TOR and Exit Nodes

[JTX]

Just opened this new topic to hear your opinion about ANONYMIZER solutions such us TOR and others regarding security risks. Many times TOR useres were compromised because of the problem regarding the exit nodes.

I think it is not unrealistic to assume some goverments, secret police, intelligence services or military intelligence services have interest to intecept such traffic through the exit nodes. As it is simple to set up an exit node in the TOR Network this makes things very easy.

How do you estimate such risks? Do you prefer other services or technologies to anonymize your traces while walking through the net?

[ArgentPyro]

For awhile, there was a site(http://www.derangedsecurity.com/), that set up 3 different computers to act as exit nodes on the TOR network. Then, they collected all packets that passed through these computers and used mail protocols, IMAP, POP3, etc. They looked for keywords such as 'military', 'government', 'legal', etc. All information that passes through TOR is encrypted for the first 2 or 3 proxies it passes through, but the exit nodes aren't. Through this method, they collected government passwords and usernames for a variety of countries, then shared them on their site. They've been shut down now of course. To come back to the point of whether or not using TOR is a risk, I'd say it varies. Things that would normally be encrypted(SSH, TLS) wouldn't be a problem, and if you're afraid that you might be caught using BitTorrent, or another P2P service, don't be. If you're planning on sending the time and date that you're going to set off a bomb to you're fellow conspirators, that is something else. Personally, I think that TOR is a pretty useful thing to use, but don't think of it as anything other than a proxy though(some of which are actually run by the government).

[BuTTHeaD]

Tor makes everything very slooooooooooooow.

[sidebottom]

Through this method, they collected government passwords and usernames for a variety of countries, then shared them on their site.

Uh...doesn't providing identifying information such as user names when using TOR COMPLETELY defeat the purpose of TOR as an anonymizer?

It's just funny that people who have NO IDEA how something like that works use it improperly and feel safe with it.

[ArgentPyro]

Uh...doesn't providing identifying information such as user names when using TOR COMPLETELY defeat the purpose of TOR as an anonymizer?

It's just funny that people who have NO IDEA how something like that works use it improperly and feel safe with it.

Which is where the members of this site come in.

[warnock]

Since this is a TOR related topic, I've decided to simply ask here as opposed to starting a new post.

I was studying up on the website w3schools.com today, when something sort of caught my attention.

The 1st page of the TCP/IP tutorial ( http://w3schools.com/tcpip/default.asp) seems to display your current IP address. I was shocked to discover that it was MY regular IP.

I was using TOR at the time (yes, it was enabled), so I assumed I'd have a different IP address being displayed on the internet.

Without closing anything, I opened up a new tab, and went to "whatismyipaddress.com" to confirm that it was my IP. but that website showed my IP address as the one I got through TOR. Some IP address from the Netherlands.

Without closing or altering TOR or my network connection in any way, I went back to my original tab, opened to the 1st page of the TCP/IP tutorial, which still had my actual IP address on it, and refreshed the page.

After it refreshed, my actual IP address was gone. And the same one that was being displayed on "whatismyipaddress.com from the Netherlands was now showing.

Can someone knowledgeable about such things please tell me why MY IP address was being displayed despite the fact that I'm using TOR?

[sanddbox]

Since this is a TOR related topic, I've decided to simply ask here as opposed to starting a new post.

I was studying up on the website w3schools.com today, when something sort of caught my attention.

The 1st page of the TCP/IP tutorial ( http://w3schools.com/tcpip/default.asp) seems to display your current IP address. I was shocked to discover that it was MY regular IP.

I was using TOR at the time (yes, it was enabled), so I assumed I'd have a different IP address being displayed on the internet.

Without closing anything, I opened up a new tab, and went to "whatismyipaddress.com" to confirm that it was my IP. but that website showed my IP address as the one I got through TOR. Some IP address from the Netherlands.

Without closing or altering TOR or my network connection in any way, I went back to my original tab, opened to the 1st page of the TCP/IP tutorial, which still had my actual IP address on it, and refreshed the page.

After it refreshed, my actual IP address was gone. And the same one that was being displayed on "whatismyipaddress.com from the Netherlands was now showing.

Can someone knowledgeable about such things please tell me why MY IP address was being displayed despite the fact that I'm using TOR?

That was a huge necro, but anyway, most likely you had already loaded the page before you connected to TOR.

[warnock]

That was a huge necro, but anyway, most likely you had already loaded the page before you connected to TOR.

I don't know all of the ins and outs of TOR, But I had it enabled since I began that internet session (which began an hour prior).

Are you saying that some pages load before TOR can accesses it?

or that I loaded the page, and afterwards, manually connected to TOR?

You should know that I didn't touch TOR in the time between getting the two IP addresses.


Wow, this was a necro bump.

In my defense, This post was still on the 1st page.