I'm a newbie at this and just wanted to know how secure Tor is.

I know that sounds a bit vague but any info will be appreciated.



It depends on what you are using Tor for, and who is your adversary. So in some case, Tor is not secure enough, and in other cases it can just do the job.

For instance, Tor uses asymmetric enryption with 1024-bit RSA keys. Those keys are considered weak nowadays (and perhaps breakable by a global adversary such as the NSA), but they are changed often, and the Tor project keeps using them as to not overload many of the weaker nodes running as Tor relay nodes (so itis Security vs Usability).

There are other aspects you may or may not interested about in terms of Tor security, but you should probably start (if you haven't already) reading documents and advices like How Tor works and The best security measures while using Tor.

| improve this answer | |

There is a difference between anonymity and security, Tor promise to provide anonymity, but does not promise to provide Security, although, it aims to provide security.

Tor does not promise secure communications, but it aims to provide security. Encryption is only used to provide anonymity between nodes, be advised that your data is not encrypted otherwise. This is the reason it is highly recommended to use "https" enabled websites while browsing with Tor. HTTPS will help to make your communication secure. If you use a Tor browser, there is a add-on which attempts to use https version of the sites if possible in an attempt to aim for security. The only exception to that is when you visit hidden services. In this case you will not leave the Tor network, and thus, you are always between the nodes. Since you are always between the nodes and encryption is provided between the nodes when using Tor, your communication is secure. Of course you must provide the information to destination site in decrypted format, so that the site can understand the requested information and answer your request. Thus, the destination site can be a honeypot and snoop on you. Hidden services or clear sites all have a potential to be a honeypot. The other thing is that, these sites maybe compromized without their consent or knowledge, But this phenomenon, still would have same effect as sites that are designed as honeypot as far as user is concerned.

| improve this answer | |
  • Careful here! "Security" is a broad term, and Tor does indeed aim to provide "security". It sounds like you want to use the term "confidentiality" here? – Roger Dingledine Feb 7 '15 at 7:53
  • @RogerDingledine, Thanks for the comment. I have edited the answer. – Roya Feb 7 '15 at 8:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.