3

Is it less or more safe to login to personal accounts (email, Amazon, etc.) when using Tor, compared to not using Tor?

For example, using Tor browser, or Firefox/Chrome with Tor extensions.

What are the cons and pros?

Will my account information be recorded by the machines in Tor network that I am connecting to?

  • Seems like it kind of defeats the purpose of a secure browse like Tor if you can't access your personal accounts online, but then you gotta ask yourself when getting ready to login to a site: Is it worth it? What's it gonna cost me if my account/credentials/personals are compromised? As others have stressed,I'd use it only if it's HTTPS. And, I'd probably only use it for a few obscure email accounts I have. I wouldn't use it for anything where there's money, credit cards, etc., involved. $0.02 worth. – user15288 Dec 3 '16 at 3:48
1

If the server you connect to does not offer SSL/TLS, the Tor exit node sees all your request data. That may include valuable information like passwords, account numbers, etc.

If you use Tor to access a site that you plan to use with valuable or personal information, make sure SSL/TLS is enabled.

Edit: See https://www.torproject.org/download/download-easy.html.en#warning for general usage advice.

  • Thanks. How can we know if SSL/TLS is enabled? – Tim Nov 17 '14 at 18:48
  • @Tim Look for https in the address bar of your browser. – ewatt Nov 18 '14 at 15:35
1

Is it less or more safe to login to personal accounts (email, Amazon, etc.) when using Tor, compared to not using Tor?

Generally speaking: Less safe. Don't do this.

When using Tor, an exit operator can steal your account credentials if you log into a site without using a TLS connection. However, even if your browser does indicate that you're using HTTPS, this doesn't necessarily mean that your credentials are safe. Many websites use mixed content (some content is encrypted, some isn't). If some of that content is also on the same domain as your encrypted / authenticated connection, it can leak your cookies (most browsers won't warn about mixed content, or will warn you but establish the connection anyways, meaning your data has already leaked). Blocking mixed content and always logging in over HTTPS can help prevent this.

However, logging into anything essentially defeats the purpose of Tor. By logging in you are confirming to the service operator (and anyone else who can tell you've logged in) that you are the person with that account, effectively de-anonymizing you. Depending on your risk tolerance, what the account is (and what information it has on you), what threats you're trying to prevent, etc. this may or may not be a problem.

TL;DR — it all depends what you want. If you want anonymity, Tor may help to a certain degree, but will be worthless without following general opsec practices. If you're just trying to protect your account credentials: Tor at best is neutral, and at worst may bite you.

1

You have not defined "safe" but one way to think about it is to ask what information you create or leak by your two methods, login with and without use of the TorBrowser.

Please note that the information below assumes you have a secure, encrypted connection to a router and assumes that this is a "first login" to site.com. Clearly, if site.com stored your IP yesterday without TorBrowser and sees your username login from Tor exit node today, it is possible that site.com will combine this information.

  1. Login to http site without TorBrowser
    • Router & ISP & Intermediary servers see: your IP, site.com, username, password
    • Site.com sees: your IP, site.com, username, password

HTTP without TorBrowser

  1. Login to httpS site without TorBrowser
    • Router & ISP & Intermediary servers see: your IP, site.com, encrypted{username, password}
    • Site.com sees your IP, site.com, username, password

HTTPS without TorBrowser

  1. Login to http site with TorBrowser
    • Router & ISP & Intermediary servers see: your IP, encrypted{site.com, username, password}, your Tor entry node
    • Tor entry node sees: your IP, encrypted{site.com, username, password}, your Tor entry node
    • Tor relay node sees encrypted{site.com, username, password}, your Tor entry node, your Tor exit node
    • Tor exit node sees site.com, username, password, your Tor exit node
    • Site.com sees site.com, username, password, your Tor exit node

HTTP with TorBrowser

  1. Login to httpS site with TorBrowser
    • Router & ISP & Intermediary servers see: your IP, encrypted{site.com, username, password}, your Tor entry node
    • Tor entry node sees: your IP, encrypted{site.com, username, password}, your Tor entry node
    • Tor relay node sees encrypted{site.com, username, password}, your Tor entry node, your Tor exit node
    • Tor exit node sees site.com, encrypted{username, password}, your Tor exit node
    • Site.com sees site.com, username, password, your Tor exit node

HTTPS with TorBrowser

Source: https://www.eff.org/pages/tor-and-https

1

Short answer: YES, it is safe as soon as those personal accounts are protected by HTTPS.

By safe I assume you mean protecting your password's secrecy. HTTPS encrypts end-to-end traffic between your Tor browser and the web server you are connected to.

Tor provides anonimity and censorship prevention too, so it works great when you use a network that prevents you from updating your Facebook profile status. Facebook uses SSL everywhere, thus Tor exit nodes cannot see your password. No one inside Tor can.

My short answer has a remark: "as soon as those...". In fact, if you use plain HTTP the exit node knows what you are doing. It is known that a number of Tor exit nodes record your data, passwords included.

  • ISPs and VPN providers aren't trustworthy either and even if they were most users home routers are trivially exploitable. You shouldn't use HTTP anywhere you can avoid it and definitely never sites that you login to. – cacahuatl Dec 5 '16 at 19:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.