Tag Info

No, it is not safe. But the reasoning your read is wrong. When you use Tor, the connection between you and the Tor network is encrypted, so your ISP can not eavesdrop. But when you access a normal HTTP website with Tor, the connection between the exit node and the target website is unencrypted. That means the exit node can eavesdrop and manipulate the whole ...

Crowds and Onion Routing are both used to create anonymous networks, but implemented in two different ways. Onion Routing Basic Operation Anonymous networks like Tor rely on passing through multiple nodes with a layer of encryption added at each node. This circuit is randomly predetermined when a node enters the network. As the data passes through each ...

It depends. Specifically, it depends on the type of data you are accessing and your threat model. What protection does HTTPS provide with Tor? Here is a breakdown of some potential adversaries at the information available to them at each point. You will note that HTTPS only provides protection in the final step of the connection (between the exit node of ...

You still need HTTPS since anyone on the Tor exit nodes can read your HTTP traffic. E.g. Tor provides protection so your ISP would have difficulty reading your traffic but it is not end to end encryption. You cannot be sure who /where your exit is or who controls it and they would still have the ability to intercept your unencrypted traffic See attached ...

The image below shows how a packet is encrypted, and sent through the network. Tor uses its own protocol to negotiate encryption keys. Through this protocol the client receives encryption keys for Routers A, B and C. From the Tor Project The client negotiates a separate set of encryption keys for each hop along the circuit to ensure that each hop ...

According to this, when you connect to a hidden service using tor you go through 6 nodes instead of 3... why? To hide the hidden service IP address in case the rendezvous point is under adversary control. The hidden service communicates with Tor client through a chosen node, which is called rendezvous point (RP). Normally they both build a standard Tor ...

In the theory of onion routing, the underlying routing graph is complete. All routing nodes can talk to the initiator's proxy and the receiver's proxy. In TCP/IP terminology, the initiator's proxy, receiver's proxy, and the routing nodes, all have fixed public IP addresses, and any of these machines can open a TCP connection to any other of these machines. ...

To add to the answer above: If b. is true, then the client and hidden service hoster don't communicate outside of the rendezvous point, becuase it's unsafe... So how do they find out which rendezvous point they will both be communicating at? The rendezvous point is chosen by a client, randomly, from a list of Tor relay nodes (they don't have to be ...

Another way I have interpreted this is that the client, nor Tor, needs to know the real IP address of the hidden service hoster, since they only communicate through a rendezvous point, and they both go through 3 encrypted hops just like normal to the rendezvous point, providing them both anonymity.  Yes, this is correct. It's helpful to think of the hidden ...

That cannot be done in any way, because the data leaves the Tor-network on the exit node! The Data is already encrypted until the exit node where it is sent in plain to the public Internet. Any encryption added between your Orbot and the exit node doesn't change anything, because it is already there. If you want to encrypt the data between the client app ...

Actually, tor only provides a socks proxy. So your OpenVPN, for example, needs one additional line: socks-proxy 127.0.0.1 9050 Additionally, you have to exclude tor traffic from vpn, which will not be too easy, and there is plenty room for mistakes. Actually, I don't see any advantage for you, using vpn over tor, as it might be very unstable and break ...

I suppose onion routing as implemented by Tor is a "crowd" implementation (I believe you are referring to google sharing by Moxie and the like with crowds? - please correct me if not). Crowds in general protect your identity from the end point, in the Google Sharing example, Google, but of course you're moving that trust to another third party in most cases....