I know how tor works but I have this question. Lets say that the user which uses tor has done something bad with some website. In website log there would be ip which did this thing. If they try find the pc which has this ip they will found it and they will figure out that its exit node of tor. Then they will try to found the previous pc from where this request was sent and they will find it. They will have to do that thing several times and eventually they will find you. Can you please which part of this story is wrong? And one more question when exit nodes are found why police is not shutting it down or arresting the man who owns that pc? thank you.
2 Answers
as I see, views on new question are rare, tor stackexchange is dead. here is my amateur answer:
I don't think tor servers/nodes are recording logs, they just forward traffic (TCP packets), the same as Internet Exchange Nodes, NSA can catch traffic at IXP but no logs. therefore you use tor software and you don't log to any server and tor software care that server cannot log your IP address (tor software connect through some circuit, I don't know how it looks and how software choose circuit, entry node, etc). that's difference between tor network and let's say classic proxy network, classic proxy can record your IP while Tor server doesn't record your IP. although I think, admin of entry node/server MAYBE can snitch your traffic but not your IP.
exit nodes are public, they are not hidden, if police want, they can shut down all of them, if cops make international cooperation. anonymization of internet is privacy and privacy is guaranteed by the law although the law is worse than before, the law is changed in interest of government to spy mass of people under excuse of paranoia about terrorism. so, you didn't study law, therefore you ask yourself why cops simply don't shut down all tor servers, then you can ask why they allow vpn, proxy and similar? because if you want to spy somebody, you must ask judge for permission, they don't have any right to spy mass of people. they do it unofficially, although in America they made this famous NSA court that allowed them to destroy privacy.
so, if you work in post office and you cut my envelope and read my letter, under excuse of this or that, I can make court case against post office and get money for damaging my privacy. it is the same with internet, therefore they spy people secretly, unofficially, only NSA has their secret court/judge. many people make case against facebook for participation in PRISM spying program. Just justice is slow, maybe after 10 years they will win.
-
"entry nodes can snitch your traffic but not your IP." i believe it's the other way around. relays can be configured to log IPs for debugging purposes. but what relevance is having an entry IP when you have no idea of the full circuit being used? what relevance is having the exit IP, when you don't know the user's origin? in theory, collusion between entry, middle and exit nodes could be used to identify a user. however, given the sheer number of nodes, it is not feasible, although it could potentially be done by a global adversary. someone please clarify if i'm incorrect.– faustusMay 10, 2015 at 6:33
I was going to just comment and add to another answer but I just joined and I don't have the rep points:
TOR traffic is very difficult to track from point to point as you describe but a global passive analyzer such as the NSA can monitor traffic on entry and exit nodes and correlate it to suspicious activity in order profile those users for a targeted investigation.
https://blog.torproject.org/category/tags/traffic-correlation
Also from the TOR Website, How it works: https://www.torproject.org/about/overview
To create a private network pathway with Tor, the user's software or client incrementally builds a circuit of encrypted connections through relays on the network. The circuit is extended one hop at a time, and each relay along the way knows only which relay gave it data and which relay it is giving data to. No individual relay ever knows the complete path that a data packet has taken. The client negotiates a separate set of encryption keys for each hop along the circuit to ensure that each hop can't trace these connections as they pass through.
