Can the Last Node See My Private Data?

Question

I have recently started learning about TOR. One concern I have is that the last node can see my private data. For example, let's say I use TOR to create a Facebook account. As part of the create account process, I input my password. Although my password is encrypted when it leaves my computer, and will remain so on its journey to the last node, when it reaches the last node, it will be plaintext. Is this right?

I feel uneasy about using TOR for this reason.

Answer 1

You should always use a secure connection (HTTPS) when visiting websites as it prevents this type of attack, regardless of if you're using Tor or not. Facebook (along with many other websites) use HTTPS to provide end-to-end encryption that the exit relay cannot read.

See:

• https://www.cloudflare.com/learning/ssl/what-is-https/
• https://www.eff.org/pages/tor-and-https

Answer 2

I found an animation which implies the last node can't see my password if I use HTTPS. https://www.eff.org/pages/tor-and-https