How Tor Works? (The Onion Router)
ฝัง
- เผยแพร่เมื่อ 28 เม.ย. 2024
- Tor or (The Onion Router) is a free and open source project for allowing anonymous communication.
In this video I want to discuss this technology and explain how it works.
* What can sniffers really see?
* Why Tor? Why don’t we just use a VPN?
* How Tor Works?
* More about Tor
So if you are interested stay tuned.
TimeCodes:
0:00 Intro
1:30 Normal Request
4:30 What sniffers see
6:00 Why Tor and not VPN?
8:50 How Tor Works
21:00 More tor info
Download slides here payhip.com/b/dLCk2 (members get all slides for all my videos free)
🏭 Software Architecture Videos
• Software Architecture
💾 Database Engineering Videos
• Database Engineering
🛰 Network Engineering Videos
• Network Engineering
🏰 Load Balancing and Proxies Videos
• Proxies
🐘 Postgres Videos
• PostgresSQL
🧮 Programming Pattern Videos
• Programming Patterns
🛡 Web Security Videos
• Web Security
🦠 HTTP Videos
• HTTP
🐍 Python Videos
• Python by Example
🔆 Javascript Videos
• Javascript by Example
Support me on PayPal
bit.ly/33ENps4
Become a Patreon
/ hnasr
Stay Awesome,
Hussein - วิทยาศาสตร์และเทคโนโลยี
Many asked how does the client obtain the 3 keys without showing its identity.. here us how it happens..
The TLS handshake happens incrementally as follows
C client, T-1,2,3 tor nodes, D destination
C - T1 - T2 - T3 - D
C establishes TLS with T1 and agree on key lets call their key Kct1
C sends an encrypted message to T1 asking it to establish TLS with T2 the way it does this T1 acts like a forwarding agent. It forwards the tls client hello to T2 on behave of C so technically T1 is now MITM but it cant really derive the keys agreed between C and T2 and T2 doesn’t know it is talking to C because T1 is the mediator so now we get Kct2
Now using the same trick, C tries to TLS to T3 but encrypts the TLS hello with kct2 then encrypts that with Kct1 then sends it to T1, T1 decrypt sees garbage forwards it to T2, T2 decrypt sees a tls hello from T1 to T3 sends it.. and the same thing happen which finally results in Kct3
As a programmer for 10 plus years, you are the best channel i yet discovered. Great blend of deep technical info and graphics plus nice humour. Keep it up
Welcome aboard! Thank you so much for your comment I appreciate you
You're doing a great job: You always go into the nitty-gritty details of the subject matter which I've increasingly missed elsewhere.
"They're from california thats why they talk like that" LMAO
Amazing. Best actual description of how Tor works 👍
This was a really entertaining way to learn about this. Educative and funny 😂 You`re good! Thanks a lot for your great explanation.
Thank you! 😃
I just liked the completeness of the explanation! Well done
Great explanation. It would be great to see an updated video incorporating questions answered below and even a more in-depth of what each packet contains.
Muirios Vanbrugh I agree! We learned so much ever since and great questions were asked. 👍
Great video! Explained beautifully.
Great explanation, thank you!
Thank you so much Hussein! Awesome video!
Amazing explanation, easy to comprehend, super Fun! Keep up👍🏼
Saad Itani thank you Saad! Glad you enjoyed it .
Greatly Explained
Beautiful presentation!
Love the content. ❤️
Thanks that was easy to follow and fun
ur channel is a gold mine
Thanks ! Best comment I got, made my day 🌞
BEST EXPLANATION!!
very well explained
great stuff!!
Great talk!
Very nice explanation, you should definitely do a movie about dark net.
Superb explanation
This guy is awesome 👌😍
Nice explanation
Thumbs up for making a topic as boring as this fun to listen to.
Crystal clear :)
Yash Desai 💎🙏
nice homor.. very insight topic
what a Great explanation i like it
Thanks Ayoub
Great explaination, you know your stuff.
One question: How do you prevent being compromised, while negotiating the keys with the nodes?
tubalcain thanks! I learn more as I make more videos and great question
This is something I missed talking about in the video. The client (you) negotiate key with first node using DH. Then establishes a TLS connection the first node. It then uses the first node as a proxy to negotiate the key with second node. So second node only knows that first node is talking to it but the first node can’t even get the key that is negotiated with node 2 because of property of Diffien helman (DH) ( check out my TLS video to learn more)
Once we have the second key, we do the same thing, connect to first node and proxy to second node which will connect us to third node which only sees node 2.
