When someone is sniffing data at a Tor exit node, how much information can be obtained? The IP can be revealed, but can they see everything you do? Does it make a difference if it is encrypted using https, or if it is a hidden service link?

  • Your IP will not be revealed (unless there are some javascript attacks - when surfing via Tor, you should use the noscript.net plugin, or equivalent.) – Dog eat cat world Jul 1 '14 at 6:42
  • Hey, I'm using tor on android(orweb browser using orbot plugin) – RichmondWilliams Jul 1 '14 at 8:09

Every unencrypted thing that passes through that exit node can be seen, for as long as you use the node. That means plain http, but it also means POP3, SMTP, and IMAP email, telnet sessions, etc.

Things that cannot be seen: your IP address, the contents of anything going over https or other encrypted protocols (but various side-channel attacks, such as monitoring packet sizes, are possible), or hidden service connections (those don't use an exit node).

  • @ Mark hey, so when you're using hidden services data can't be intercepted and decrypted by anyone? I mean even the guys like N.I.A? – RichmondWilliams Jul 1 '14 at 8:13
  • Be wary as HTTPS can also be sniffed, depending on how you reach the HTTPS page. – AlexH Jul 1 '14 at 8:19
  • 1
    @Alex...How are HTTPS sniffed? And what about .onion links – RichmondWilliams Jul 1 '14 at 8:31
  • 2
    @RichmondWilliams, .onion links are encrypted end-to-end. Barring a three-letter agency finding a vulnerability in the encryption, only you and the .onion server know what you're talking about. On the other hand, the fact that you're talking isn't as secure: .onion servers are almost as vulnerable to confirmation attacks as the rest of TOR (it's a bit harder, since the first step requires finding the server). – Mark Jul 1 '14 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.