Questions tagged [tor]
Tor (short for The onion router) is a system intended to enable online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers in order to conceal a user's location or usage from anyone conducting network surveillance or traffic analysis. For non-security questions about Tor, see our sister site Tor Stack Exchange.
82
questions
71
votes
6
answers
60k
views
Differences between using Tor browser and VPN
I can't quite figure out the differences between using the Tor browser and using a VPN (like concretely proXPN). From what I understand the idea is the same, that they both hide the IP address. The ...
- 3,861
123
votes
5
answers
28k
views
How much can I trust Tor?
How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress.
I am a political activist from India and I do not enjoy the freedom of ...
- 1,265
84
votes
2
answers
41k
views
Best practices for Tor use, in light of released NSA slides
It has been known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor ...
- 3,003
14
votes
3
answers
70k
views
Downloading files using Tor
I have the Tor Browser Bundle installed and have been using the Firefox Tor browser. If I attempt to download a file or email attachment I get the following warning
I understand that if I download an ...
user28946
25
votes
3
answers
63k
views
Can my workplace view my Tor traffic?
I connect to the internet using my company's Wi-Fi and Tor. Can they still see the websites I visit?
- 361
24
votes
6
answers
20k
views
Why is Tor safer than a proxy?
If I use a Tor router to browse the regular internet, my traffic must leave the Tor network through an exit node. Apparently the exit node can see the data originally sent.
Is this true?
If an ...
- 908
14
votes
3
answers
45k
views
Is it safe to access HTTP sites from Tor?
Somewhere I read that you should only open HTTPS links on Tor because otherwise your ISP for example could read the webpages you visit.
I searched on the subject and somewhere else I read that the ...
- 279
6
votes
3
answers
7k
views
Can ISP use MITM attack to "break" encrypted traffic?
Use connection of A and B as an example.
Their communications were encrypted by Public Key Encryption.
Before they exchange their public key, ISP MITM attacked.
A got "B"'s public key (ISP generated)
...
user52979
19
votes
3
answers
25k
views
How did the FBI compromise Tor users? [closed]
I read in this article that the FBI was able to crack the anonymity of Tor.
From what I heard and read, onion routing makes it almost impossible to de-anonymize a user.
The last time I heard anyone ...
- 411
17
votes
3
answers
16k
views
How safe is Tor from MITM/snooping attacks?
I am behind an HTTP proxy, and I frequently tunnel out via an ssh -D SOCKS proxy (I have access to a couple of outside servers which I can tunnel to) when the HTTP proxy causes problems1.
Now, this ...
- 8,267
9
votes
4
answers
13k
views
How is Tor secure despite being open source?
If Tor is open source (and thus its process of concealing your IP is known), then how does it keep anything secure? Couldn't someone look at the source code and figure out how to reverse the routing ...
- 109
8
votes
2
answers
10k
views
Tor exit node can know my IP address?
I have read some articles about how Tor works. I know about layer by layer decryption, but there is something that I cannot understand:
If the exit node is the one that does the last decryption and ...
- 189
6
votes
4
answers
7k
views
Is using Tor and VPN combination more secure?
I have been reading more about Tor and its risks to personal data leakage to the exit nodes in the chain. This last node can snatch encryption keys or log in information of websites I may have ...
- 67
2
votes
2
answers
13k
views
How do traffic correlation attacks against Tor users work?
I was reading about how Tor works. There is says that if the attacker is able to see both ends of the communication channel then Tor fails (and other anonymous networks too).
How and why does this ...
- 381
47
votes
7
answers
7k
views
How does Tor protect against an attacker just running thousands of nodes?
Does Tor have any protection against an adversary simply running a very large number of nodes?
Someone with the necessary resources could just run thousands of relay nodes (including exit nodes). If ...
- 941
12
votes
8
answers
13k
views
How anonymous is my setup?
my friend and I are trying to make the most anonymous setup for a computer to do things across the internet without being known the location from which it came.
Our setup is as follows:
A windows ...
- 908
6
votes
3
answers
22k
views
Why is JavaScript disabled in the Tor Browser Bundle?
