Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been reading about Tor and it's benefits regarding anonymity, but I've also researched its problems. If I understand correctly, when I access a website using Tor the packets are secured using 2 layers of encryption, but the exit node has to send the data unencrypted. This allows me to access any server using the last node's IP address, but it falls short on protecting the data from possible monitoring.

I also own a VPS and I can use it to connect to a server using SSH tunneling and encrypting the data over the network, but it always uses the same IP address.

My questions are:

  1. Is there any way to mix Tor and SSH tunneling in order to get both the encryption and the multiple IP benefits?
  2. When I log in to my account on the VPS using SSH, is my password sent in plaintext?
share|improve this question

1 Answer 1

You can tunnel traffic over SSH with TOR just the same as you can use SSL over TOR to send only encrypted traffic out to the internet from which ever exit node you use. So if you are trying to SSH tunnel into your VPS server over TOR then the exit nodes IP will show up on the VPS server logs not your IP. If you do it in reverse and tunnel into the VPS then out to TOR you will only be passing encrypted traffic if you are using SSL or another form of encryption to protect your data.

SSH does not send any of your information in plain text. If you take a look at the link to the image I included below during step 2 the client encrypts the "key exchange" data with the certificate generated by the server and passed to the client in step 1. The SSH authentication occurs after the handshake has been completed thus keeping your password encrypted.

share|improve this answer
    
"tunnel into the VPS then out to TOR you will only be passing encrypted traffic if you are using SSL or another form of encryption to protect your data" So if I setup a tunnel and, using it, enter the Tor network and, lets say, check my email. My computer sends the data to my VPS and then into the Tor network, and the exit node only recieves the encrypted "blahblahblah"? How does the unencrypted email message enter the mail server? –  Daniel S Dec 31 '11 at 19:57
    
the email will pass in plain text from the time it leaves the VPS and while it travels through TOR where any of the nodes it passes through could potentially sniff it if you are not using encryption to reach the email server. Most likely your email service provider will only allow connections from inside its own network (unless it is public ie gmail etc.) You want to look into using SSL/TLS to ensure your message cannot be sniffed. –  Mark S. Dec 31 '11 at 22:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.