I understand in general how TOR works, with creating a circuit from the client using 3 random nodes in the TOR network - the entry node, some internal node, and an exit node.
My question is about how HTTPS works with TOR, and specifically whether or not the data sent to the end server is actually secure.
The way I assume it works, the HTTPS session is created between the exit node (the 3rd node in the circuit) and the target server, but that means this 3rd node can actually see all the data I'm sending as cleartext, including any form data (e.g. credit card numbers, passwords etc.), it then takes that cleartext data and uses the HTTPS/SSL protocols to send it securely to the target server.
Am I wrong/missing something? Is all the data I'm sending to the end server visible to the TOR exit node, even when browsing to an HTTPS connection?
- To be 100% clear - I'm talking about a case where I'm using TOR to connect to an HTTPS website OUTSIDE of TOR, as connecting to .onion addresses already ensures e2e encryption without the need for HTTPS.