Comment by plg | Hacker News Reader

Comment by plg | Hacker News Reader

Parent Full thread

but with Tor you are only anonymous at the exit node, right? Sure, your ISP (or anyone else listening in) doesn't know WHERE you are connecting to, when you use Tor, but if the connection isn't encrypted (for example using SSL or ssh) then they sure can listen in to WHAT you are sending and receiving. In other words if the traffic between your computer and the Tor entrance node is not encrypted (and it wouldn't be unless you are using SSL or ssh), your ISP (or any third party listening in on that traffic) can read everything you are doing. Or am I mistaken?

You're mistaken. With Tor you are (in theory) anonymous at every leg of the journey. The only connection Tor doesn't encrypt is the connection between the exit node and the server you're connecting to, which is unavoidable. Your ISP can probably tell you're using Tor, but they won't know what you're sending or what its ultimate destination is.

In a little more detail, when connecting through a circuit of Tor routers R1 -> R2 -> R3, the encryption looks something like this.

    client <- E1(E2(E3(msg))) -> R1 <- E2(E3(msg)) -> R2 <- E3(msg) -> R3 <- msg -> server

It's not perfect, though. If you can see the traffic between the client and R1 and between R3 and the server and you're being reasonably clever you can probably break Tor's anonymity. (This is what's called an 'end-to-end correlation attack'.)

Hey thank you for the clarification!! I didn't realize there was any encryption at all with Tor. RTFM I guess ;)

Reply on news.ycombinator.com