Could Tor be compromised by hackers, allowing them to discover your IP, etc.?

  • 4
    I think the answer to your question must be "Yes". It is possible for Tor to be compromised in some way that we don't know about yet. Has this already happened? If so, it is clearly not public knowledge. – Greg Hewgill Jun 22 '14 at 20:48
  • 2
    Of course it can be hacked. Anything can be done given enough time and money. The other thing is anything that can be done will be done. – Roya Jun 23 '14 at 12:47
  • Tor uses encryption and runs on computers. Encryption can be broken, and computers can be compromised. It just takes a lot of time and a lot of money. It's much easier for say, the FBI, to exploit vulnerabilities in older versions of the Tor Browser, Flash Player, or other security holes introduced by the user. That's why it's always important to stay up-to-date, and never, EVER, use Flash Player. – SuperSluether May 1 '16 at 2:11

Yes, all software is subject to flaws, both in design and implementation. Tor has had them in the past, Tor also relies on OpenSSL which has had numerous vulernabilities. However, only your guard or a man-in-the-middle between your guard and you can attack a Tor clients OpenSSL.

The far larger problem, and the source of most of the large-scale hacks performed on Tor users is through the application that the user is using over Tor. For example, Tor Browser has regular updates that fix vulnerabilities. This is also why there are efforts to harden the Tor Browser to make it resistant to exploitation through the security slider, ASAN, selfrando and more.

While there is no silver bullet, there are steps that can be taken to be more resistant to and reduce the impact of successful exploitation. See Subgraph, Qubes, and Whonix for some examples.


If you read up on subjects such as Tails for instance you can get more info, I say Tails because they actually have an informative FAQ section on Tor. You have to realize nothing in itself is foolproof. A hacker can identify an originating IP at the exitpoint as the packet is no longer encrypted, and so it is typically ideal to use a Tor Bridge, and connect through a unpublished or uncommon entrypoint

  • Dear, If you read the subject carefully, you will notice that, it takes months of testing before a relay is accepted as a Guard. However, this extensive testing is short cut for bridges. Thus, in no way bridges are safer than regular guards. In reality the purpose of bridges are circumvention. They may not enhance anonymity. It even may reduce anonymity compare to regular guards. – Roya Jun 21 '14 at 11:04
  • 1
    " A hacker can identify an originating IP at the exitpoint as the packet is no longer encrypted" are you sure about this. where is it getting the IP from... – puser Jul 21 '14 at 14:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.