What is the possibility or probability that a relay that my browser is using can see and record my traffic?

2 Answers 2


It's mainly the exit node you'd need to be worried about, as that's where the last layer of encryption added by Tor is stripped off. The other two relays in your circuit (i.e. the entry node and middle node) can't see what's going on because of the encryption added by Tor before it leaves your computer.

So what about the exit node? As Alexey says, the Tor Browser comes with HTTPS-Everywhere enabled by default, and therefore enforces the use of HTTPS (i.e. TLS). Attempts to connect to sites that don't support HTTPS will generate a warning and be prevented. This means you're safe from Man-in-the-Middle attacks by rogue exit nodes.

However, there are other things you should be aware of when assessing your threat model, such as correlation attacks. There's a page on the Tails site (an OS that enforces the use of Tor for all network connections, not just the browser) that would be worth reading in understanding the other threats.

  • Thank you Richard - I see in the Tools Dropdown that the HTTPS Everywhere entry has a drop down arrow but when I mouse over it or click on it nothing happens. How do I know if it is active and can I administrate it in the TOR browser Options anywhere? Thanks for your patience, the learning curve is steep but I am sure it levels out quickly.
    – ron
    Jan 31, 2016 at 20:45
  • Hmm, the dropdown works in my browser (I'm Linux-based). In you're just trying to click it on the Tor welcome page, try visiting an innocuous website, and then try clicking it. Failing that, navigate to about:config, accept the disclaimer, and search for extensions.https_everywhere.globalEnabled. It should be set to true. Jan 31, 2016 at 21:09
  • Actually it turns out that extensions.https_everywhere._observatory.enabled was set to false. I downloaded the software to my Firefox Browser and it worked perfectly there so I was able to compare the settings to find the solution. Thank you for giving me the solution and for your patience.
    – ron
    Jan 31, 2016 at 23:50
  • No problem :) Welcome to the site. Feb 1, 2016 at 9:40

the probability is 100% at exit node =) It's an exit node who receives a packets that it sends for you outside. But if you're using SSL/TLS verification - you should not worry about any interventions in your network traffic. About a plaintext traffic there's nothing unusual : it IS insecure, inside Tor, outside Tor or even in your home LAN.

  • Thanks Alexey - my question was more of a privacy one. For instance if a "bad Guy" sets up a relay to get information I send or receive such as passwords or other sensitive information can he identify me, where the information came from or in any way compromise me? I may be missing something basic here but it seems that using "volunteer relays" leaves me open to all kinds of intrusive activities? Maybe you can point me to some more informative writing about TOR privacy issues>
    – ron
    Jan 31, 2016 at 18:08
  • @ron If you're actively verifying SSL/TLS and enforcing verification checks - then he is unarmed in all the questions you've mentioned.
    – Alexey Vesnin
    Jan 31, 2016 at 18:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .