There a bit of truth to both views. Tor does encrypt traffic from the user's computer through to the exit node. Thus is appears as an SSL vpn for TCP traffic to all observers between the user and the exit node.
What Dan did was setup malicious exit nodes "mal-nodes" to sniff on the traffic exiting those nodes. People we logging into webmail on unencrypted channels. Theoretically you could create an end-to-end encrypted tunnel using tor by running an exit node inside your network and selecting your exit node to be that node. -----Original Message----- From: "Ali, Saqib" <[EMAIL PROTECTED]> Date: Tue, 25 Sep 2007 08:15:14 To:[email protected] Subject: [FDE] Tor is an Anonymizer NOT a VPN Wired is reporting on how many folks mistake TOR for an end-to-end encryption channel. TOR is merely an anonymizer. Freelance security researcher Dan Egerstad discovered that any were using TOR to send confidential information. >From the article < http://www.wired.com/politics/security/news/2007/09/embassy_hacks >: Among the data he (Dan Egerstad) initially collected was e-mail from an Australian embassy worker with the subject line referring to an "Australian military plan." Under Tor's architecture, administrators at the entry point can identify the user's IP address, but can't read the content of the user's correspondence or know its final destination. Each node in the network thereafter only knows the node from which it received the traffic, and it peels off a layer of encryption to reveal the next node to which it must forward the connection. (Tor stands for "The Onion Router.") But Tor has a known weakness: The last node through which traffic passes in the network has to decrypt the communication before delivering it to its final destination. Someone operating that node can see the communication passing through this server. Read more at: http://www.wired.com/politics/security/news/2007/09/embassy_hacks _______________________________________________ FDE mailing list [email protected] http://www.xml-dev.com/mailman/listinfo/fde _______________________________________________ FDE mailing list [email protected] http://www.xml-dev.com/mailman/listinfo/fde
