Let's work our way backward.

I understand that the Tor exit node would not know who I am, because the request it is sending out is encrypted via HTTPS. But, the website it connects to would realize that a connection from that Tor exit node made a purchase for myself, or logged into a self-identifying account. Put short, they'd know that my identity was connecting to them via that Tor exit node.

Let's say that website lets the world know that I made a purchase from that Tor exit node. My thought is that other websites probably couldn't deduce my identity simply from an exit node IP, even if they knew I exited from that node, previously. I'm also thinking that even though the exit node is consistently getting requests from the same middle node, it wouldn't be able to identify that any of those requests are coming from my identity vs. other identities from that middle node. Leading to the only possible case of compromised identity being someone having access to all 3 Tor nodes, making it possible for them to trace connections. But, even if they had all 3 nodes, in my setup the entry node would be seeing an HTTPS-encrypted connection from a VPN.

This leads me to believe that I could safely log into all of my accounts and buy the same item with the same credit card a million times over, and the only way my identity could be compromised to sites I don't make purchases on is if my VPN had access to all three of my Tor nodes. Am I wrong, or am I wrong?

END GOAL: I would like to be able to buy something on Amazon and login to Facebook, then go read some random journal, all through the same browser connection, and that journal would have no idea who I am, even if Amazon and Facebook told them that I'd made purchases or logged in from that specific Tor exit node.

  • 2
    If you used a CC, they know who you are.... – Moab Jan 1 at 21:39
  • I understand that the website I made the purchase on would know who I am. But, that wasn't my question. I'm wondering if I can be safe to make purchases on some sites while then opening up a new tab and navigating to another site anonymously. – N N Jan 1 at 21:42
  • 1
    I assume that this the purpose of TOR, but exit nodes have been known to be compromised. – Moab Jan 1 at 21:44
  • That's where the VPN and HTTPS are critical in this question. The VPN anonymizes the entry to the Tor network. And HTTPS means that none of the Tor nodes should be able to decrypt and obtain the original request information if compromised. Or so I'm thinking. – N N Jan 1 at 21:51
  • 2
    Tor conceals your location. It does not and cannot conceal your identity. That remains up to you to engage in proper operational security practices if you wish to do so. – Michael Hampton Jan 2 at 0:39

After conducting more research and based off comments on the original question, it appears that other sites (sites other than Amazon or Facebook in this example) could identify you only via a few sneaky methods.

  1. Browser fingerprinting -- this would be difficult to do if you're using the Tor Browser, since it uses default settings that most other users on the Tor network would share.

  2. Cookies -- Facebook and Amazon might store cookies in your browser session that another site could potentially get access to. The Tor Browser only clears cookies automatically on startup, so these could be hanging around. But there are plugins to auto-delete cookies.

  3. WebRTC, malicious javascript -- VPNs can disable all WebRTC (which could potentially expose your personal IP), and the Tor Browser has the NoScript plugin installed to allow control over what javascript runs on a page.

So, if you are using a VPN that can disable WebRTC and you're using the Tor Browser with properly configured plugins (NoScript, cookie auto-deleter, maybe even an intelligent canvas scrambler), there aren't any remaining openings that I am aware of.

  • From my understanding, webRTC is already disabled in Tor. The VPN does nothing for what the destination sites can see or do, it only affects what your ISP (and perhaps therefore your government) can see, namely that you are using Tor. I wouldn't risk using Tor simultaneously for identified traffic and anonymized traffic, there are too many vectors and it's an arms race. Simply change Tor Identities, or re-launch Tor, or run another Tor instance on a separate physical machine or VM. – pseudon Jan 2 at 19:14
  • But it depends on your threat model... what are the potential harms of correlating your identified traffic with your anonymous traffic? (rhetorical question) – pseudon Jan 2 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.