Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
Is it less or more safe to login to personal accounts (email, Amazon, etc.) when using Tor, compared to not using Tor?
For example, using Tor browser, or Firefox/Chrome with Tor extensions.
What are the cons and pros?
Will my account information be recorded by the machines in Tor network that I am connecting to?
If the server you connect to does not offer SSL/TLS, the Tor exit node sees all your request data. That may include valuable information like passwords, account numbers, etc.
If you use Tor to access a site that you plan to use with valuable or personal information, make sure SSL/TLS is enabled.
Edit: See https://www.torproject.org/download/download-easy.html.en#warning for general usage advice.
Is it less or more safe to login to personal accounts (email, Amazon, etc.) when using Tor, compared to not using Tor?
Generally speaking: Less safe. Don't do this.
When using Tor, an exit operator can steal your account credentials if you log into a site without using a TLS connection. However, even if your browser does indicate that you're using HTTPS, this doesn't necessarily mean that your credentials are safe. Many websites use mixed content (some content is encrypted, some isn't). If some of that content is also on the same domain as your encrypted / authenticated connection, it can leak your cookies (most browsers won't warn about mixed content, or will warn you but establish the connection anyways, meaning your data has already leaked). Blocking mixed content and always logging in over HTTPS can help prevent this.
However, logging into anything essentially defeats the purpose of Tor. By logging in you are confirming to the service operator (and anyone else who can tell you've logged in) that you are the person with that account, effectively de-anonymizing you. Depending on your risk tolerance, what the account is (and what information it has on you), what threats you're trying to prevent, etc. this may or may not be a problem.
TL;DR — it all depends what you want. If you want anonymity, Tor may help to a certain degree, but will be worthless without following general opsec practices. If you're just trying to protect your account credentials: Tor at best is neutral, and at worst may bite you.
Short answer: YES, it is safe as soon as those personal accounts are protected by HTTPS.
By safe I assume you mean protecting your password's secrecy. HTTPS encrypts end-to-end traffic between your Tor browser and the web server you are connected to.
Tor provides anonimity and censorship prevention too, so it works great when you use a network that prevents you from updating your Facebook profile status. Facebook uses SSL everywhere, thus Tor exit nodes cannot see your password. No one inside Tor can.
My short answer has a remark: "as soon as those...". In fact, if you use plain HTTP the exit node knows what you are doing. It is known that a number of Tor exit nodes record your data, passwords included.
You have not defined "safe" but one way to think about it is to ask what information you create or leak by your two methods, login with and without use of the TorBrowser.
Please note that the information below assumes you have a secure, encrypted connection to a router and assumes that this is a "first login" to site.com. Clearly, if site.com stored your IP yesterday without TorBrowser and sees your username login from Tor exit node today, it is possible that site.com will combine this information.