We then negotiate 3rd key.
Very smart and extremely hard to break.
Hope that helps!
(TLS 1.3 video th-cam.com/video/ntytZy3i-Jo/w-d-xo.html)
The spec
gitweb.torproject.org/torspec.git/tree/tor-spec.txt
@@hnasr thanks 👍and sorry, I was scrolling down the comments and saw the same question already ask, haha. Shame on noob me 😂
@@hnasr if that's the case how does the client know all the keys?
Great!
Great explanation. But wouldn't the identity of the client be compromised while creating the symmetric keys with the relay nodes?
Thanks! This is a question that I have been trying to answer for a while.
Edit:
More info on this now that we know more (thanks everybody)
This is something I missed talking about in the video. The client (you) negotiate key with first node using DH. Then establishes a TLS connection the first node. It then uses the first node as a proxy to negotiate the key with second node. So second node only knows that first node is talking to it but the first node can’t even get the key that is negotiated with node 2 because of property of Diffien helman (DH) ( check out my TLS video to learn more)
Once we have the second key, we do the same thing, connect to first node and proxy to second node which will connect us to third node which only sees node 2.
We then negotiate 3rd key.
Very smart and extremely hard to break.
Hope that helps!
(TLS 1.3 video th-cam.com/video/ntytZy3i-Jo/w-d-xo.html)
The spec
gitweb.torproject.org/torspec.git/tree/tor-spec.txt
Ok, thanks.
The client establishes the symmetric keys with the other relays through the entry node (never directly talking to other relays) thanks to the magic of the "Diffie-Hellman" key exchange method that allows the client to establish a shared secret over an insecure channel.
@@hnasr The Onion proxy runs on the client machine
@@hakkerb35 So if I understand your statement correctly, using video clip at 14:35 as the example, T1 would be the entry node? If this is to be true then Client A would tell T1 it needs a guard key, middle key and exit key? If this is to be true then T1 would reach out to both T2 & T3 passing on the info back to Client A?
but the last node knows who initiate the request (it can relate the key with client during the first setup) and where the request goes to, is this a problem?
ooooooo that's a NICE packet
Great explanation! :)
What software do you use for editing videos?
Thanks!! I use iMovie and Canva
There's one thing I don't quite understand. The last exit node knows it is the last node, because after decrypting it sees a meaningful request. The last node receives the encrypted request from the previous node, so it shouldn't know about the original requester, but what about the KEY exchange?? Since the last node knows it is the last one, shouldn't it figure it out that whomever it established the symmetric key with is the original requester? Diffie-Helmann is still tied to IP's, isn't it? Shouldn't the exit node have all the pieces of the puzzle? The IP of whoever established the key with them and the request itself?
Good question, the TLS handshake happens incrementally as follows
C client, T-1,2,3 tor nodes, D destination
C - T1 - T2 - T3 - D
C establishes TLS with T1 and agree on key lets call their key Kct1
C sends an encrypted message to T1 asking it to establish TLS with T2 the way it does this T1 acts like a forwarding agent. It forwards the tls client hello to T2 on behave of C so technically T1 is now MITM but it cant really derive the keys agreed between C and T2 and T2 doesn’t know it is talking to C because T1 is the mediator so now we get Kct2
Now using the same trick, C tries to TLS to T3 but encrypts the TLS hello with kct2 then encrypts that with Kct1 then sends it to T1, T1 decrypt sees garbage forwards it to T2, T2 decrypt sees a tls hello from T1 to T3 sends it.. and the same thing happen which finally results in Kct3
Thnks for great explanation ....but How are t1 t2 and t3 desided are they desided form all the number of clients that are currently online on tor browser if i am using tor browser is someone elses network traffic going through my computer
Usama Wizard those nodes are not normal clients, (tor browser) those must be an actual tor node. You download the software and agree to be a tor node so traffic goes through you.
If you use the tor client you are a user..
Hope that helps
Could you please share the presentation Sir ??
