Using Facebook via Tor

Question

I think about using Tor for nearly everthing, including Facebook, because FB often tags the users even on other sites, for example per Like-Button, Cookies etc.

Now I think about using the Tor Browser to log in to FB, to use FB and then to use a new identity via Tor and to do other things.

My question is, how the Exit Nodes may sniff personal information (Cookies etc) that is transferred via FB. For example i read http://security.blogoverflow.com/2012/04/tor-exploiting-the-weakest-link/. There is described how Exit Nodes can do Session Hijaking (the Article is from 2012). Now I read somewhere else that now all traffic of FB is encrypted (since 2013).

Can an Exit node - theoretically - decrypt the Data that is sent via FB or can do a Man-in-the-Middle-Attack? I think if a MITM-Attack would be done, there would be a warning that the Certificate is not correct? Are there some other possible Attacks that the Exite Node could do - even if fb traffic is encrypted?

And, how secure is it to use other services, etc. for Example Chats or E-Mail (TorBirdy) via Tor (with SSL-Encryption)? Is this really that secure it is said to be?

Thank you

Answer 1

If I'm reading your question correctly, you'll be fine. You're still hooked up to Facebook via SSL, whose security isn't, at the moment, broken. Tor now includes HTTPS Everywhere, which would force Facebook to use SSL (assuming it was supported) even if it didn't do so by default (which, at the moment, it does). Since Firesheep (a bit later in 2010 than that post), which worked on a similar underlying principle (session hijacking by stealing a user's cookies), cookies are encrypted by SSL too. HTTPS Everywhere should even defend against SSLStrip most (some) of the time (Does HTTPS Everywhere defend me against sslsniff-like attacks?).