How Tor Works? (The Onion Router)

Поділитися
Вставка
  • Опубліковано 26 лис 2024

КОМЕНТАРІ • 135

  • @hnasr
    @hnasr  3 роки тому +23

    Many asked how does the client obtain the 3 keys without showing its identity.. here us how it happens..
    The TLS handshake happens incrementally as follows
    C client, T-1,2,3 tor nodes, D destination
    C - T1 - T2 - T3 - D
    C establishes TLS with T1 and agree on key lets call their key Kct1
    C sends an encrypted message to T1 asking it to establish TLS with T2 the way it does this T1 acts like a forwarding agent. It forwards the tls client hello to T2 on behave of C so technically T1 is now MITM but it cant really derive the keys agreed between C and T2 and T2 doesn’t know it is talking to C because T1 is the mediator so now we get Kct2
    Now using the same trick, C tries to TLS to T3 but encrypts the TLS hello with kct2 then encrypts that with Kct1 then sends it to T1, T1 decrypt sees garbage forwards it to T2, T2 decrypt sees a tls hello from T1 to T3 sends it.. and the same thing happen which finally results in Kct3

    • @TheClockmister
      @TheClockmister 5 місяців тому

      Tor client will get a list of tor routers from the directory server. It will pick a random sequence from this tor routers and create session between every node. Each node will have a session with the other node in the path. Session stays open for as long as your client is requesting data.
      TCP handles all, Tor manages.

  • @jacthemuss
    @jacthemuss 4 роки тому +50

    As a programmer for 10 plus years, you are the best channel i yet discovered. Great blend of deep technical info and graphics plus nice humour. Keep it up

    • @hnasr
      @hnasr  4 роки тому +1

      Welcome aboard! Thank you so much for your comment I appreciate you

  • @miguelalejandro7045
    @miguelalejandro7045 4 роки тому +40

    "They're from california thats why they talk like that" LMAO

  • @dmitrikonnov922
    @dmitrikonnov922 2 роки тому +2

    You're doing a great job: You always go into the nitty-gritty details of the subject matter which I've increasingly missed elsewhere.

  • @jongxina3595
    @jongxina3595 2 роки тому

    Amazing. Best actual description of how Tor works 👍

  • @muiriosvanbrugh7146
    @muiriosvanbrugh7146 4 роки тому +6

    Great explanation. It would be great to see an updated video incorporating questions answered below and even a more in-depth of what each packet contains.

    • @hnasr
      @hnasr  4 роки тому +2

      Muirios Vanbrugh I agree! We learned so much ever since and great questions were asked. 👍

  • @saad.83
    @saad.83 5 років тому +10

    Amazing explanation, easy to comprehend, super Fun! Keep up👍🏼

    • @hnasr
      @hnasr  5 років тому

      Saad Itani thank you Saad! Glad you enjoyed it .

  • @Eljulitus
    @Eljulitus 4 роки тому +4

    This was a really entertaining way to learn about this. Educative and funny 😂 You`re good! Thanks a lot for your great explanation.

    • @hnasr
      @hnasr  4 роки тому +1

      Thank you! 😃

  • @1992corvette1
    @1992corvette1 4 роки тому +1

    Thumbs up for making a topic as boring as this fun to listen to.

  • @avivfriedman
    @avivfriedman Місяць тому +1

    Great and clear explanation , thanks!!

  • @mattiamaria1
    @mattiamaria1 2 роки тому

    I just liked the completeness of the explanation! Well done

  • @WiLL-by5sw
    @WiLL-by5sw 3 роки тому

    Thank you so much Hussein! Awesome video!

  • @chimaugochukwu7705
    @chimaugochukwu7705 4 роки тому +8

    Great explanation. But wouldn't the identity of the client be compromised while creating the symmetric keys with the relay nodes?

