Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [tor]

Tor (short for The onion router) is a system intended to enable online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers in order to conceal a user's location or usage from anyone conducting network surveillance or traffic analysis. For non-security questions about Tor, see our sister site Tor Stack Exchange.

Filter by
Sorted by
Tagged with
1 vote
4 answers
132 views

How do you rate limit bruteforce attempts on a Tor hidden service?

I'm considering the feasibility of a .onion domain for my website to cater to privacy conscious users. Actions that occur before there's a known UserID (eg. login page) need to have a bounded number ...
anthonyryan1's user avatar
0 votes
0 answers
98 views

These two pgp public keys are the same but different?

I'm doing some research on .onion websites and was trying to verify an onion URL. I got a public key from two different sources: side by side they are identical until about ten lines before the end. ...
pilks7's user avatar
  • 1
0 votes
0 answers
66 views

Deploying a site with zero-knowledge?

Any methodologies of secret or private dev-ops as a service? The use-case I was thinking of is for example, a productized service like on Fiverr, eg. Seller will deploy your site onto TOR network and ...
Reed Jones's user avatar
0 votes
1 answer
137 views

Is exposing a bind shell to tor dangerous?

I have a bind shell written in python: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.bind(("127.0.0.1", "710")) s.listen(1) conn, addr = s.accept() print(f"[*] ...
johnrollins's user avatar
0 votes
2 answers
326 views

Any tool that can prevent ISP from knowing which websites we visit? beside tor?

Any tool that can prevent ISP from knowing which websites we visit? beside tor? while https can help, but still ISP knows which domains/websites we visit. There is no way around it? Also believe that ...
Maxfield's user avatar
  • 149
0 votes
0 answers
155 views

Impact of Deep Learning Based Flow Correlation on Tor

It's been known ever since Tor existed that flow correlation attacks can break Tor's anonymity, but whereas in the past flow correlation attacks had a false positive rate far too high to be useful ...
DeepPSNA's user avatar
0 votes
2 answers
434 views

What is the difference between a VPN and a Tor Socks proxy on public wifi?

I seek protection against MITM & snooping of VPN or Tor proxy traffic on public WiFi. So, what are the different security impacts of each of these 2 solutions: Using a VPN (like Proton VPN) to ...
John's user avatar
  • 1
17 votes
2 answers
7k views

Is Tor over VPN a security risk?

In his talk about OPSEC, The Grugq stresses that you first have to go through TOR before connecting to a VPN. Otherwise, the VPN would be a direct link from the endpoint to you. He summarizes: TOR ...
Arbuiwer's user avatar
  • 171
3 votes
0 answers
123 views

Can botnets/malicious traffic be effectively reduced on my exit nodes?

I host a small collection of TOR exit nodes to the clear net. Believe it or not, the number one complaint I get in my inbox is not due to illegal materials coming through the nodes (of which I have ...
tuskiomi's user avatar
  • 192
8 votes
1 answer
194 views

Anonymity in initial Key exchange in onion routing

Maybe I will be wrong, please correct me and at the same time answer my question. I know the keys are exchanged between client and Tor relays through circuit extension requests (other than first relay)...
user10433098's user avatar
2 votes
1 answer
217 views

Do VPNs log and analyze OCSP requests?

I am a privacy-conscious user currently living in Russia where the Internet is censored and monitored by the Russian state. Russian ISPs are legally required to log and store all users’ Internet ...
Gilgamesh's user avatar
1 vote
0 answers
880 views

What are the risks of running SSH over Tor?

Goal The intention is to set up an SSH entrance which is more secure (or at least more obfuscated) than a default setup with Port Forwarding or VPN. Previous research and context TL;DR, see question ...
Saul Goodman's user avatar
0 votes
1 answer
163 views

Does the first node in the circuit connecting the hidden service to the introduction point know the server's IP address?

I am doing research about the dark web. However I find it hard to understand how Tor hidden services work. The whole point of it is to actually anonymize the server from the client so that the client ...
Potatoe's user avatar
0 votes
0 answers
115 views

Can WebASM provide JavaScript style interactivity without the same vulnerabilities?

JavaScript is useful for interactivity. However, it is often disabled by security conscious browsers, such as the Tor Browser Bundle, and blocked with plugins such as NoScript. I was wondering if it ...
user5623335's user avatar
0 votes
1 answer
227 views

Is a tor packet readily identifiable?

if an exit node decides to trace back a Tor message to its source, will it be able to identify the same packet at the middle node, and from then identify the same packet at the entry node? assuming ...
Dhari's user avatar
  • 101
1 vote
0 answers
573 views

How does a website know if i've visited it before? (and how to bypass that) [closed]

For example: https://pdfcandy.com/pdf-ocr.html has a limit on how many times I can use a feature per hour, but if I use an incognito tab I can easily bypass that. But with https://ichigoreader.com/...
Kamisama's user avatar
0 votes
0 answers
185 views

Requests to malicious IP being sent by background process on Windows

Whenever an internet connection is established on my pc, I am repeatedly getting warnings from QuickHeal like this: I am getting such warnings repeatedly with different IP addresses. In the above ...
DevRish's user avatar
1 vote
1 answer
361 views

What does a domain seizure entail?

