6

I'm using a hotel's wifi service and need to send sensitive documents back home. A coworker has suggested using tor but I'm uncertain when and where the decryption takes place.

Is it decrypted at the exit node? If it is, when you send or receive a document through tor while using a public network, won't others on the same network be able to view the contents?

6

With tor, the data is decrypted at the exit node. The exit node, plus all routers and networks between the exit node and the target server can see the unencrypted data. Furthermore, you have no control over the exit node, so it may be in any of a number of countries.

What you want is a VPN. Hamachi is a good, easy-setup VPN if both ends are windows clients, but there are other solutions such as OpenVPN if want to ensure you have full control over the entire process from end to end.

3
  • This answer is not completely right. Saying that traffic thru tor is not secure means that an attacker listening on the sender should be able to find out the exit node, and pick up the message from there. But this is exactly what tor makes impossible, especially by using nodes in multiple countries, so that even powerful governments do not have jurisdiction over all of them. And as for intercepting traffic on the receiver's end, good luck with that. But the part about the VPN is right, provided sender and receiver either host the VPN server, or they share a common server. – MariusMatutiae May 3 '17 at 5:20
  • @MariusMatutiae The problem is not the data traveling through tor, but what happens to the data after it leaves tor. And yes, if you run enough exit nodes, you may not be able to decrypt 100% of the messages, but you can still de-anonymize a large enough percentage of them to be worthwhile. – Darth Android May 6 '17 at 23:13
  • Also, with tor you can chose your exit node, contrary to what you say in your answer. – MariusMatutiae May 7 '17 at 5:57
0

Yes just use tor. It is secure and no one will see the contents or know where you are. Proxy VPN or anything has the same vulnerabilities after exit. The only solution is to use https to the server in which case you don't even need tor at all unless you want anonymity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.