Simple questions about logging in to sites over Tor

Question

I'm a Tor newbie that wants to use Tor to log in to a few communities online, and I have a few questions about the safety of it. Before you say anything, I won't use sites like Facebook that know my real life identity, or sites that are very important (like online banking). I'm generally not doing anything too interesting over Tor and don't expect to be especially targeted by hackers or law enforcement.

As I understand it, when logging in to a website, my username and password can be stolen when I send them through Tor. What is the likelihood of this, and steps can I take to minimize such risk?

If I change my password immediately after logging in, will that prevent hackers from getting in, or will Tor continue to transmit these details while I use the website?

I understand Tor reroutes my traffic every 10 minutes. Will this also re-transfer my details, making it more likely to get routed through a malicious node the longer I stay on the site? Can I prevent re-routing, so that only 1 exit node can potentially see my details, instead of 100+? Besides, some websites automatically log out if the IP address changes, which is just annoying.

Can I store a cookie with my login details on my computer, so that I don't have to log in every time I start the browser? I understand that this will somewhat reduce my privacy.

Or would it be better to leave the Tor browser running throughout the day, so that I only have to log in once? Would that not compromise my anonymity, in other words, the longer I stay on the site, the more likely the NSA or someone else will connect the start node and the end node?

Thanks for any replies.

Answer 1

To address some of your concerns:

1. "As I understand it, when logging in to a website, my username and password can be stolen when I send them through Tor."

   • This is more generally true of the internet, the proper solution is the application of end-to-end cryptography. For example, that the sites should use HTTPS, if HTTPS is properly deployed a passive eavesdropper (like a naughty exit node) wouldn't be able to recover your login credentials. Again, this is a more general problem. Your login credentials pass through multiple companies networks and devices even when you don't use Tor. These devices, and their administrators, are not infallible and hackers do compromise them. With or without Tor you should be using end-to-end cryptography like HTTPS to protect your login credentials. This interactive infographic from the EFF might help clarify the situation.

2. "If I change my password immediately after logging in, will that prevent hackers from getting in"

   • If the provider isn't using a secure login mechanism, it's unlikely they will be using a secure password update mechanism. The updated password is as likely to be read as the original one. This will not help if the site has poor security.

3. "I understand Tor reroutes my traffic every 10 minutes."

   • Only under default circumstances, if you are using Tor Browser this isn't the case. This was actually changed to help out with some of the concerns that you had about it, e.g. logged in sessions being associated to IP. Tor Browser uses two things, first of all it isolates connections (meaning they will each use a different circuit from each other) by the "First Party Domain" of the tab. So if you have a tab for example.com and foobar.org they will both use different circuits. The second thing it does is that it will keep those isolated circuits open for the duration that they're used, to stop it using new circuits (and thus potentially a new exit) for connections to that website. As long as a new connection to the site has been made within the last 10 minutes (e.g. a new page or resource has been requested) it will be kept open and re-used for subsequent requests to the website.

4. "Can I store a cookie with my login details on my computer"

   • Yes, Tor Buttons 'Privacy and Security' settings allow this but it's strongly recommended against, first of all it won't just keep one cookie but all browsing history and cookies, which would mean you'd always carry around your browsing history with you. Part of the privacy protection offered by Tor is what's called "unlinkability", that is the inability to link previous browsing sessions to current or future ones through technical means alone. Storing identifiers from previous sessions would violate this property, it would make it as easy to profile you as an individual for advertising and marketing purposes through a pseudonym as it would through your real identity.

5. "...the longer I stay on the site, the more likely...someone...will connect the start node and the end node?"

   • Difficult to say, in theory yes but also consider that if, for example, you started Tor Browser exclusively to login as your psuedonymous identity that the time that you are connected to the Tor network will correlate to the times that the pseudonymous identity is connected. Onion routing, and low-latency anonymity networks in general, will always have problems like these when faced with a "GPA" ("Global Passive Adversary"), that is an adversary who can see a large enough fraction of the network at any time, as covered in the FAQ. There is little evidence that such an adversary exists but we know that, for example, the NSA is able to deanonymize some users some of the time through these methods, see page 2 of the "Tor Stinks" slide deck. It's also important to note that the length of the connection isn't the only factor, other attacks include things like website traffic fingerprinting which doesn't require the connection be sustained for long periods of time. None of these attacks provide a 100% proof, but over time provide stronger statistical probabilities. Most (known) effective attacks on deanonymizing Tor users have been through directly compromising the end points and metadata leaks (some covered in the Tor Stinks slide deck linked above). This is a big questions that I can't authoritatively answer here.

Answer 2

Welcome to Tor community! So - step by step to your questions:

• No information, including login and password can be stolen if it's transferred via HTTPS and the certificate genuinity is verified. Use Perspectives project and/or Convergence to check it all up locally and in decentralised manner - it will save your day not just inside Tor, btw.
• Tor is a very configurable tool, and it can be tuned up to change it's circuits in a decent privacy-oriented manner, so password change will not be intercepted. However it does not negate a need in two-factor authentication. Google Authenticator is free and easy to use and adopt, for example.
• No cookies! Ever! It's not so laborious to type your password.
• It's better to use a dedicated Tor node of yours running 24/7/365 and route all your traffic through it - I'm doing it myself on Orange Pi PC single-board computer. Feel free to ask and I'll give you all the details how to do it if you need.

Post Scriptum. If you have any further questions - ask them! I'll be glad to help you

Answer 3

I would like to add 1 tiny part in this and that is about storing passwords. I might be old fashion but i never ever ever store passwords anywhere everything can be hacked. I simply write them down in a book. You have to break into my house to search for it to get the passwords. :)