1

I am not sure how does Tor work, how safe is it as I heard that some relays are ran by bad people or government agencies.

Improve this question
3
  • Hm. I wonder if this should be best broken into two different questions? I guess the answers are sort of related, but I think we want better answers for each of them independently.
    – Roger Dingledine
    Commented Sep 26, 2013 at 6:44
  • I agree, should've done that from the beginning..
    – Sherief Alaa
    Commented Sep 26, 2013 at 6:54
  • Closing as too broad and probably either of those questions is also too broad or not answerable: how does Tor work requires a very complex answer and "should I be worried" doesn't really seem to have a specific answer.
    – Sklivvz
    Commented Sep 26, 2013 at 9:33

2 Answers 2

Reset to default
1

how does Tor work

When you connect to the Tor network a Tor circuit is formed which consists of three relays (entry node, middle node and an exit node), Tor encrypts your traffic and passes it through its circuit then when your traffic reaches its destination node (outside of the Tor network) and the encryption is lifted off.

how safe is it as I heard that some relays are ran by bad people or government agencies.

Will explain that through an example:

Lets say you visit https://twitter.com/ your traffic enters the Tor network then exits at Twitter's servers and the effects are:

  1. Twitter cannot know your real IP address or physical location.

  2. Your internet service provider will not know that you are using Twitter, because to them you are communicating with the entry node only.

  3. Your traffic within the Tor network is encrypted multiple times in order to prevent any eavesdropping from relay operators. But when your traffic leaves the Tor network and reaches its destination (Twitter's servers) the encryption must be lifted off so that your request can be understood by Twitter, this is why you should always use HTTPS, because HTTPS will encrypt your traffic even after leaving Tor's exit node protecting you from a bad exit that may try to read your data.

EDIT:

The EFF made a nice interactive web page that illustrates the usefulness of using Tor and HTTPS together.

Improve this answer
2
  • 1
    It might also be worth linking to eff.org/pages/tor-and-https. It's a great interactive visualisation of Tor and what sort of attacks it protects against.
    – Philipp Winter
    Commented Sep 26, 2013 at 7:51
  • Thanks Philip I just added it, I am also using it in #5991
    – Sherief Alaa
    Commented Sep 26, 2013 at 7:59
1

In general everyone can operate a relay. Those can be either good or bad guys. Bad guys can do everything. This ranges from passive listening to injecting malicious content. When the main Tor people learn about those bad things they can give the Tor relay a special mark (Bad Exit flag). In this case no other client will use those relays.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .