Tor Exit Node Security & https website

Question

Sometimes I need to make multiple transactions on some websites which only allow 1 transaction per hour per IP address. So to avoid IP address problem I sometimes use Tor browser. I know Tor keeps us anonymous but what about our credit card or others details, can they be monitored on Tor exit node on websites which use HTTPS?

How secure is my transaction?

Correct me if I am wrong : I don't think VPN + Tor will help either because VPN will just avoid my ISP getting to know I am using Tor and my traffic will still be unencrypted at Tor Exit nodes.

Only VPN option was not considered because I have seen VPN to be slow (sometimes speed drops to zero) and have read that there are chances of IP leaking while using VPN, and in my case if IP address is leaked my transaction will fail.

I need a fast, secure and IP changing solution.

Answer 1

but what about our credit card or others details, can they be monitored on tor exit node on websites which use https ?

No, they cannot be monitored UNLESS the exit node is malicious and actively interferes with your traffic by performing various attacks. Notably:

• "downgrade" attack, by redirecting your https://example.com request to http://example.com. This is trivial to do, but also trivial to spot if you look at your address bar at all (and if the server is set correctly, .

• MitM attacks with self-signed certificates. This is also trivial to do, but also hard to miss because your browser would show a big warning about certificate not being trusted.

• MitM attacks with the valid certificates signed by a shady/government-controlled CA. This is generally only possible for state actors. You can protect against this by using certificate pinning.

• SSL protocol attacks. Generally also only useful for state actors; you can protect by using up-to-date browser and hope the server is up-to-date too.

So if everything looks right, and you're not dealing with state secrets, your transaction is most likely secure - although you're definitely taking larger risks using Tor (a chance an exit node is malicious is much higher than a chance your ISP or some other ISP in between is malicious).

VPN+Tor in combination "Tor over VPN" would work as you described.

The best solution for you would be to rent a number of servers across the globe, and run VPN software there. This way you're in full control of the speed. A cheaper, but worse, solution would be to use multiple commercial VPNs - the situation you describe with connection speed is typical for free VPNs.

Before going into details, please note that it is very easy for the website owner to block all transactions coming from Tor exit nodes, shall they decide so. So your solution might stop working anytime if the website really wants to block it.