For context, I have limited knowledge pertaining to computer networks, and the recent seizure of z-library brought up some questions I am unsure of, and I can't seem to find much information online. ...
Andrei Paraschiv's user avatar
2 votes
2 answers
209 views

Tor: is a relay cell's header also onion-encrypted?

I am puzzled by the question if not only the data, but also the header of a relay cell in Tor is onion-encrypted. I understand that when an OR receives an outbound relay cell and peels off one layer ...
meerkat_person's user avatar
0 votes
1 answer
374 views

Alternative for secure browsing since Tor is too slow

What options for secure browsing are available these days? I always used Tor, but since the DDOS attack, even simple sites like google.com need almost 2 minutes to load. By "secure browsing" ...
JoeRogaan's user avatar
18 votes
1 answer
20k views

What is this potential identity leak that NoScript warns about?

Recently, while using the Tor Browser, NoScript popped up the following warning when I opened a stack overflow link in a new tab from duckduckgo: Potential Identity Leak You are about to load a page ...
nobody's user avatar
  • 11.6k
2 votes
3 answers
799 views

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted? If not then is there any way to visit a malicious ...
User4857's user avatar
1 vote
1 answer
1k views

Is Anonymized DNSCrypt over Tor a better alternative to having Doh+ECH?

I use dnscrypt-proxy's anonymized DNScrypt with multiple relays, force it all to use TCP, route them over Tor. Does this prevent my ISP or anyone in my country to see my DNS queries and client hellos ...
user avatar
1 vote
1 answer
344 views

Passing traffic from a script through proxy / tor network [closed]

I am applying for a job that involves creating unit tests and end to end tests for a website. Right now, i am assigned with a task, in order to test my skills. However, my country has blocked access ...
user1584421's user avatar
-2 votes
2 answers
1k views

Why do people claim Tails is more secure than Windows?

Why do some people say that using Tor within my normal operating system will not be safe? What differentiates Windows and Tails in this regard? I believe that running Windows together with a VM, VPN ...
Jordin928's user avatar
-1 votes
1 answer
246 views

Steganographically hide encrypted packets for VPN, Tor, etc?

We all know about different encryption methods used today in secured connections like VPN, Tor, etc. However, there is an issue with usage of those. Even if the outsider can not decrypt the message, ...
user184868's user avatar
0 votes
0 answers
1k views

How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?

How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is Sqlmap uploading it and is the file just a normal reverse shell trojan? Also, is it still anonymous when ...
UndercoverDog's user avatar
6 votes
2 answers
547 views

What's the advantage of connecting to an onion address over a regular domain through Tor?

Many websites offer both standard domains that you can access through any browser and onion addresses only accessible via Tor. I wonder what is the privacy advantage (if any) for the end user when ...
user avatar
0 votes
2 answers
378 views

Can my ISP know that I am using Tor if I am connecting to Tor via an SSH SOCKS5 proxy?

I created an SSH SOCKS tunnel that forwards connections from a local port to a remote server: ssh -N -D 127.0.0.1:1234 [email protected] (i.e. all connections to 127.0.0.1:1234 get forwarded to the ...
Flux's user avatar
  • 913
1 vote
1 answer
2k views

How secure and anonymous is the --tor parameter in Sqlmap?

How secure and anonymous is the --tor parameter in Sqlmap? Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
UndercoverDog's user avatar
1 vote
0 answers
153 views

How does Tor's second node know the key to decrypt the second layer?

I was watching this video explaining how tor works: https://youtu.be/QRYzre4bf7I It explains it with the example of 3 intermediate nodes between client and server. It says that each of the nodes can ...
RenatoRenatoRenato's user avatar
1 vote
1 answer
170 views

MITM in Tor: Authentication when an Entry node is sending data back to the Client

Diagram: Server -> Exit Node -> Middle Node -> Entry Node -> Client In Entry Node -> Client, how does the entry node authenticate that the receiver is a real client but not a MITM?
Gaai Chia's user avatar
1 vote
1 answer
711 views

How insecure are self-signed certificates? Why does Tor still use them?

