Scott Bennett wrote:
If you set up something like that you're opening up all sorts of attacks against the people who use your service. If they don't know that all of their plain text traffic can be read and modified by, "dodgy," exit nodes, and almost certainly *will* be at some point...How will they be subject to any greater number of possible attacks if their connections are funneled through tor than if they are not? They can go to any of several coffee shops in the area and use unencrypted, completely unprotected, free or paid wireless services. They just can't do that at home. If you see some way by which anonymizing their TCP source addresses and their UDP port 53 (name service) packets' source addresses when they access the Internet at home will cause them to suffer more attacks than they will in any public location or, for that matter, from a direct connection in their own dwelling if they had one, please enlighten me.
If they use an Internet cafe, their traffic is subject to being monitored. If they use Tor it is *also* subject to being modified.
Example 1:Your user goes to http://www.hotmail.com/ and enters their login details. The Tor exit node controller has written something to modify the html on that page so the form posts to a http url instead of a https url. Their login details are now compromised.
Example 2:Your user goes to http://www.msn.co.uk/livemessenger to download msn messenger. They click the "download it now" link. The tor exit node controller intercepts that request and returns a modified exe containing a trojan instead of the original.
Scary huh?Of course, you could argue that the person running the Internet cafe or the ISP could do that, but I am inclined to believe it's much more likely to occur on the Tor network than in those cases.
Aside from that, the only IP addresses that could conceivably be
discovered would either be the one temporarily assigned to my connection
or the one assigned on a private network by my wireless router via DHCP.
In any case, I still would appreciate helpful information, so I'll
repeat my questions here, quoting from my original query:
The anonymity of the IP address is not at issue here. The issue is, by using Tor, you allow the possibility of exit nodes monitoring and modifying traffic, so you should only use Tor if you truly understand these issues and how to deal with them.
IMHO. There's no need to use Tor for general web browsing, and at the end of the day it probably makes your online experience more dangerous rather than less dangerous.
Mike