Can the police, any spy agency or any government organizations track you on Tor and spy on what you're doing?

Or is the only way to do this hacking the computer or infecting it with a keylogger? If this is the only way, what's the likelihood of any agency doing that to you especially if they know about you and how can you protect yourself so no one hacks or keylogs your computer? Thanks

  • @NeverMine17 Not really a duplicate. This question asks about more powerful adversaries.
    – Anonymous
    Commented Jun 14, 2017 at 18:24

1 Answer 1


It is possible (but usually difficult). Other than hacking the computer, there are some ways powerful adversaries could spy on you.

  • Correlation attack: If you are unlucky, you might get an entry node/guard controlled by an adversary. Tor tries to prevent this by making entry nodes semi-permanent, so adversaries get only one (or a few) tries. This does not necessarily compromise the whole circuit, but if you also get an exit node controlled by the same adversary, they will be able to correlate the traffic going into the entry node and coming out of the exit node.
  • MITM (man-in-the-middle) attack: If you use HTTP, an adversary who is able to see the traffic coming out of the exit node will be able to see contents of the connection and modify them. They could also try to attack your browser if they know any vulnerabilities (most common are script exploits, most scripting is disabled in TBB at medium and high security setting). MITM would be much more difficult, but not impossible over HTTPS. This has happened with compromised CAs (certificate authorities) like DigiNotar, which have since been removed by Mozilla and TBB from trusted CAs. If you're concerned about this, check site certificates for anything suspicious.
  • Compromised site: The site could be controlled by an adversary or
    working together with them.
  • Identity correlation: Using any of these attacks to track your behavior and linking it to your real identity.

Usually at least two of these attacks would have to be combined to successfully deanonymize you.

How can you protect yourself so no one hacks or keylogs your computer?

Most difficult question, depends on your threat model.

The basic thing you should do is to use good security practices (full disk encryption, sandboxing/hardening (not to be confused with hardened) Tor Browser) and don't use vulnerable or (up to your research and discretion) untrustworthy software.

  • Thanks. I have a software that runs certain files virtually (automatic) and asks me about the rest. Is that enough for sandboxing, or do I need something else? Is there a difference between sandboxing and hardening? What software do you recommend for full disk encryption?
    – Hay
    Commented Jun 14, 2017 at 21:19
  • There is a possibility that they already gained access to my computer (physical access) but I've been checking TCPview and couldn't spot any suspicious remote address connections, they are mostly just Tor connections. Is there any other way to know if the computer is hacked/keylogged, or TCPview is enough and if there is nothing suspicious there it should be safe?
    – Hay
    Commented Jun 14, 2017 at 21:25
  • Since I don't know what software you're using, I can't tell. Sandboxing is software that contains the browser, hardening is making the browser less vulnerable. TBB is already hardened compared to Firefox. For full disk encryption, you should usually use the software provided by your OS. If you don't already, you might want to consider using a Linux distribution as your OS.
    – Anonymous
    Commented Jun 14, 2017 at 21:28
  • No way to tell if your computer is hacked from the computer itself. It would be possible for an adversary with access to your computer to simply hide their tracks.
    – Anonymous
    Commented Jun 14, 2017 at 21:31
  • I use Comodo Internet Security Sandboxing, is that enough? How can I harden the browser? So there is no way to know if a computer has been hacked, or if someone is keylogging or watching what I'm currently doing? I thought TCPview remote connections would at least tell if someone is currently keylogging or watching, wouldn't?
    – Hay
    Commented Jun 14, 2017 at 22:47

Not the answer you're looking for? Browse other questions tagged .