Is my privacy safe with Tor?

Question

I tried using Chrome to connect to torproject.org but got the "website couldn't make a secure connection..." page. everytime I visit the page.

After using tor I can connect fine, so should I be concerned about my online privacy? If someone is living around me dedicated to hacking my wifi and watching my internet is there a way to tell and what does it take to do that hardware/software wise? Is there anything else I can do other than use tor?

Do using sites without HTTPS jeopardize my anonymity? What about gmail/hotmail/yahoo mail?

Answer 1

Also if you are extra paranoid buy a used computer with cash so you domt leave a money trail behind, then burn an anonimity centered linux live cd (I think there was one called "tails") which tunnels everything through Tor by default and does not leave anything behind on the hard drive. If you are not that paranoid it also helps to use the tor browser bundle instead of chrome and running an up to date operating system.

Answer 2

If the site does not use HTTPS a rogue exit node could try to alter the site before delivering it to you, for example adding javascript that sends your loginn information to a server controlled by the attacker. This basically means unless the site makes you enter sensitive information such as passwords it is more likely to be used as a way to smuggle rogue scripts into your browser instead of being eavesdroped on.

Answer 3

If someone breaks into your wireless and you do not have a very secure computer he could try to compromise your computer an try to manipulate the Tor software itself in which case its game over for your privacy/anonymity anyways since he could install a RAT/keylogger on your device. Tor itself also has vulnerabilities since the internet is designed in a way that makes real anonymity impossible. For example, the NSA has started hosting Tor entry/exit nodes and using time corelation to find your true IP adress. However, the percentage of such exit nodes is fairly low, so it is pretty much a gamble whether you get a good or evil entry/exit node. As for using unsecure sites if you are on a compromised/unencrypted network people can see what ypu are doing without even having to be connected to the network. Hardware/software wise cracking wifi with weak encryption only takes a laptop with any linux distribution. There is no way other than encryption to stop/detect passive sniffing (when the attacker only uses a wireless card in monitor mode to passively receive signals) but if the attacker is actively transmitting you could try to pinpoint his location using triangulation and hit him with a crowbar or something. As for defenses the best defense is to not use wireless, but many devices do not support networking cables so the next best thing is to use WPA enterprise encryption, however that takes some knowledge so its probably best to not use WEP encryption and turn off WPS as that poses a security vulnerability.