    • @hnasr
      @hnasr  4 роки тому +9

      Thanks! This is a question that I have been trying to answer for a while.
      Edit:
      More info on this now that we know more (thanks everybody)
      This is something I missed talking about in the video. The client (you) negotiate key with first node using DH. Then establishes a TLS connection the first node. It then uses the first node as a proxy to negotiate the key with second node. So second node only knows that first node is talking to it but the first node can’t even get the key that is negotiated with node 2 because of property of Diffien helman (DH) ( check out my TLS video to learn more)
      Once we have the second key, we do the same thing, connect to first node and proxy to second node which will connect us to third node which only sees node 2.
      We then negotiate 3rd key.
      Very smart and extremely hard to break.
      Hope that helps!
      (TLS 1.3 video ua-cam.com/video/ntytZy3i-Jo/v-deo.html)
      The spec
      gitweb.torproject.org/torspec.git/tree/tor-spec.txt

    • @chimaugochukwu7705
      @chimaugochukwu7705 4 роки тому

      Ok, thanks.

    • @hakkerb35
      @hakkerb35 4 роки тому +1

      The client establishes the symmetric keys with the other relays through the entry node (never directly talking to other relays) thanks to the magic of the "Diffie-Hellman" key exchange method that allows the client to establish a shared secret over an insecure channel.

    • @hakkerb35
      @hakkerb35 4 роки тому

      ​@@hnasr The Onion proxy runs on the client machine

    • @muiriosvanbrugh7146
      @muiriosvanbrugh7146 4 роки тому +2

      @@hakkerb35 So if I understand your statement correctly, using video clip at 14:35 as the example, T1 would be the entry node? If this is to be true then Client A would tell T1 it needs a guard key, middle key and exit key? If this is to be true then T1 would reach out to both T2 & T3 passing on the info back to Client A?

  • @TheSagitta969
    @TheSagitta969 3 роки тому

    There's one thing I don't quite understand. The last exit node knows it is the last node, because after decrypting it sees a meaningful request. The last node receives the encrypted request from the previous node, so it shouldn't know about the original requester, but what about the KEY exchange?? Since the last node knows it is the last one, shouldn't it figure it out that whomever it established the symmetric key with is the original requester? Diffie-Helmann is still tied to IP's, isn't it? Shouldn't the exit node have all the pieces of the puzzle? The IP of whoever established the key with them and the request itself?

    • @hnasr
      @hnasr  3 роки тому +1

      Good question, the TLS handshake happens incrementally as follows
      C client, T-1,2,3 tor nodes, D destination
      C - T1 - T2 - T3 - D
      C establishes TLS with T1 and agree on key lets call their key Kct1
      C sends an encrypted message to T1 asking it to establish TLS with T2 the way it does this T1 acts like a forwarding agent. It forwards the tls client hello to T2 on behave of C so technically T1 is now MITM but it cant really derive the keys agreed between C and T2 and T2 doesn’t know it is talking to C because T1 is the mediator so now we get Kct2
      Now using the same trick, C tries to TLS to T3 but encrypts the TLS hello with kct2 then encrypts that with Kct1 then sends it to T1, T1 decrypt sees garbage forwards it to T2, T2 decrypt sees a tls hello from T1 to T3 sends it.. and the same thing happen which finally results in Kct3

  • @aishwarya6123
    @aishwarya6123 3 роки тому +1

    Great video! Explained beautifully.

  • @deheinrich4785
    @deheinrich4785 5 місяців тому

    If the nodes can look up the CID to see which nodes are in a circuit, then the circuit nodes arent really secret? What am I missing?

  • @jorgeolmedo3474
    @jorgeolmedo3474 4 роки тому +3

    Great explanation, thank you!

  • @IamMclov1n25
    @IamMclov1n25 5 років тому

    ur channel is a gold mine

    • @hnasr
      @hnasr  5 років тому

      Thanks ! Best comment I got, made my day 🌞

  • @brainoverflow98
    @brainoverflow98 3 роки тому

    Beautiful presentation!