How insecure are self-signed certificates? Why does Tor still use them?
Gaai Chia's user avatar
1 vote
1 answer
131 views

Android- ads in applications are in local language even when using proxy

I have noticed some weird behavior on my smartphone that I can't explain myself. I'm using Orbot application as proxy to route all of the phone's internet traffic through the Tor network. When I ...
notjohny1912's user avatar
1 vote
1 answer
331 views

Tor: How does entry nodes communicate with middle nodes? How does middle nodes communicate with exit nodes?

In Tor, when a client communicates with an entry node, they exchange the parameters such as the prime number and the generator with each other through DH. What about when an entry node communicating ...
Gaai Chia's user avatar
1 vote
2 answers
2k views

Can Tor bridges really prevent ISPs from knowing the fact that you are using Tor?

Using Tor bridges for censorship circumvention routes your traffic to a bridge before an entry node. If the IP of the bridge is constant, isn't it abnormal that you are always connecting to the same ...
Gaai Chia's user avatar
1 vote
2 answers
218 views

Which type of Diffie-Hellman does Tor use?

Does Tor use Ephemeral DH, Static DH or Anonymous DH? I have heard that the latter two are not secure so I am worried if Tor uses them.
Gaai Chia's user avatar
-1 votes
2 answers
367 views

How would routing DDoS attacks over Tor increase effectiveness?

In recent days, stackexchange has been hit by a series of DDoS attacks , leading to the blocking of Tor exit nodes. I'm curious how a DDoS attack would be more effective when routed over Tor. From ...
dcom-launch's user avatar
2 votes
2 answers
244 views

Before Tor, VPNs and proxy services, how did cybercrimals remain anonymous?

I have read that they used previously breached machines, but to try to gain access to those machines they also needed some kind of protection right? How did they do it then?
Camilo's user avatar
  • 121
0 votes
0 answers
112 views

Anonymity setup criticism

My current setup up is for pseudonymous communication on a smartphone. I need help to know if I am doing anything wrong. GrapheneOS all traffic over tor using (orbot) using Signal with anonymous ...
rkohjkoe5554ew3's user avatar
1 vote
1 answer
171 views

Why don't the security problems with torrenting over tor, at least partly apply to VPNs as well?

So understand that torrenting over tor isn't generally a good idea, mainly because the speeds aren't high and it strains the network. Also that it doesn't support UDP. But if we look at the old paper ...
UserNotHere411's user avatar
1 vote
0 answers
247 views

VPS for Tor & I2P - which other services can I safely run on same?

I'm toying with the idea of setting-up a Tor node (middle/guard) and an I2P node on the same VPS. I think that should be safe(ish)... But I'm wondering what other services I could run without it/them ...
Baard Kopperud's user avatar
0 votes
0 answers
174 views

Allow for login through Tor while preventing brute force/distributed password attacks?

I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via Tor. One of the approaches to ...
johnnyApplePRNG's user avatar
1 vote
1 answer
310 views

If Tor does Diffie-Hellman with each node how do they all not know the sender

I'm a bit confused by something regarding Tor. As per what I have read and confirmed in this answer Tor: Is a Diffie-Hellman key exchange being done over recipient of traffic? the client does a DH key ...
Chris Owen's user avatar
1 vote
1 answer
335 views

Are there any known SSH (protocol or implementation) vulnerabilities which can be performed on a tor hidden service?

The last couple of weeks I have been researching possible attacks that can be performed on a Tor hidden service using SSH from a location different from that of the server, assuming the .onion address ...
Baldovín Cadena Mejía's user avatar
0 votes
0 answers
261 views

Using compromised tor bridge

If a malicious user creates a tor bridge, does that compromise the entire connection? I don't think so, because I thought they have to control both the entry and exit nodes. However, my friend is ...
ninaxg's user avatar
  • 1
2 votes
1 answer
244 views

Does using IP address over Tor with a one essential website expose me to any attack surface?

I routinely access www.email-provider-of-my-choice.com via browser over Tor. My browser enforces https-only mode and I opt for never saving my credentials with this provider. I tend to use the domain ...
John Smith's user avatar
0 votes
1 answer
238 views

Tor relay access

I want to do a project on onion routing for my school graduation test. I want to show how onion routing could be compromised if the end and start relay within the network are both accessible by a ...
mantissa's user avatar
3 votes
1 answer
1k views

What is extra 3 relays in .onion in Tor connection

When I visit any website in Tor browser and if I see the diagram of the circuit that Tor Browser is using for the current tab in the site information menu in the URL bar, it shows 3 relays: Guard, ...
Sann's user avatar
  • 43
1 vote
2 answers
2k views

How is Tor's exit node safe?

If I use Tor over VPN (User -> VPN -> Tor -> Destination), then VPN first encrypts my data and hides my original IP address, and then it goes to Tor's Entry Node. So that Tor's Entry Node can'...
Sann's user avatar
  • 43

1
2 3 4 5
11