Didn't Tor create a local socks proxy? Why doesn't all the Web traffic go over this local socks proxy and why is JavaScript disabled in the Tor Browser bundle?
If you would connect with firefox for ...
- 63
5
votes
1
answer
2k
views
About onion packet and onion routing?
I was just wondering if anyone has a diagram showing what is encrypted inside an onion packet when it leaves the sender?
When a Tor client sends the packet out, wouldn't the entry onion node know ...
- 65
5
votes
2
answers
2k
views
How does Tor protect against MITM attacks between the client and relay nodes?
According to robertheaton.com:
When a Tor client constructs a circuit, it negotiates TLS sessions with each of the nodes it has chosen for its circuit using the nodes’ TLS certificates and public ...
- 181
4
votes
2
answers
3k
views
Tor traffic correlation attacks by global adversaries
I recently came across a paper called "Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries" (Aaron Johnson et al) ... which seems to be saying that adversaries (like the NSA) that ...
117
votes
4
answers
22k
views
How would a resourceful government block Tor?
I came across this article saying that after the November 2015 Paris attacks, some French police officers proposed to ban Tor.
Tor is used to circumvent censorship! What security techniques would ...
- 1,133
41
votes
2
answers
9k
views
Why hasn't anyone taken over Tor yet?
Tor is known to encrypt the transferred content and the meta information by layering the encryption.
I know there have been correlation attacks that deanonymized some users by federal agencies.
Why ...
- 585
34
votes
3
answers
12k
views
Why can a Tor exit node decrypt data, but not the entry node?
Me -> Node A -> Node B -> Node C -> destination
The documentation on Tor always states that only the exit node C can see plain text data. How is this possible without me talking to Node C ...
- 607
14
votes
2
answers
5k
views
How does Tor protect against fake entry nodes / total redirection?
There is much material on how to protect yourself from malicious exit nodes, especially by using SSL and minimizing the leakage of identifying information (user-agent, screen size, etc.).
However, I ...
- 941
13
votes
2
answers
9k
views
Why is it so hard to close onion domains (e.g. The Silkroad)?
A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor)
For those who do not know what Tor is and who do not want to waste their time ...
- 1,765
13
votes
2
answers
25k
views
Is using VPN, Tor and ProxyChains together more secure?
Similar question (Tor and VPN only).
All these three technologies seem to share the same goal, i.e. making internet traffic anonymous. Does it make any sense to try to use them together to increase ...
- 231
11
votes
4
answers
40k
views
Advanced techniques for detecting a proxy/getting original IP
In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used:
Firefox with a proxy ...
- 211
11
votes
3
answers
62k
views
Why disable JavaScript in Tor? [duplicate]
Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
- 133
10
votes
2
answers
17k
views
Is chaining multiple VPNs a good way to reach anonymity on the internet?
I would like to chain a couple, say 6 or 7, VPNs together to create a sort of "super" encrypted lane on the internet. I'm not too concerned about speeds, all I want is privacy and anonymity.
I've ...
- 253
9
votes
1
answer
22k
views
How can I get the IP address for a Tor Hidden Service (HS) with a .onion address?
I'd like to find out the IP address of a given .onion address.
Is it possible for me to simply assign an exit node (that I control) to my client and just monitor it to determine what IP address ...
- 50.7k
7
votes
1
answer
6k
views
Can a malicious Tor exit node perform a HTTPS man-in-the-middle attack to see/modify your HTTPS traffic?
Let's say I am browsing the Internet using Tor - visiting https://example.com/login.php - and the NSA is operating the Tor exit node which I am currently routed to use.
Can that NSA exit relay swap ...
user21377
5
votes
1
answer
2k
views
Tor: Is a Diffie-Hellman key exchange being done over recipient of traffic?
As I was looking over Tor specifications and I noticed that when a circuit is generated then on each circuit's node a Diffie-Hellman key exchange is being done over an encrypted path on each Node as ...
5
votes
2
answers
8k
views
How to recognize Tor traffic
Having a PCAP file with Tor traffic, is there a way fast enough to recognize if any of the packets are part of Tor traffic/sessions?
Some tools speak about "protocol identification via ...
- 167
4
votes
4
answers
3k
views
How well can Tor + VPN secure my anonymity on the internet?
