1

Sometimes I need to make multiple transactions on some websites which only allow 1 transaction per hour per IP address. So to avoid IP address problem I sometimes use TOR browser. I know tor keeps us anonymous but what about our credit card or others details, can they be monitored on tor exit node on websites which use https ?

How secure is my transaction ?

Correct me if i am wrong : I don't think VPN + Tor will help either because VPN will just avoid my ISP getting to know I am using TOR & my traffic will still be unencrypted at Tor Exit nodes.

Only VPN option was not considered because I have seen VPN to be slow (sometimes speed drops to zero) and have read that there are chances of IP leaking while using VPN, & in my case if IP address is leaked my transaction will fail.

I need a fast, secure & IP changing solution.

  • What type of website limits you to just one transaction per hour? – Chris Huang-Leaver Jan 4 '17 at 6:21
5

but what about our credit card or others details, can they be monitored on tor exit node on websites which use https ?

No, they cannot be monitored UNLESS the exit node is malicious and actively interferes with your traffic by performing various attacks. Notably:

  • "downgrade" attack, by redirecting your https://example.com request to http://example.com. This is trivial to do, but also trivial to spot if you look at your address bar at all (and if the server is set correctly, .

  • MitM attacks with self-signed certificates. This is also trivial to do, but also hard to miss because your browser would show a big warning about certificate not being trusted.

  • MitM attacks with the valid certificates signed by a shady/government-controlled CA. This is generally only possible for state actors. You can protect against this by using certificate pinning.

  • SSL protocol attacks. Generally also only useful for state actors; you can protect by using up-to-date browser and hope the server is up-to-date too.

So if everything looks right, and you're not dealing with state secrets, your transaction is most likely secure - although you're definitely taking larger risks using Tor (a chance an exit node is malicious is much higher than a chance your ISP or some other ISP in between is malicious).

VPN+Tor in combination "Tor over VPN" would work as you described.

The best solution for you would be to rent a number of servers across the globe, and run VPN software there. This way you're in full control of the speed. A cheaper, but worse, solution would be to use multiple commercial VPNs - the situation you describe with connection speed is typical for free VPNs.

Before going into details, please note that it is very easy for the website owner to block all transactions coming from Tor exit nodes, shall they decide so. So your solution might stop working anytime if the website really wants to block it.

  • Thank you. I have AWS account with active servers... I will try to run VPN software & check the results... By VPN software you mean OpenVPN ? – Surendra Patil Jan 4 '17 at 3:48
  • 1
    OpenVPN is one of them, but there are many alternatives. If you use your own scripts or a browser which supports SOCKS5, you can even use something like ssh tunnel (however in this case the server might be able to find out your real IP) – George Y. Jan 4 '17 at 3:52
  • Keep in mind that the "downgrade" attack and self-signed cert. you describe are prevented by HSTS. – L3n Nov 14 '17 at 19:11
  • 1
    @L3n Tor Browser necessarily has to clear the HSTS cache on restart in order to reduce fingerprintability (as you can fingerprint a user by seeing if a given site is in the HSTS cache by timing the connection with JS), which limits its security, especially for short-lived browser sessions. Tor Browser does have the HTTPS Everywhere extension though, which helps for many popular sites. – forest Jan 2 '18 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.