When someone is sniffing data at a Tor exit node, how much information can be obtained? The IP can be revealed, but can they see everything you do? Does it make a difference if it is encrypted using https, or if it is a hidden service link?

  • Your IP will not be revealed (unless there are some javascript attacks - when surfing via Tor, you should use the noscript.net plugin, or equivalent.) Jul 1, 2014 at 6:42
  • Hey, I'm using tor on android(orweb browser using orbot plugin) Jul 1, 2014 at 8:09

1 Answer 1


Every unencrypted thing that passes through that exit node can be seen, for as long as you use the node. That means plain http, but it also means POP3, SMTP, and IMAP email, telnet sessions, etc.

Things that cannot be seen: your IP address, the contents of anything going over https or other encrypted protocols (but various side-channel attacks, such as monitoring packet sizes, are possible), or hidden service connections (those don't use an exit node).

  • @ Mark hey, so when you're using hidden services data can't be intercepted and decrypted by anyone? I mean even the guys like N.I.A? Jul 1, 2014 at 8:13
  • Be wary as HTTPS can also be sniffed, depending on how you reach the HTTPS page.
    – AlexH
    Jul 1, 2014 at 8:19
  • 1
    @Alex...How are HTTPS sniffed? And what about .onion links Jul 1, 2014 at 8:31
  • 2
    @RichmondWilliams, .onion links are encrypted end-to-end. Barring a three-letter agency finding a vulnerability in the encryption, only you and the .onion server know what you're talking about. On the other hand, the fact that you're talking isn't as secure: .onion servers are almost as vulnerable to confirmation attacks as the rest of TOR (it's a bit harder, since the first step requires finding the server).
    – Mark
    Jul 1, 2014 at 9:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .