said by the Tor website:

Tor is a toolset for a wide range of organizations and people that want to improve their safety and security on the Internet. Using Tor can help you anonymize web browsing and publishing, instant messaging, IRC, SSH, and other applications that use the TCP protocol.

said by Daniel :

Anyone doubting the legitimate uses of anonymous proxies needs to think about the legitimate uses of encryption as well. Just because something is likely going to also be used for nefarious purposes, doesn't make it inherently evil.

Go read about the EFF if you're confused as to what the purpose of this network is. It's not some network for script kiddies or terrorists; it's a network designed to allow for increased privacy on the Internet. Whether those two end up mixing or not isn't a valid argument against the project.

I mean, the obvious answer here is to not allow the public to have anything that can be used as a weapon. Heading down that path, however, will take us precisely where we don't need to be as a society.

said by novaflare :

Im talking about a script kiddie makeing a hacked version of tor to steel personal information and why no proxies should ever be used to transmit information that is secure.

said by novaflare :

This includes banking info cc numbers log i info etc.

said by novaflare :

As for getting by ip bans etc useing a proxy thats very easy to stop. Scan common proxy ports on all incoming connections and refuse the connection if one of those ports are open.

said by EGeezer :

Once a rogue node is in place, it would seem the node operator would be free to trap and decrypt traffic at their leisure.

said by Daniel :

Again, this is only an issue if the original traffic was unencrypted to begin with, which isn't a good idea (unless you don't care if someone reads it).

In short, if you want your data to be private, encrypt it. The Tor network just bounces whatever you send through its servers with additional encryption.

That being said, if a rougue Tor server was set up, what could it see? Well, if the user encrypted their data they'd simply see encrypted data from another Tor server. I see the benefits of this system being legion compared to any downsides -- especially since it's free.

said by novaflare :

Your wrong there, Daniel. Trafic can be encrypted or decrypted it doesnt matter.

said by Gelroos :

A lot of this reminds me off trying to explain anonymous email using Mixmaster relays and eventual posting to newsgroups for retrieval. People just can't seem to realize that compromised nodes may be able to intercept and READ the data, but if the data is in a form that is UNREADABLE, then the data is useless to them. I can chain proxies and run a SSL tunnel thru several proxies, it may be slow, but the data will transverse the entire chain, ENCRYPTED, and then to the eventual target. If any of the proxy's try to modify the communication the worst that will happen is an error/break in communications. They would have to break the SSL tunnel encryption to READ the data I am sending/receiving. If the website I am communicating with is using SSL, and it is setup right, and my client supports it, then barring decrypting the SSL tunnel, I am pretty secure. Secure enough for what I am using SSL for, if I need more encryption, I use it.

said by EGeezer :

I also wonder what would happen if a legitimate node were to be infected and owned. Since there's no way to verify the security practices of a node operator, there could be a "clueless user" volunteer's system being used as a sniffer or collector of information that could be brute-force decrypted to fish for goodies.

said by nobodyuknow :

I dont think Novaflare is entirely wrong is having some doubts about TOR. I was using tor and I went to a Google search page and it said my PC was infected and ask me to download some software to scan the infection?

said by nobodyuknow :

I dont think Novaflare is entirely wrong is having some doubts about TOR. I was using tor and I went to a Google search page and it said my PC was infected and ask me to download some software to scan the infection? When I disconnect from Tor and went to Google I didn't get the message. So, maybe machines on the TOR network can be infected. It's would be a tempting target I gather.

said by novaflare :

Heres a fun one find a free anon proxy then go to the test and tools pages here and do a port scan. In fact use tor and see what it shows.

said by novaflare :

This is what im talking about. Tor is nothing more than proxy servers running on untrusted pcs. Now what you likly seen was a web site that is scanning for open proxies. Heres a fun one find a free anon proxy then go to the test and tools pages here and do a port scan. In fact use tor and see what it shows. Then tell me this thing is trust worthy.

said by novaflare :

If i understand correctly what tor is in essence is proxies connecting to other proxies and routeing your connection through them. And these proxies are running on personal computers. These personal computers tell the tor server im online and accepting tor connections use me. Now theres a high probability that a large number of these people useing tor are downloading cracks warez and who knows what else. Not the mostt carefull bunch (see many highjack this logs for examples). So warez freak downloads a crack thats realy a trojan you connect to this trojaned pc as your first stop.

said by novaflare :

You a visit somestoresite.com while on this first hop enter your cc etc info. Trojan was used to to install a custom webpage for somestoresite.com that emails your information to hacker who used trojan to install cached page for somestoresite.com. Hacker now has your information. You just got torn up by tor.

said by Daniel :

And what exactly is going to happen when the encrypted traffic comes through that specific host for roughly 60 seconds? What are they supposed to do with that? Assuming there was an attacker on that host, they wouldn't be able to crack the Tor encryption or the encryption that the person should be using if the data was confidential. In short, you gain nothing but a view of some encrypted traffic that you can't break.

said by novaflare :

And if they are infected with something then so are you essentialy.

said by MattUK :

I do not understand your logic here. If a Tor proxy is infected, so what? How exactly is it going to spread this through Tor to other systems? Or am I missing the point entirely?