I want to be as anonymous as possible online without anyone being able to connect me to my online activity. Assume that the people trying to track me have lots of resources and can even use the legal ...
- 89
2
votes
2
answers
6k
views
connecting a secure computer directly to the internet without a router
If you have a fairly secure computer how dangerous is it to connect to a modem directly without a router in between.
Let's say the computer is running Debian as a host and Whonix in VirtualBox, a VPN ...
Steve
2
votes
2
answers
1k
views
Revealing IP of an email recipient using remote PHP script or pixel tracking
I read through the search items and similar threads but my query is rather specific.
I know it's possible to reveal IP of an email recipient if we can get the person to click on an attached image or ...
user182445
2
votes
3
answers
1k
views
Is there an anti-proxy detection available?
Sites like Wikipedia and Google (among others) don't let you sign up through a proxy or Tor (at least with Google, you have to provide SMS verification if you sign up through proxy.) Somehow they ...
- 1,151
0
votes
0
answers
50
views
Surfed Darkweb carelessly [duplicate]
A while ago, I installed Tor app on my android (fully updated and Android 10) and with a free Vpn tried to open some sites listed on several blogs (like "best dark sites in 2020" or "...
- 1
59
votes
5
answers
90k
views
How do you get a specific .onion address for your hidden service?
.onion addresses normally should be made of a base32 string of the first 80 bits of the SHA1 hash of the private key of the server (see .onion address specification).
Today I ran into a service which ...
user9651
43
votes
3
answers
29k
views
How does check.torproject.org know if you're using Tor?
I'm looking at the results from the following URL and would like to know how does the Tor Project website "know" that Tor is being used or not.
https://check.torproject.org/?lang=en-US&small=1&...
- 50.7k
35
votes
6
answers
23k
views
How to detect if employees are using Tor?
We work in an organisation which is supposed to be HIPAA compliant. Security is a big concern for us. We've been tasked to find out if any user is using anonymous proxy in the network.
Is there a way ...
- 535
33
votes
1
answer
22k
views
Why is Home --> VPN --> Tor worse than Home --> Tor?
I've read lot of questions asked on various websites about the pros & cons of using a VPN with Tor. As said on Tails website VPN make the situation worse by introducing a permanent entry guard or ...
- 650
19
votes
1
answer
3k
views
Could someone explain parts of the FBI's Firefox 0-day?
Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown.
http://pastebin.mozilla.org/2776374
The ...
- 664
16
votes
1
answer
5k
views
How are tor hidden nodes/services found?
Tor has "hidden services", which have an address like duskgytldkxiuqc6.onion.
Now I was wondering: how is this duskgytldkxiuqc6.onion name mapped to the real server?
I don't think there's a central ...
15
votes
3
answers
5k
views
Is the fact that Tor's development is largely government funded cause for concern?
In light of recent events, I've been learning more about Tor, and I have a lot of questions. Here's one.
Wikipedia's article states;
As of 2012, 80% of the Tor Project's $2M annual budget comes ...
- 485
14
votes
4
answers
18k
views
Detecting Tor proxy by reading request headers
I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
- 4,357
10
votes
1
answer
5k
views
wget: what security issues am I not considering?
Questions: based on the details provided below, (a) what potential security vulnerabilities and threats might I face in my use of wget and (b) what recommendations would you give for mitigating those ...
- 177
10
votes
1
answer
3k
views
Different types of Tor bridges - implications for detection of Tor use
I am trying to figure out the implications of using the different types of Tor bridges - such as meek, obfs4, etc.
My threat model: I am engaged in entirely legal, non-violent communications, but I ...
- 101
6
votes
3
answers
2k
views
How precisely can your ISP tell you are using Tor?
I often read that your ISP can tell if you are using Tor. Assuming you use a bridge the only way to do this seems to be statistical analysis of a packet capture. How exactly is this done given that ...
- 61
6
votes
2
answers
13k
views
Is it safe to download internet files over Tor
This question is related to downloaded files from the internet (i.e. chrome.exe from google site or an attachment in email), excluding torrents which Tor expressly recommends against.
I have started ...
- 544