1

I am not sure how does Tor work, how safe is it as I heard that some relays are ran by bad people or government agencies.

  • Hm. I wonder if this should be best broken into two different questions? I guess the answers are sort of related, but I think we want better answers for each of them independently. – Roger Dingledine Sep 26 '13 at 6:44
  • I agree, should've done that from the beginning.. – Sherief Alaa Sep 26 '13 at 6:54
  • Closing as too broad and probably either of those questions is also too broad or not answerable: how does Tor work requires a very complex answer and "should I be worried" doesn't really seem to have a specific answer. – Sklivvz Sep 26 '13 at 9:33
1

how does Tor work

When you connect to the Tor network a Tor circuit is formed which consists of three relays (entry node, middle node and an exit node), Tor encrypts your traffic and passes it through its circuit then when your traffic reaches its destination node (outside of the Tor network) and the encryption is lifted off.

how safe is it as I heard that some relays are ran by bad people or government agencies.

Will explain that through an example:

Lets say you visit https://twitter.com/ your traffic enters the Tor network then exits at Twitter's servers and the effects are:

  1. Twitter cannot know your real IP address or physical location.

  2. Your internet service provider will not know that you are using Twitter, because to them you are communicating with the entry node only.

  3. Your traffic within the Tor network is encrypted multiple times in order to prevent any eavesdropping from relay operators. But when your traffic leaves the Tor network and reaches its destination (Twitter's servers) the encryption must be lifted off so that your request can be understood by Twitter, this is why you should always use HTTPS, because HTTPS will encrypt your traffic even after leaving Tor's exit node protecting you from a bad exit that may try to read your data.

EDIT:

The EFF made a nice interactive web page that illustrates the usefulness of using Tor and HTTPS together.

  • 1
    It might also be worth linking to eff.org/pages/tor-and-https. It's a great interactive visualisation of Tor and what sort of attacks it protects against. – Philipp Winter Sep 26 '13 at 7:51
  • Thanks Philip I just added it, I am also using it in #5991 – Sherief Alaa Sep 26 '13 at 7:59
1

In general everyone can operate a relay. Those can be either good or bad guys. Bad guys can do everything. This ranges from passive listening to injecting malicious content. When the main Tor people learn about those bad things they can give the Tor relay a special mark (Bad Exit flag). In this case no other client will use those relays.

Not the answer you're looking for? Browse other questions tagged or ask your own question.