In which ways can my ISP, who by the way controls the WiFi router I connect to, do a MITM attack on my TOR connections and hence read the traffic?

  • Tor uses a PK hierarchy with the root key hardcoded into the software to prevent MITM. See this answer for more details.
    – Tgr
    Commented Dec 14, 2017 at 0:02

4 Answers 4


They can not read your traffic, because the communication between you and the entry node is already encrypted.

  • 1
    Upvoted, but I just thought I'd add - they can see that you are using Tor (unless you take steps to prevent it, eg. using a tor 'bridge'). Don't know if this is relevant to the OP, but for some use cases it can be.
    – randomdude
    Commented Jul 15, 2015 at 17:26
  • That seems to miss the point of the question. If there is a MITM attack, the entry node is owned by the attacker.
    – Tgr
    Commented Dec 13, 2017 at 23:58

Tor was written to be secure even when connecting through an insecure network. Since they're giving you Internet access they can obviously read all your traffic, but unless they have exploits no one knows about or managed to utilize the known ones they won't be able to decrypt your traffic.


Tor communication is encrypted and designed to look like normal HTTPS which makes detection almost impossible. Communication between Tor's exit nodes and the Clearnet is not different from normal traffic which also makes it prone to MITM attacks.

Tor ensures total anonymity on entry points, but exit nodes could run various opensource applications like SSLstrip to defeat SSL and intercept / change traffic.


Your ISP could hypothetically perform a MITM (SSL strip) attack and see what you send the first hop, however they will not be able to see the second hop or be able to see or inject into the third.

Tor works in layers. Each layer is a separate TLS connection.

You  |  GuardN     RelayN       ExitN     Dest
  • GuardN only sees you and RelayN.
  • RelayN will only see Entry and GuardN.
  • ExitN (Exit Node) is the only node that can see your destination traffic, so as long as your using httpseverywhere your almost fine. The destination traffic will be hidden as long as the exit node is not running sslstrip. Note: bad nodes do exist, so you should still use other mechanisms like OTR.

Just because you use Tor doesn't mean you can forget about your personal Opsec. Tor has a specific threat model, don't use it if it does not match yours.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .