1

I am new to Tor. I'm not using it for anything illegal or suspicious, I'm just trying to protect my privacy as best as I can from my ISP, NSA, etc. (primarily my IP address, and anything that could give up my personal identity).

I accidentally logged into YouTube, Facebook and Twitter via Tor yesterday. Have I permanently blown my cover? Have I only blown it for yesterday's browsing? Do I need to buy a new computer or clean install my OS? I'm moving across the country (US) in a couple weeks - does that help my case at all?

Also worth mentioning: The accounts I logged into were WORK accounts. I'm a comedian so I use social media to connect with fans. These channels are in my name but I don't use them for personal/private communication. Also, I'm not the only one with access to these accounts, so is it "possible" that someone who works for me logged into the accounts (manager, agent, assistant)?

To sum up: How big of a mistake was this? And if it was a big one, are there steps I can take to reverse it?

  • 1
    Hi, welcome to Tor.SE; this is a great question! However, it could be even better. If you edited the question to describe your threat model (eg. what exactly are you trying to protect yourself against? Your ISP tracking you, your fans finding out where you are? Are you trying to protect your physical location, or the IP of your laptop? etc.) people will be able to assist you much better. Thanks for posting, and good luck getting a good answer! – Sam Whited Dec 30 '15 at 16:45
1

It's probably not that big of a mistake, as long as you obtained a new Tor identity after you were done (e.g., quit the Tor browser bundle, then restarted it before using Tor for more anonymous purposes). Each time you restart Tor (details vary depending on how you have Tor installed and configured), you will have a new anonymous "identity", in theory distinct from any other past or future Tor identities you may have over time.

The services you logged into now have a record that you (or someone on your team) at some time logged in via a Tor IP address. Some 3rd-party (and 1st-party) trackers may be able to correlate and know that you visited the sites you did. Other users of your work accounts may, depending on the service, be able to see the IP address you logged in from and identify it as a Tor IP address. Your ISP knows only that you connected to Tor, not where you went on Tor or what you did. The Tor exit node could potentially track the sites you went to, but without further exploits, they don't know who you are or where you really are.

A very sophisticated attacker (e.g., state actor) with access to your ISP traffic and your Tor exit node could potentially correlate and determine what sites you went to. But your connections to most of the services you mention will have used TLS (AKA SSL), so the individual traffic from your browser to each service would be encrypted end-to-end (assuming no further exploits to break the encryption).

Your fans will not know where you were when you logged into the services, and neither will the services unless you told them.

  • I assumed this was the case (that the only info I've given up is that myself or someone on my team uses Tor) but didn't know for sure. Thanks for taking the time to give such a thorough answer. – clockplate Dec 31 '15 at 13:47
1

Oh man! You need to sell everything you own now!!! :D

All that happened is your accounts are logged with a known Tor exit node. Thus, you are identified as a Tor user now if logs are checked for any reason. Of course you cant delete their logs.

Pro Tip: If you don't know how a type of technology works, you probably shouldn't use it until you do. Take time to read a Tor white paper...

  • Your pro tip is a good one. I def rushed into this and should have done more reading beforehand. Thanks for the answer! – clockplate Dec 31 '15 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.