0

I have a short question regarding name resolution using the tor network.

Why is the name resolution not done by the proxy, but instead by the exit node? The traffic is encrypted and anonymized either way. It makes sense that the traffic is higher if it is done by the proxy, but is there also a security reason for this decision?

Improve this question

1 Answer 1

Reset to default
0

If DNS was resolved at "the proxy" (I.E. the local client) then anyone watching the Tor clients internet connection could look at the DNS resolves that they were making at determine information about what the user was using Tor for.

Clearly, that would break Tor's protection. An adversary who can see your DNS logs can determine a lot about what you're doing on the internet and when.

By resolving at the exit Tor ensures that your DNS resolves are not linked directly to your identity, stopping a local adversary from discovering what you are using Tor for.

Improve this answer
2
  • Ok but wouldn't it be possible to handle the DNS traffic like any other tor traffic and encrypt it, therefore making it impossible for an attacker to see your DNS queries?
    – mius
    Commented Jan 19, 2018 at 21:27
  • That's basically what happens when you resolve over the exit node? Even if you encrypted it, some server at the other end has to be able to see the content of what you requested so if you don't also anonymize the DNS requests then you will end up revealing your activity on Tor to someone. Resolving over Tor is the only way to ensure that your DNS queries don't reveal what you are doing and break Tor's anonymity.
    – cacahuatl
    Commented Jan 19, 2018 at 23:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .