When someone is sniffing data at a Tor exit node, how much information can be obtained? The IP can be revealed, but can they see everything you do? Does it make a difference if it is encrypted using https, or if it is a hidden service link?
Every unencrypted thing that passes through that exit node can be seen, for as long as you use the node. That means plain
http, but it also means
IMAP email, telnet sessions, etc.
Things that cannot be seen: your IP address, the contents of anything going over
https or other encrypted protocols (but various side-channel attacks, such as monitoring packet sizes, are possible), or hidden service connections (those don't use an exit node).