Questions tagged [tor]

Tor (short for The onion router) is a system intended to enable online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers in order to conceal a user's location or usage from anyone conducting network surveillance or traffic analysis. For non-security questions about Tor, see our sister site Tor Stack Exchange.

Filter by
Sorted by
Tagged with
0 votes
1 answer
93 views

Alternative for secure browsing since Tor is too slow

What options for secure browsing are available these days? I always used Tor, but since the DDOS attack, even simple sites like google.com need almost 2 minutes to load. By "secure browsing" ...
16 votes
1 answer
8k views

What is this potential identity leak that NoScript warns about?

Recently, while using the Tor Browser, NoScript popped up the following warning when I opened a stack overflow link in a new tab from duckduckgo: Potential Identity Leak You are about to load a page ...
  • 11.3k
2 votes
1 answer
101 views

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted? If not then is there any way to visit a malicious ...
1 vote
1 answer
117 views

Is Anonymized DNSCrypt over Tor a better alternative to having Doh+ECH?

I use dnscrypt-proxy's anonymized DNScrypt with multiple relays, force it all to use TCP, route them over Tor. Does this prevent my ISP or anyone in my country to see my DNS queries and client hellos ...
user avatar
1 vote
1 answer
45 views

Passing traffic from a script through proxy / tor network [closed]

I am applying for a job that involves creating unit tests and end to end tests for a website. Right now, i am assigned with a task, in order to test my skills. However, my country has blocked access ...
-2 votes
2 answers
247 views

Why do people claim Tails is more secure than Windows?

Why do some people say that using Tor within my normal operating system will not be safe? What differentiates Windows and Tails in this regard? I believe that running Windows together with a VM, VPN ...
-1 votes
1 answer
124 views

Steganographically hide encrypted packets for VPN, Tor, etc?

We all know about different encryption methods used today in secured connections like VPN, Tor, etc. However, there is an issue with usage of those. Even if the outsider can not decrypt the message, ...
0 votes
0 answers
232 views

How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?

How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is Sqlmap uploading it and is the file just a normal reverse shell trojan? Also, is it still anonymous when ...
6 votes
2 answers
216 views

What's the advantage of connecting to an onion address over a regular domain through Tor?

Many websites offer both standard domains that you can access through any browser and onion addresses only accessible via Tor. I wonder what is the privacy advantage (if any) for the end user when ...
  • 221
0 votes
2 answers
106 views

Can my ISP know that I am using Tor if I am connecting to Tor via an SSH SOCKS5 proxy?

I created an SSH SOCKS tunnel that forwards connections from a local port to a remote server: ssh -N -D 127.0.0.1:1234 me@example.com (i.e. all connections to 127.0.0.1:1234 get forwarded to the ...
  • 593
1 vote
1 answer
261 views

How secure and anonymous is the --tor parameter in Sqlmap?

How secure and anonymous is the --tor parameter in Sqlmap? Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
1 vote
0 answers
71 views

How does Tor's second node know the key to decrypt the second layer?

I was watching this video explaining how tor works: https://youtu.be/QRYzre4bf7I It explains it with the example of 3 intermediate nodes between client and server. It says that each of the nodes can ...
1 vote
1 answer
79 views

MITM in Tor: Authentication when an Entry node is sending data back to the Client

Diagram: Server -> Exit Node -> Middle Node -> Entry Node -> Client In Entry Node -> Client, how does the entry node authenticate that the receiver is a real client but not a MITM?
1 vote
1 answer
184 views

How insecure are self-signed certificates? Why does Tor still use them?

How insecure are self-signed certificates? Why does Tor still use them?
1 vote
1 answer
73 views

Android- ads in applications are in local language even when using proxy

I have noticed some weird behavior on my smartphone that I can't explain myself. I'm using Orbot application as proxy to route all of the phone's internet traffic through the Tor network. When I ...
1 vote
1 answer
92 views

Tor: How does entry nodes communicate with middle nodes? How does middle nodes communicate with exit nodes?

In Tor, when a client communicates with an entry node, they exchange the parameters such as the prime number and the generator with each other through DH. What about when an entry node communicating ...
1 vote
2 answers
512 views

Can Tor bridges really prevent ISPs from knowing the fact that you are using Tor?