If TOR uses the nodes, and the nodes communicate with each other- wouldn’t you be able to be tracked via following the nodes back to the source? I don’t know much about computer stuff, I just got curious and looked this up.
Each node only know the node before it and after it. So yes if you are running all the 3 nodes you will be able to track the request to its source. In reality its very hard to do.
I love onions!
The real question here is, is the first tor node reliable? Is a trust problem, exactly like the vpn one.
I have a doubt. If someone in the circuit disconnect their tor browser, their node will no longer be in the circuit. What will happen at that time??
1)
If i give get request already and waiting for the response, and suddenly a node goes offline. What will happen?
2)
If i use tor, mine will also be a node, so i transfer data to some website for someone else. If they are doing something illegal, I'm the one who is going to be in trouble. Right?
3)
And am I using extra data?
For example, I'm watching a video which is 5mb in size, if i am involved in tor circuit and someone else is watching other video of 100mb (in 10 mins, cuz after that circuit will change). So am i going to lose 105mb data?
I am sorry if my questions are silly. I am new to these kind of topics. Please explain
So, if the client sets up separate symmetric keys with all three relay nodes then won’t the relay nodes detect the client when the packet reaches the nodes? Because only the correct key can decrypt the packet and that key was generated with the client.
Okay, that’s same question as Chima! But, it is widely accepted, so maybe you are missing something?
G M yes I missed to mention a very important point in the video. The client enters the Tor network using an Onion Proxy which negotiates the keys on behalf of the client with the 3 tor nodes. So the tor nodes don’t know the identity of the client. 👍
Usually the onion proxy is also the first node or the entry node which already knows the client so it negotiates the keys on its behalf.
The info that the exit node at max will know the ip A is connecting to and not the actual data right because the data will be encrypted between A and B?
Palaniappan RM the exit node will see the data (except if its encrypted with TLS) but exit node doesn’t know the IP address of A
@@hnasr TLS between A and B mostly will be there right?
Mostly correct for all websites (HTTPS)
interesting video...hypothetically speaking, if you were engaging in illegal activity - could the exit node not be held liable given that the destination IP will know who they are? isnt this just like shifting the onus onto the exit node?
That is a good question, i dont really know the answer.
Technically all nodes facilitied the illegal activity. But I don’t think they should be held accountable.
Its like arresting the black smith that made a knife because his knife was used in murder scene? I don’t know 🤷♀️
Interesting question though
@@hnasr found this
www.reddit.com/r/TOR/comments/b7rfb4/are_exit_node_operators_legally_responsible_if/
@@hnasr technically your example is not a direct comparison because the black smith never stabbed anyone..in this case the exit is actually the one committing an illegal act, albeit unknowingly
but thank you for this video
So, if each transmission is only aware of the directly connected nodes, wouldn't it still be possible to track?
Let's say I'm accessing illegal content and law enforcement were able to get a warrant, couldn't they simply monitor the next hops and follow it back? It might be hard to determine which packet belongs to which circuit but if few enough people were using it they might be able to link the nodes based on where they are sending packets and draw a path back to you
Correct, if cia is running tor nodes and you happened to land on a circuit of 3 nodes run by the CIA they can know which sites you are visiting. However they still can’t see what content you are access if the website is secured (HTTPS) unless the actual website shares that info with them
How does the ISP know to block a traffic for a TOR server? Do or can their Edge router decrypt and encrypt the packet to identify the circuit number before forwarding it to the next hop?
Telisi John I was thinking the ISP can block the IP addresses of the most common TOR directories out there.. so clients cant even get to create a circuit.
I don’t believe they can decrypt the traffic since they shouldn’t have the key.
Thanks. I forgot about the ISPs can in fact blockhole traffic destined for TOR server if they see it fit. How about torrent servers designed for educational purpose, can you stream traffic from torrent servers using TOR?
Yes Of course you can stream over tor since tor operates at TCP layer (4ish). and torrent uses tcp
Using Deep packet sniffer they can identify the traffic flow as Tor and block it that way. If they do block it based on traffic flow then you would need to use a pluggable transport; this makes tor traffic flow look like innocent-looking traffic.
What about VPN over TOR?
Would you do video about vpn? Technology I mean, not the if I should...
