I know Tor uses encryption to guarantee anonymity, but I if wish to guarantee the privacy of my conversations should I use an additional layer of encryption?
Can my home router or ISP intercept Tor packets and see its contents?
Yes, additional security is necessary. No, your home router or ISP can't intercept the packets.
But then why is additional security still necessary?
If you decide to use Tor for being anonymous but still use personal information then your data will be safe from your PC till the last hop within the Tor network, but the endpoint can monitor your traffic if he wants to. Simply because he no longer has to send stuff over the Tor network, so your data will have been decrypted at that point such that it is no longer encrypted when sent again. That's why you should still use HTTPS instead of HTTP if you want your data to arrive securely at its final destination.
What if a ISP decides to fake responses to Tor traffic?
This is not possible as a public / private key encryption is being used, see the comment thread.
|show 7 more comments|
When reading the Wikipedia article about Tor I found this
You see that the last link is unencrypted. So an additional layer of encryption seems to be necessary.
That's not the case when using TorChat because it uses end-to-end encryption
Your traffic is already encrypted while it is on the Tor network and can be read by no one, not your ISP, not your router, not even the relays that encrypt it. However, when traffic emerges from the Tor network, its source is unknown, but the data is generally unaltered otherwise. It has to be. The recipient wouldn't know what to do with data still encrypted by Tor and will reply and expect to receive data in plain-text.
The exit node therefore can and does decrypt your data. It (and its ISP, etc.) will have the same access as your router, ISP and anyone intercepting your packets would normally have, although they cannot tell whose traffic it is - unless this is evident from its contents.
If you want to protect yourself against this kind of intrusion as well, you need to make sure the communication between you and the recipient is encrypted to begin with. Tor will still add layers of cryptography, but the messages will not be transmitted in plain-text at any time and can only be read by the actual recipient. A lot of instant messaging applications, websites, VoIP and e-mail providers support this (by default).