Using Tor bridges for censorship circumvention routes your traffic to a bridge before an entry node. If the IP of the bridge is constant, isn't it abnormal that you are always connecting to the same ...
1 vote
2 answers
103 views

Which type of Diffie-Hellman does Tor use?

Does Tor use Ephemeral DH, Static DH or Anonymous DH? I have heard that the latter two are not secure so I am worried if Tor uses them.
-1 votes
2 answers
259 views

How would routing DDoS attacks over Tor increase effectiveness?

In recent days, stackexchange has been hit by a series of DDoS attacks , leading to the blocking of Tor exit nodes. I'm curious how a DDoS attack would be more effective when routed over Tor. From ...
2 votes
2 answers
152 views

Before Tor, VPNs and proxy services, how did cybercrimals remain anonymous?

I have read that they used previously breached machines, but to try to gain access to those machines they also needed some kind of protection right? How did they do it then?
  • 21
0 votes
0 answers
60 views

Anonymity setup criticism

My current setup up is for pseudonymous communication on a smartphone. I need help to know if I am doing anything wrong. GrapheneOS all traffic over tor using (orbot) using Signal with anonymous ...
1 vote
1 answer
97 views

Why don't the security problems with torrenting over tor, at least partly apply to VPNs as well?

So understand that torrenting over tor isn't generally a good idea, mainly because the speeds aren't high and it strains the network. Also that it doesn't support UDP. But if we look at the old paper ...
1 vote
0 answers
98 views

VPS for Tor & I2P - which other services can I safely run on same?

I'm toying with the idea of setting-up a Tor node (middle/guard) and an I2P node on the same VPS. I think that should be safe(ish)... But I'm wondering what other services I could run without it/them ...
0 votes
0 answers
78 views

Allow for login through Tor while preventing brute force/distributed password attacks?

I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via Tor. One of the approaches to ...
1 vote
1 answer
169 views

If Tor does Diffie-Hellman with each node how do they all not know the sender

I'm a bit confused by something regarding Tor. As per what I have read and confirmed in this answer Tor: Is a Diffie-Hellman key exchange being done over recipient of traffic? the client does a DH key ...
1 vote
1 answer
120 views

Are there any known SSH (protocol or implementation) vulnerabilities which can be performed on a tor hidden service?

The last couple of weeks I have been researching possible attacks that can be performed on a Tor hidden service using SSH from a location different from that of the server, assuming the .onion address ...
0 votes
0 answers
125 views

Using compromised tor bridge

If a malicious user creates a tor bridge, does that compromise the entire connection? I don't think so, because I thought they have to control both the entry and exit nodes. However, my friend is ...
  • 1
2 votes
1 answer
166 views

Does using IP address over Tor with a one essential website expose me to any attack surface?

I routinely access www.email-provider-of-my-choice.com via browser over Tor. My browser enforces https-only mode and I opt for never saving my credentials with this provider. I tend to use the domain ...
0 votes
1 answer
154 views

Tor relay access

I want to do a project on onion routing for my school graduation test. I want to show how onion routing could be compromised if the end and start relay within the network are both accessible by a ...
2 votes
1 answer
330 views

What is extra 3 relays in .onion in Tor connection

When I visit any website in Tor browser and if I see the diagram of the circuit that Tor Browser is using for the current tab in the site information menu in the URL bar, it shows 3 relays: Guard, ...
  • 33
1 vote
2 answers
558 views

How is Tor's exit node safe?

If I use Tor over VPN (User -> VPN -> Tor -> Destination), then VPN first encrypts my data and hides my original IP address, and then it goes to Tor's Entry Node. So that Tor's Entry Node can'...
  • 33
0 votes
2 answers
845 views

Any known SSH attacks/vulnerabilities other than brute force, dictionary attacks and compromising keys?

