0

I suppose to those of you with technical expertise in this matter this question might seem obvious, so apologies as I am know nothing of this topic. Also what data would be possibly visible by someone potentially monitoring my connection to such a server?

0

1 Answer 1

0

No, your IP address will not be visible to the website, just the IP of the exit node.

The implication of the unencrypted connection is that your communications with the site can be monitored by the exit node. This could mean stealing credentials, or attempting to fingerprint you via other possibly identifying information (headers, screen resolution, font support, etc.).

They can also manipulate the traffic if they wish to, for example to deliver malware.

6
  • So speaking in tech dummy terms: this means that whoever is managing the exit node might decide to use my data for their purposes, but apart from the exist node no one else would be able to access the data right (of course assuming the exit node does not provide it to others)? So how large a security risk does this exactly constitute in your opinion? Hypothetically speaking while putting my imaginary tin foil hat on, does this make it possible for the government or other organizations to see your data specifically. I know a cliche question.
    – Finviel
    Commented Jan 29, 2016 at 0:00
  • @Finviel Governments do run their own TOR exit nodes and could monitor unencrypted streams. That's why encryption is still very important when you use TOR. But, that's not what your main question asks. Your main question was about tracing the IP, which is a completely different topic.
    – schroeder
    Commented Jan 29, 2016 at 0:10
  • any unencrypted data sent through TOR could be read
    – schroeder
    Commented Jan 29, 2016 at 0:12
  • The intermediary Tor nodes can't view the unencrypted traffic because of the nested "onion" structure where one layer of encryption is removed after each hop. However, if the target site isn't using TLS then your data is visible to the exit node. Additionally, you really have no idea what the target site's data storage policies are, so if you're really paranoid, use end to end encryption with self-generated keys. Of course, that's only an option if your target is able to handle it.
    – user8405
    Commented Jan 29, 2016 at 2:38
  • Also the entire network connection from the exit node to the target server is susceptible to attack because SSL isn't being used. Commented Jan 29, 2016 at 3:35

Not the answer you're looking for? Browse other questions tagged .