Will I be anonym while I connect to onion domain through Tor?

Question

If the connection not leave the Tor network, so I am browsing only onion site, for example: Tor email through Tor browser/network, Tor website admins know my identifiable data? What kind of data is available to admins? For example: Real IP? I know admin can read my email on the server, if I am not using encryption, but it isn't problem right now. The question is, can the administrator track my location? So what can they do, if the NSA running the hidden website (for example a honeypot)?

Because I read, Tor's weak point is exit node, so I am thinking, what will happen, if I don't leave the Tor, and I don't use exit node.

Answer 1

It is all the game of probability. There no definite answer to your question. It depends on lots of factors, but let us take one scenario out of the table. Read the below declaration first:

Tor doesn't protect you from a global adversary

A global passive adversary would be a person or an entity able to monitor at the same time the traffic between all the computers in a network. By studying, for example, the timing and volume patterns of the different communications across the network, it would be statistically possible to identify Tor circuits and thus matching Tor users and destination servers.

It is part of Tor's initial trade-off not to address such a threat in order to create a low-latency communication service usable for web browsing, Internet chat or SSH connections.

If your adversary is NSA or similar entities, there are considered to be global adversaries and Tor can not protect you against them. There is no game of probability about this. It is stated as definite warning.

Also read the more complete list of the warnings here: https://tails.boum.org/doc/about/warning/index.en.html

If any of your concern relate to non state entities, thus non global adversaries then we are talking about the game of probability. If you encounter a honeypot, then there is a good chance that you eventually will be de-anonymized. Depending on how fast, how much information you provide to the site and how often you visit the site, plus the nature of the site. The best approach to the best of my knowledge is not to trust any site until the evidence convince you that the site is not a honeypot beyond reasonable doubt. One important point here is eveything should be evidence based and nothing should be faith based as far as trusting these sites are concerned.

Always leave some probability for error in judgment and mistakes and have a backup plan when these mistakes and error in judgement occur. For example one established way to increase the security is to make layers after layers of barriers, so that once some of these layers are broken you still remain safe. One of these barriers could be Tor or even better using Tor through Tails. But of course this is not enough. You need to connect to Tails at some remote location at least 100 miles from your place of residence, work, study in Starbucks like caffe which does not employee surveillance cameras. Also please read my answer to this question for additional clues of what you need to observe:

Can an IP address get you caught?

Answer 2

Whether you are using Tor to browse an ordinary or an onion site, the site admin cannot know your IP address, since the traffic will appear as originating from the last Tor node it passes through, which is called a Tor exit node.

That said, a Tor exit node is used whether you are you are browsing an onion site or a normal one. It is the node where the last layer of data encryption is decrypted (so if you are not using HTTPS, a Tor exit node can see the content), and the data will be forwarded to the destination address (address of the website).

That's the ideal situation. In non-ideal cases, there are applications such as BitTorrent clients that can leak your IP address, so better to avoid them. Also some javascript exploits have been discovered in the past and allowed at the time to leak addresses. Those kind of breaches are on the application-level and are no responsibility of Tor, because they happen due to applications or protocols that you can choose not to use.

On the other hand, Tor itself is not invincible. There are many researches concerning security attacks on Tor, and there have been many incidents where people using Tor or hosting a hidden service have been tracked (although in some cases it was due to human errors not due to a weakness in Tor). At any rate, Tor is not 100% safe anonymizing solution, but it is certainly safer than most of the other solutions, and if combined with something else (such as VPNs, proxies, accessing the net from public WiFi networks), it can greatly increase your level of protection.