Tracking One Year of Malicious Tor Exit Relay Activities (Part II)

Re:Tracking One Year of Malicious Tor Exit Relay Activities ... by bawolff on Monday May 10, 2021 @03:50PM (#27110114)

Its designed so that a snooping exit node can't identify you, but it can see all traffic.

Which is why you should generally only use https when using tor. The last leg may be snooped on so you need to use encryption during it. (http is fine with hidden services though)

Its important to keep in mind that anonoyminity and data integrity are separate properties. You can have one without the others.

[ Parent | on HN ]

Re:Tracking One Year of Malicious Tor Exit Relay Activities ... by windy_willow on Tuesday May 11, 2021 @08:35AM (#27117303)

Hmm, just trying to make sure then. If they can see all traffic would using a tool hide this in combination with Tor help?

[ Parent | on HN ]

Re:Tracking One Year of Malicious Tor Exit Relay Activities ... by bawolff on Tuesday May 11, 2021 @10:12PM (#27125894)

Using https would help. If you totally disable http (or only use http on .onion sites) the described attack won't work. Similarly, if the site in question enabled HSTS the attack would be prevented.

Think of tor like the open wifi network of dubious origin at a black hat hacker convention. You are probably fine if using https, but plain http is a bad idea.

Using a vpn is more questionable. Generally a paid vpn already knows who you are so hiding you origin ip with tor would be pointless. Also sometimes combining vpn technologies can cause traffic congestion algorithms to interact poorly and make things really slow, but that will depend on which technologies are in use.

[ Parent | on HN ]