Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite

I know Tor uses encryption to guarantee anonymity, but I if wish to guarantee the privacy of my conversations should I use an additional layer of encryption?

Can my home router or ISP intercept Tor packets and see its contents?

share|improve this question

3 Answers

up vote 6 down vote accepted

Yes, additional security is necessary. No, your home router or ISP can't intercept the packets.

But then why is additional security still necessary?

If you decide to use Tor for being anonymous but still use personal information then your data will be safe from your PC till the last hop within the Tor network, but the endpoint can monitor your traffic if he wants to. Simply because he no longer has to send stuff over the Tor network, so your data will have been decrypted at that point such that it is no longer encrypted when sent again. That's why you should still use HTTPS instead of HTTP if you want your data to arrive securely at its final destination.

What if a ISP decides to fake responses to Tor traffic?

This is not possible as a public / private key encryption is being used, see the comment thread.

share|improve this answer
It's not theoretically possible. They can't peel off the inner layer of encryption because they don't have the inner key. They can't peel off the layer before the inner layer because to do that, they'd have to send the data to the inner node directly, and there's no way to know what node that is. (That's why governments have a hard time shutting down hidden services -- they can't identify which nodes do the final decryption. If they could figure out which nodes to send decrypted data to, obviously, they would know.) – David Schwartz Jun 19 '12 at 22:22
no it's not possible, the tor.exe has built in a set of known good nodes that must be part of the directory authorities – Jader Dias Jun 19 '12 at 22:32
@JaderDias: But what if the ISP fakes being such nodes? Instead of connecting to such node, the packets get captured by the ISP, which emulates your packet going through a virtual Tor network. That way he can get the original version and then just connect to the real Tor network again pretending it was you. Of course, doing such interception wouldn't be legal; but it's still possible. – Tom Wijsman Jun 19 '12 at 22:45
1  
@TomWijsman I'm no expert, but I suppose the nodes are identified using asymmetrical encryption which renders them impossible to fake. – Jader Dias Jun 19 '12 at 22:51
1  
@TomWijsman: It would be impossible any other way -- for symmetric encryption, you need a secret key known only to the endpoints. Where could that come from? – David Schwartz Jun 20 '12 at 0:19
show 7 more comments
up vote 2 down vote

Your traffic is already encrypted while it is on the Tor network and can be read by no one, not your ISP, not your router, not even the relays that encrypt it. However, when traffic emerges from the Tor network, its source is unknown, but the data is generally unaltered otherwise. It has to be. The recipient wouldn't know what to do with data still encrypted by Tor and will reply and expect to receive data in plain-text.

The exit node therefore can and does decrypt your data. It (and its ISP, etc.) will have the same access as your router, ISP and anyone intercepting your packets would normally have, although they cannot tell whose traffic it is - unless this is evident from its contents.

If you want to protect yourself against this kind of intrusion as well, you need to make sure the communication between you and the recipient is encrypted to begin with. Tor will still add layers of cryptography, but the messages will not be transmitted in plain-text at any time and can only be read by the actual recipient. A lot of instant messaging applications, websites, VoIP and e-mail providers support this (by default).

share|improve this answer
up vote 3 down vote

When reading the Wikipedia article about Tor I found this

how tor works

You see that the last link is unencrypted. So an additional layer of encryption seems to be necessary.

That's not the case when using TorChat because it uses end-to-end encryption

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.