I am looking for attacks over Tor that can be applied to a server running SSH. I have been looking at SSH.com, IEEE papers, SpringerLink papers/books, etc. but so far I have only found that the ...
0 votes
0 answers
24 views

How client and server exchanges keys over Tor network using HTTPS? [duplicate]

When someone uses a browser to connect to https://google.com via Tor network, the client needs to exchange a key with Google in order to keep all the data hidden from the exit node, right? Otherwise, ...
-1 votes
1 answer
102 views

tor traffic routing within tor network

I understand there is entry node, middle node and exit node when a user accesses an internet resource like https://www.google.com while coeected to the tor network. Is the concept the same if the user,...
  • 101
2 votes
1 answer
490 views

Difference between Tor over VPN and VPN over Tor

I saw many posts here saying that Tor over VPN is different from VPN over Tor, and one is better than other, but I was unable to find any explanation over it. There were some speculations that you ...
2 votes
1 answer
117 views

Onion Routing Network: Analyzing the size of the encrypted message to determine distance along a circuit

I am teaching Anonymous Networks in a Cybersecurity class. I am understanding (what I think) is a good deal about the process TORproject uses for its network by using this as a guide. https://skerritt....
3 votes
1 answer
332 views

Is using email (protonmail with Tor Browser / obfs4 bridges) to contact embassy in potentially hostile foreign countries safe?

Suppose one wants to use email (say using protonmail with Tor Browser / obfs4 bridges) to discuss sensitive matters (such as asylum seeking / embassy protection) with embassy in potentially hostile ...
-1 votes
1 answer
153 views

IP hiding attempts are detected [closed]

So I am using Tor and I try to log into a certain web site. It gives me a message saying that my IP address was used for spamming and does not let me log in. I think ok, probably the exit node is ...
0 votes
2 answers
154 views

How are data breach lists sourced and distributed?

I understand at an elementary level how data breaches tend to be distributed, starting with friends of the attacker/discoverer and then being distributed via forums, paste bins, etc. However I was ...
2 votes
1 answer
205 views

Tor for confidentiality on corporate network

I work in gov organization and recently I learned they set up a MITM, by installing some certificates - so when I visit any web site and then check the certificate info it shows the certificate ...
0 votes
1 answer
285 views

Anonymous video uploading on an internet host

How much video uploading could be trackable for some person who uses the Tor Browser for uploading video on YouTube or other video hosting services with low authorization and sign-up processing, like ...
2 votes
0 answers
341 views

How to harden portable Tor Browser installation (SELinux, sandbox)?

tldr How can I define a SELinux policy, that limits filesystem access of portable Tor Browser to its installation directory, say /home/user/.local/opt/tor-browser_en-US? How might Tor Browser be ...
  • 21
0 votes
1 answer
213 views

Torrent sites on the onion network being served over http

I've noticed that torrent websites like the Pirate Bay are served over http. This means that when using a network like the Tor onion network, where the first server in the response chain receives the ...
0 votes
1 answer
506 views

is metasploit under whonix anonymous?

If I run an exploit like EternalBlue with Metasploit on whonix to a remote machine, do I remain anonymous? I think I do because it goes over tor but I am not sure. Am I right?
1 vote
1 answer
222 views

Is saving a dark web page locally and reloading it in another browser a security risk?

Say I have Tor running and am browsing the dark web with the Tor browser. If I were to save a local copy of a web page and render it into another browser, like Chrome (with JS enabled), would I then ...
  • 13
-2 votes
2 answers
379 views

Is Tor Private/Secure?

I have had Tor for a bit, I do not use it that often. But I am wondering if anyone knows if it is secure. How safe are onion connections?
0 votes
0 answers
186 views

Can Tor browser protect me from being found out? [duplicate]

I am using my computer, but am connected to my work's WiFi. Can my company see what websites I visit when am using Tor browser?
  • 1
0 votes
3 answers
609 views

What’s the point in using proxychains for an nmap scan when you could use Tor?

I always hear on YouTube and other places on the internet that Tor is the best option to stay anonymous. Tor is used by many activists, journalists etc. hiding from oppressive governments and so on. ...
0 votes
1 answer
140 views

Person tried to login in my website with non-existent username, but not a VPN nor Tor

I am managing a WordPress website. I have installed the plugin "Limit Login Attempts Reloaded". This plugin sent me an email saying that A.B.C.D has tried to login with the non-existent ...
2 votes
1 answer
135 views

Timeless timing attacks and response jitter

I've been researching timeless timing attacks, ie: timing attacks using concurrency rather than round trip time. Here is an article by portswigger with links to the original article by Van Goethem. ...
  • 123

1
2 3 4 5
11