I actually do have a video comparing it to a proxy th-cam.com/video/npnqyRT77Zc/w-d-xo.html
what happens when the data packet is decrypted at the exit node and sent to the server? is that data not unencrypted and exposed at that point? good video btw
It depends on what any other privacy methods you use, for example, if you use HTTPS instead of HTTP, data between the exit node and the server (your actual data) won't be exposed to anyone.
@@neotodsoltani5902 yea I was thinking this. would that show in TOR I guess in the usual place if TLS is being used?
If you were a professor I would have actually graduated from college
something I don't understand - if the encryption process starts at the exit node and works backwards, doesn't it mean that the exit node knows who i am as well? if it is not the request I am sending, which contains my IP address, that is being transmitted when the encryption starts, what exactly is being transmitted? and where is it coming from?
Shimon Abitbol I explained that in the video, the request packets are being encapsulated and and changed to reflect the correct SOURCEIP address so that each nodes knows the nodes before it.
On top of that each layer is encrypted with the node’s key.
Can My Internet Admin View My Browsing History?
how do i access it?
So basically, through a series of nodes, we encrypting the data 3 times and sending it to the server right?
Correct and the client knows how the decrypt all 3 layers
@@hnasr thank you! You're video was very helpful. I'm gonna hit subscribe. I hope u keep posting good quality videos
So our provider can see our traffic! Because the IP Source is in clear!
Your provider will see that you are sending traffic to the first TOR node IP address. ISP will not see your final destination in TOR
@@hnasr Then the traffic can be read!
Man, you are crazy, but like for nice explanation.
Does T1 know for sure that I'm the origin of all this process? Or it thinks that I'm just another relay for another TOR client behind me?
Correct T1 knows that you are the origin and it knows your IP address (unless you used a Proxy to connect to T1) in this case T1 will know the Proxy's IP..
T1 does not know where you are going just that you are using Tor
T3 knows that someone is going to B but doesn't know who (It knows T2 wants to go there)
There is something I missed in this video is key exchange . The client (you) negotiate key with first node using DH. Then establishes a TLS connection the first node. It then uses the first node as a proxy to negotiate the key with second node. So second node only knows that first node is talking to it but the first node can’t even get the key that is negotiated with node 2 because of property of Diffien helman (DH) ( check out my TLS video to learn more)
Once we have the second key, we do the same thing, connect to first node and proxy to second node which will connect us to third node which only sees node 2.
We then negotiate 3rd key.
Very smart and extremely hard to break.
Hope that helps!
(TLS 1.3 video th-cam.com/video/ntytZy3i-Jo/w-d-xo.html)
@@hnasr very clear. But I wonder if it's possible to build something similar to TOR, but with all nodes are unable to make sure if the received packet came from an origin or from a relay node? 🤔🤔 Food for thought
Basically it is super fire fox
Why should I trust any TOR directory?
How could someone circumvent this process? Seems almost impossible
The onion rounter can create visit to dark web
The onion rounter can visit dark web
İf we use tor, is that mean we are may become a exit node ?
Eren Sertkaya no , you become a tor server node when you install the tor server node software. When you use tor as a client you only download the client tor software.. good question!
No you become only spied by CIA running tor relays
@@hnasr Thanks for your good explanation :)
9:23 *Your client makes a request to a Tor Directory.*
Is this a direct request ??? Does the Tor Directory server knows the IP of the client ????
Yes the directory knows the client IP, but it doesn’t tell what websites the client is consuming. All it does is reveals that this client uses TOR
@@hnasr This seems bad. It means that the directory servers know all IPs that uses Tor.
Tor browser was made to track their clients.
I wouldn’t be surprised. It has access to pretty much everything. Unless you can compile it from Source You can’t trust it.
07:06 Raison I subscribed .
You're cool .❤️❤️❤️
left after 2min ....
Your English is so different 🤣🤣
انا عربي لم افهم ماتقوله يا اخي
ط1
Nice video. Thank you. Can you please do less jokes?
There are tons of boring explanations about this topic out there. Get out of this funny one if it doesnt pleases you.
The accent ...
HAhAgAg aaaGAgAGaGaGAgGaGAgaAGGbaBaGAGGaGavBaB
unnecessarily long
Try to put your back into it, or at least prepare your presentation.