Sites like Wikipedia and Google (among others) don't let you sign up through a proxy or TOR (at least with Google, you have to provide SMS verification if you sign up through proxy.) Somehow they ...
35
votes
5answers
31k views

How do you get a specific .onion address for your hidden service?

.onion addresses normally should be made of a base32 string of the first 80 bits of the SHA1 hash of the private key of the server (see .onion address specification). Today I ran into a service which ...
8
votes
4answers
31k views

Advanced techniques for detecting a proxy/getting original IP

In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used: Firefox with a proxy ...
18
votes
1answer
2k views

Could someone explain parts of the FBI's Firefox 0-day?

Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown. http://pastebin.mozilla.org/2776374 The ...
30
votes
5answers
3k views

How does Tor protect against an attacker just running thousands of nodes?

Does Tor have any protection against an adversary simply running a very large number of nodes? Someone with the necessary resources could just run thousands of relay nodes (including exit nodes). If ...
34
votes
3answers
15k views

How does “check.torproject.org.” know if you're using TOR?

I'm looking at the results from the following URL and would like to know how does the TOR website "know" that TOR is being used or not. ...
20
votes
3answers
15k views

Can my workplace view my Tor traffic? [duplicate]

I connect to the internet using my company's Wi-Fi and Tor. Can they still see the websites I visit?
17
votes
3answers
4k views

TOR cracked: How do you think the FBI did it? [closed]

I read in this article that the FBI was able to crack the anonymity of TOR. From what I heard and read , onion routing makes it almost impossible to de-anonymize a user. The last time I heard anyone ...
12
votes
2answers
3k views

How does Tor protect against fake entry nodes / total redirection?

There is much material on how to protect yourself from malicous exit nodes, especially by using SSL and minimizing the leakage of identifying information (user-agent, screen size, etc.). However, I ...
3
votes
1answer
363 views

In depth TOR encryption design details

I am currently struggling with understanding the details of a connection in tor, mainly because I try to understand PCTCP. In this paper the authors claim that the changes are local to the onion ...
13
votes
3answers
3k views

Is the fact that Tor's development is largely government funded cause for concern?

In light of recent events, I've been learning more about Tor, and I have a lot of questions. Here's one. Wikipedia's article states; As of 2012, 80% of the Tor Project's $2M annual budget comes ...
8
votes
4answers
4k views

Why disable JavaScript in Tor? [duplicate]

Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
5
votes
2answers
310 views

How does Tor guarantee anonymity of Tor network?

To me it seems that the only thing Tor is doing for anonymity (not security!) is the fact that it does not record the traffic in and out, because obviously if every router was recording the traffic ...
5
votes
1answer
2k views

Can a malicious Tor exit node perform a HTTPS man-in-the-middle attack to see/modify your HTTPS traffic?

Let's say I am browsing the Internet using Tor - visiting https://example.com/login.php - and the NSA is operating the Tor exit node which I am currently routed to use. Can that NSA exit relay swap ...
4
votes
1answer
1k views

How much information can be sniffed at tor exit nodes

When someone is sniffing data at a Tor exit node, how much information can be obtained? The IP can be revealed, but can they see everything you do? Does it make a difference if it is encrypted using ...
4
votes
1answer
5k views

How can I get the IP address for a ToR Hidden Service (HSP) with a .onion address?

I'd like to find out the IP address of a given .onion address. Is it possible for me to simply assign an exit node (that I control) to my client and just monitor it to determine what IP address ...
3
votes
2answers
377 views

How to increase anonymity of TOR

I need some system to gain a high level anonymity - nobody should have the possibility to figure out my IP. I can use TOR, but I do not completely trust to it. So I have an idea for a system with high ...
3
votes
3answers
131 views

Does using DNSSEC in parallel with an anonymisation network decrease your privacy?

When using an anonymous communication network like Tor, to ensure privacy you must route your DNS traffic through the system even if your computer always uses DNSSEC for DNS lookups, would this be ...
3
votes
3answers
1k views

Attack on Tor with stolen private keys of main nodes

What could attacker do with stolen private keys of main nodes? Tor is based on 10 main nodes: moria1, tor26, dizum, Tonga, etc. IP Addresses of this nodes hard-coded into client. ./src/or/config.c: ...
3
votes
1answer
618 views

Encryption key exchange for Tor

I've been studying how Tor works - including the great QA "Why can a Tor exit node decrypt data, but not the entry node?". I understand the concept of onion routing and multiple layers of ...
1
vote
2answers
281 views

I'm wondering how I hide my identity online well [duplicate]

what are the different ways to become anonymous. Is quicksilver a good email for that? What are the different options? I know about proxies, Tor, and VPNs. Should I do all three? I like computers but ...
1
vote
1answer
1k views

VPN tunnel in VPN tunnel

I'm wondering if there is an easy way to establish VPN tunnels through other VPN tunnels to get onion routing like properties (sender anonymity). Since VPN builds a tunnel, it should be easy to set up ...
-1
votes
1answer
118 views

Blocking Tor By Trying to Connect to an Entry Node [closed]

So, I had an idea on how to block Tor (or similar tools) from being used on your network (or ISP, which is perhaps more relevant, considering Tor's mission). I'm assuming it wouldn't work (based on ...
-2
votes
1answer
471 views

how to use tor in linux kali with other applications

I want to know how to open applications as nmap and recon-ng through tor first I have kali linux v 1.0.9 and tor I tried using proxychains recon-ng but all I get is that the normal banner of ...
4
votes
1answer
371 views

Decrypting TOR traffic?

Is there any way to decrypt tor traffic from an exit node or relay? I know it's possible to analyze the traffic using something like tcpflow or tcpdump, but it comes back as encrypted giberish. Is ...
1
vote
1answer
184 views

Are darknets in the internet like Tor and i2p similar to darknets implemented for security like the CAIDA network telescope.?

I am planning to implement a darknet in an organizational network to work alongside SNORT to detect malicious scanning activities in the network like the CAIDA network telescope/Internet Motion ...
1
vote
1answer
2k views

Which is more secure - a VPN, a proxy-server, Tor, etc.? And why so, exactly? [closed]

I want to know how to ensure the most complete anonymity when browsing the internet and connecting to remote servers: I want to be as anonymous and secret as possible. I don't know exactly how VPNs ...