Can someone use WiFi snooping to see data I send through Tor Browser when I'm not using SSL?

Question

(NOTE: I've read other similar questions, but I'm not at all certain about this, therefore I'm asking.)

I travel a lot, and I generally use public WiFi spots and hotels/hostels/boarding houses etc. access points.

I'm a reporter. Sometimes I send my communications to email services and websites which don't use SSL cryptography (no https, just http), and though I KNOW this is not smart, I have no alternative.

What I want to know is if someone locally sniffing the network could read what I send to unprotected (no https) websites. If I send multimedia, pictures, audios etc., can they see/listen to them? Can they see what sites exactly I'm loading?

If so, what would take them? Just being connected to the same network? Having direct access to the router?

Is there anything I can do about it?

Again, I'm talking about people using the same network, snooping locally, and thinking about the data just after it leaves my PC and after it leaves the end node.

Thank you!

Answer 1

The Tor client is running on your local machine, and is responsible for adding the layers of encryption required by onion routing. Therefore your traffic is encrypted before it leaves your computer (i.e. before it is broadcast over the Wifi connection in your proposed situation).

However, if you're not using SSL (i.e. TLS), you could be vulnerable in other ways. The main threat would be a Man-in-the-Middle attack, either by a rogue exit node, or an intermediary between the exit node and website you're visiting. The Tor Browser comes with HTTPS-Everywhere as standard, and tries to enforce the use of TLS.

Have a look at this useful EFF infographic to understand your threat model in the absence of TLS.

Using a VPN in conjunction with Tor doesn't help in this case, as a Man could position himself in the Middle of where you exit the VPN and the website you're visiting.

Answer 2

It would take them to :

1. To just wiretap/eavesdrop in "FULL-STEALTH mode" it is required to be able to control the router. Some public routers are poorly secured ones, so they can be easily hijacked
2. To try to sniff your traffic with minimal self-exposure risk and having no special equipment they just need to be on the same network. It's a WiFi feature abuse, it's called CTO(Call To Others), it's usually enabled by default in your wifi card drivers, and in some VERY simple routers it's even un-disableable. An attacker enters "promicious mode", basically enabling himself to receive copies for all the packets.
3. If an attacker is properly equipped for an active intrusion - it can create a clone for free hotspot and grab all the traffic to himself. Or even create a "free WiFi cheese" hotspot.

You should use a middlebox, routing all the traffic through Tor for you, then it will not matter where you're coming out from.