1

To establish connection with Tor node I need to send my IP address. Otherwise it will not know where to send reply. How is this better than ssl connection over proxy? Is this only helpful as obfuscation scheme because it's impossible for government to have access to all tor nodes?

I read about encryption of application layer. But some node needs to receive unencrypted version for the whole onion routing to initiate. If government would ask access to this node the whole process would be exposed.

Improve this question
4
  • The answers to this question might help: tor.stackexchange.com/questions/7275/… – Richard Horrocks Sep 19 '15 at 14:57
  • @RichardHorrocks so basically if first node is attacker you're deanonymized because it can intercept the entire request. But it's unlikely because Tor has thousands of nodes/relays. I'm also interested in certificate system because it's unlikely that anyone would consider to register certificate with known CA. They probably use self-signed certs to stay anonymous. It's also likely that half of those relays belong to NSA and they log everything. – pusheax Sep 19 '15 at 17:02
  • If the first node - the entry guard - is owned by an attacker or the NSA, then yes, they know the IP address of the client (you). However, all they know is the IP address and that the client is using Tor; they can't see inside the encrypted traffic stream. It's also likely that your ISP knows you're using Tor, but again, they have now way of knowing what you're using it for. Have a read of this part of the Tor FAQ: torproject.org/docs/faq.html.en#Torisdifferent – Richard Horrocks Sep 19 '15 at 17:38
  • @RichardHorrocks Ok, one point of failure(proxy) vs many(Tor). The probability is better. Also don't really know much about connection relays. It seems they are tunneling data and you can effectively make a handshake with destination host through a series of other hosts. – pusheax Sep 19 '15 at 20:20
0

How is this better than ssl connection over proxy?

It is the same, except it's over a bunch of proxies, such that none of the proxies can see the entire chain. If you use only a single proxy, it can tell where you connect from and to.

But some node needs to receive unencrypted version for the whole onion routing to initiate.

The client connects to the 1st node. It tells the 1st node to connect to the 2nd node. Then it tells the 2nd node to connect to the 3rd node, but the 1st node can not read this, as it is encrypted with the public key of the 2nd node. Likewise, the 1st and 2nd node can not read what the client sends to the 3rd node.

Improve this answer
1
  • I also thought that to minimize risk of different nodes knowing each other Tor can select them from different countries. Wheather it does so is beyond the point. But this scheme now makes sense to me. – pusheax Sep 19 '15 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.