If Tor is able to hide the IP address of the machine and make us anonymous, then does it prevent the ISP from tracking us?


You cannot hide how much data you are sending and when you are online. But, Tor encrypts data and sends it through proxies before it reaches the target server, so that hides the contents of the communication and to which website or server you are talking. You can also try to hide that you are using Tor, but this is difficult and a determined ISP will be able to determine that you are using Tor.

The first proxy will decrypt the outer layer of encryption and send it on to a middle proxy. The middle proxy does the same and sends it onto the final proxy. The final proxy finally decrypts your original request, so be aware that they can see the contents of what you are sending and to which website or server it is being sent. But they don't know that it came from you.

Note that, while the final proxy can see the contents, if you use "https" then the contents are still encrypted. I would not do internet banking over Tor unless you know very well what you should be checking (IDN homoglyph attacks, the certificate, perhaps other things), but generally speaking: https encrypts your communication. They can still see which website you are talking to, though, since contents encryption does not hide routing information (the page request, form data, etc. still needs to get to the right website).

See also the top hit on duckduckgo for "tor isp tracking": Does my ISP know what sites I have visited if I am using Tor?

  • I would add that the server certificate is sent in cleartext - even if it is cryptographically signed - so the final node (a.k.a exit note) will know which website is accessed in HTTPS (but not the content itself) – John Kravicz Feb 3 at 13:11
  • @JohnKravicz Good point, it's kind of covered by that "they can see [...] and to which website or server it is being sent" but I could be more clear in that paragraph about https because encryption does not hide routing information. Will update, thanks. – Luc Feb 3 at 13:19
  • @Luc Thanks for this clarification. Finally, the ISP only knows we are using tor. Other details can not be got by ISP. Is it the final conclusion – RCvaram Feb 3 at 13:43
  • @JohnKravicz: for TLS1.3 (now 20% of top 150k per qualys) the cert is encrypted, and even below that many sites are on shared hosting or CDN where the cert has 10s or 100s of unrelated names. OTOH SNI contains the exact hostname (except for HTTP2) in clear, except in 1.3 if both endpoints implement ESNI which is still fairly rare -- and requires an extra, host-specific DNS request (which is clear unless you use e.g. DoH). – dave_thompson_085 Feb 4 at 3:08
  • @dave_thompson_085 "for TLS1.3 (now 20% of top 150k per qualys) the cert is encrypted" I know you qualify it later but leading with that stat is a bit misleading. Taking a random website with TLS1.3 (my own), I totally see the hostname in plain text in the network traffic. Screenshot: lgms.nl/files/TLS1.3SNI.png (103K, PNG) – Luc Feb 4 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.