| defcon writes:
|
|> I have been using tor for a while now, and I absolutely love it, although
|> the only thing keeping me from using it, is the insecurities of the exit
|> nodes. I know to truly stay anonymous you should stay away from personal
|> accounts "but" how can I connect through tor to gmail or other ssl
enabled
|> services without risking my password being sniffed or my dns request
being
|> hijacked. Any advice would be greatly appreciated!
|
| The answer is to use SSL. I'm not sure but I think you meant to say
"... or
| other *non*-ssl enabled serviecs...".
|
| In the particular case of Gmail: Gmail normally uses HTTPS for the login
| phase but not thereafter. That is of course totally silly, because
while the
| attacker won't see your password they will still see your Gmail session
| cookies. That's all they need to hijack your Gmail session -- they don't
| need your password. BUT! the good news is that if you go to Gmail via
|
https://mail.google.com/, Gmail will use HTTPS for the entire session, not
| just the login phase, and then you are as safe as anyone ever can be from
| network eavesdroppers (including traffic-sniffing Tor operators).
|