What is the possibility or probability that a relay that my browser is using can see and record my traffic?
2 Answers
It's mainly the exit node you'd need to be worried about, as that's where the last layer of encryption added by Tor is stripped off. The other two relays in your circuit (i.e. the entry node and middle node) can't see what's going on because of the encryption added by Tor before it leaves your computer.
So what about the exit node? As Alexey says, the Tor Browser comes with HTTPS-Everywhere enabled by default, and therefore enforces the use of HTTPS (i.e. TLS). Attempts to connect to sites that don't support HTTPS will generate a warning and be prevented. This means you're safe from Man-in-the-Middle attacks by rogue exit nodes.
However, there are other things you should be aware of when assessing your threat model, such as correlation attacks. There's a page on the Tails site (an OS that enforces the use of Tor for all network connections, not just the browser) that would be worth reading in understanding the other threats.
answered Jan 31, 2016 at 19:54
-
Thank you Richard - I see in the Tools Dropdown that the HTTPS Everywhere entry has a drop down arrow but when I mouse over it or click on it nothing happens. How do I know if it is active and can I administrate it in the TOR browser Options anywhere? Thanks for your patience, the learning curve is steep but I am sure it levels out quickly.– ronJan 31, 2016 at 20:45
-
Hmm, the dropdown works in my browser (I'm Linux-based). In you're just trying to click it on the Tor welcome page, try visiting an innocuous website, and then try clicking it. Failing that, navigate to
about:config, accept the disclaimer, and search forextensions.https_everywhere.globalEnabled. It should be set totrue. Jan 31, 2016 at 21:09 -
Actually it turns out that extensions.https_everywhere._observatory.enabled was set to false. I downloaded the software to my Firefox Browser and it worked perfectly there so I was able to compare the settings to find the solution. Thank you for giving me the solution and for your patience.– ronJan 31, 2016 at 23:50
-
the probability is 100% at exit node =) It's an exit node who receives a packets that it sends for you outside. But if you're using SSL/TLS verification - you should not worry about any interventions in your network traffic. About a plaintext traffic there's nothing unusual : it IS insecure, inside Tor, outside Tor or even in your home LAN.
answered Jan 31, 2016 at 17:35
-
Thanks Alexey - my question was more of a privacy one. For instance if a "bad Guy" sets up a relay to get information I send or receive such as passwords or other sensitive information can he identify me, where the information came from or in any way compromise me? I may be missing something basic here but it seems that using "volunteer relays" leaves me open to all kinds of intrusive activities? Maybe you can point me to some more informative writing about TOR privacy issues>– ronJan 31, 2016 at 18:08
-
@ron If you're actively verifying SSL/TLS and enforcing verification checks - then he is unarmed in all the questions you've mentioned.– Alexey Vesnin ♦Jan 31, 2016 at 18:23