My understanding is the same as Daniel and others in this thread. It's is about anonymity not encryption, firstly. Any up-standing website that requires personal info will use SSL, which I think you could agree is pretty safe? So how does the Tor system magically decrypt the SSL allowing a Tor proxy to see the info?

said by novaflare :

On ssl its only safe as long as your getting a fresh page. Ive given the example a dozen times. All some one needs tdo is cache the page on a local proxy say squid for example.

said by Daniel :

So let me get this straight, Novaflare -- you're telling me you're able to:

1. Put up a malicious Tor server and have it used by the system.
2. Sit and watch the encrypted traffic moving through it, ignoring the Tor encryption.
3. Put up a fake website for the bank being requested and somehow redirect the user to your daemon.
4. Keep the user from getting a certificate warning after you intercept them.
5. Capture all their credentials from what they thought was a secure site.

Is that what you'd have us believe?

said by novaflare :

Why bother captureing data at all when all you need to do is have the bogus web site email you it unencrypted.

said by Daniel :

I think I'm done here.

said by novaflare :

From tors vey own faq as another poster mentioned its exactly as i thought it might be. Each pc useing tor is also a proxy for tor.

said by nobodyuknow :

I dont think Novaflare is entirely wrong is having some doubts about TOR. I was using tor and I went to a Google search page and it said my PC was infected and ask me to download some software to scan the infection? When I disconnect from Tor and went to Google I didn't get the message. So, maybe machines on the TOR network can be infected.

said by Daniel :

I am at a loss for words.

3.12. Google tells me I have spyware installed.

This is a known and intermittent problem; it does not mean that Google considers Tor to be spyware. Instead, Google tries to detect certain kinds of spyware or viruses that send distinctive queries to Google Search. It then notes the IP addresses from which those queries are received. Finally, Google tries to warn the users of those IP addresses that it received queries indicating an infection.

When you use Tor, you are sending queries through exit nodes that are also shared by thousands of other users. If some of those users are infected with software that Google detects, Google may mistakenly conclude that the exit nodes themselves are infected (because the requests appeared to originate from the exit nodes) and, for a limited period of time, will try (incorrectly) to warn all Google users who share an exit node with an infected machine that they are themselves infected.

You may also get this sort of message when lots of Tor users are querying Google in a short period of time. Google interprets the high volume of traffic as somebody trying to "crawl" their website, so it slows down traffic from that IP address for a short time.

To our knowledge, Google is not doing anything intentionally specifically to deter or block Tor use. The error message about an infected machine should clear up again after a short time.

If we think of a measure that would prevent users from seeing this sort of spurious warning message, we will certainly suggest it to Google and to other web site developers. There may also be technical workarounds for Tor end-users affected by this problem; if you find a useful workaround and write up a description of it, please let us know. [#]

said by Wildcatboy :

I think what novaflare has been trying to say and hasn't been successful in conveying it, is that each Tor server belongs to a totally unknown and most likely untrusted user. The fact that the communication is encrypted won't be enough to stop compromise of your data.

I too haven't had a chance to read the complete overview of Tor but it would be great if someone could clarify this for me:

Let's say I build a Tor server and I also run a proxy server on it that directs all requests for paypal.com, eBay.com, major banks, etc... to my own version of those web pages residing on my server. What in Tor system prevents me from redirecting you to may page? You as a user try to go to paypal, you see my version of it which by the way is quite convincing and you enter your username and password. You can't login and you say to yourself "Oops, Paypal must be down." and move on.

I have your password and the encryption didn't do anything. So can someone tell me how Tor prevents me from doing that and what safeguards are in place? This is a question that novaflare has been asking and I haven't seen an answer for it yet or perhaps I missed it.

said by jp10558 :

Well, with paypal - it is SSL before you ever enter your password. So, paypal prevents it with or without tor. eBay is the same. So, unless you somehow get a verisign SSL cert claiming you are eBay or Paypal, I don't get the problem...

Every financial site I've seen is like this - and if you are in the habit of paying for things without it being secure, TOR isn't going to help - but I doubt it will hurt either.

So, yes, I suppose you could spoof yahoo e-mail, but who's using TOR to access their e-mail anyway? I mean, if you have to authenticate yourself to the end site, I don't see how it was worth all the anonymizing steps...

And if you mean to say you're spoofing google search, you're not getting private info that way...

said by novaflare :

when your entering info in to a moded cached page it does not matter how secure the real site is. SSL never plays a part. Hell why even bother presenting the user with a cert fake or real. Most will asume this is normal and just enter and submit away. Url will show correct anti fishing apps and meathods will be no good etc.