  • @psycho.2u
    @psycho.2u 3 роки тому

    I have a doubt. If someone in the circuit disconnect their tor browser, their node will no longer be in the circuit. What will happen at that time??
    1)
    If i give get request already and waiting for the response, and suddenly a node goes offline. What will happen?
    2)
    If i use tor, mine will also be a node, so i transfer data to some website for someone else. If they are doing something illegal, I'm the one who is going to be in trouble. Right?
    3)
    And am I using extra data?
    For example, I'm watching a video which is 5mb in size, if i am involved in tor circuit and someone else is watching other video of 100mb (in 10 mins, cuz after that circuit will change). So am i going to lose 105mb data?
    I am sorry if my questions are silly. I am new to these kind of topics. Please explain

  • @hikariangel6520
    @hikariangel6520 3 роки тому

    The real question here is, is the first tor node reliable? Is a trust problem, exactly like the vpn one.

  • @tashirojima
    @tashirojima 2 роки тому

    but the last node knows who initiate the request (it can relate the key with client during the first setup) and where the request goes to, is this a problem?

  • @umeshb8210
    @umeshb8210 4 роки тому +1

    Greatly Explained

  • @jyotigajrani7031
    @jyotigajrani7031 3 роки тому +1

    very well explained

  • @ripofs8441
    @ripofs8441 2 роки тому +1

    Can My Internet Admin View My Browsing History?

  • @tubbalcain
    @tubbalcain 4 роки тому +1

    Great explaination, you know your stuff.
    One question: How do you prevent being compromised, while negotiating the keys with the nodes?

    • @hnasr
      @hnasr  4 роки тому +2

      tubalcain thanks! I learn more as I make more videos and great question
      This is something I missed talking about in the video. The client (you) negotiate key with first node using DH. Then establishes a TLS connection the first node. It then uses the first node as a proxy to negotiate the key with second node. So second node only knows that first node is talking to it but the first node can’t even get the key that is negotiated with node 2 because of property of Diffien helman (DH) ( check out my TLS video to learn more)
      Once we have the second key, we do the same thing, connect to first node and proxy to second node which will connect us to third node which only sees node 2.
      We then negotiate 3rd key.
      Very smart and extremely hard to break.
      Hope that helps!
      (TLS 1.3 video ua-cam.com/video/ntytZy3i-Jo/v-deo.html)
      The spec
      gitweb.torproject.org/torspec.git/tree/tor-spec.txt

    • @tubbalcain
      @tubbalcain 4 роки тому +1

      @@hnasr thanks 👍and sorry, I was scrolling down the comments and saw the same question already ask, haha. Shame on noob me 😂

    • @jacksonmcginnis1854
      @jacksonmcginnis1854 4 роки тому

      @@hnasr if that's the case how does the client know all the keys?

  • @franksemmi435
    @franksemmi435 4 роки тому +2

    Love the content. ❤️

  • @jacksonmcginnis1854
    @jacksonmcginnis1854 4 роки тому

    So, if each transmission is only aware of the directly connected nodes, wouldn't it still be possible to track?
    Let's say I'm accessing illegal content and law enforcement were able to get a warrant, couldn't they simply monitor the next hops and follow it back? It might be hard to determine which packet belongs to which circuit but if few enough people were using it they might be able to link the nodes based on where they are sending packets and draw a path back to you

    • @hnasr
      @hnasr  4 роки тому

      Correct, if cia is running tor nodes and you happened to land on a circuit of 3 nodes run by the CIA they can know which sites you are visiting. However they still can’t see what content you are access if the website is secured (HTTPS) unless the actual website shares that info with them

  • @Michael89312
    @Michael89312 4 роки тому +1

    what happens when the data packet is decrypted at the exit node and sent to the server? is that data not unencrypted and exposed at that point? good video btw

    • @neotodsoltani5902
      @neotodsoltani5902 4 роки тому

      It depends on what any other privacy methods you use, for example, if you use HTTPS instead of HTTP, data between the exit node and the server (your actual data) won't be exposed to anyone.

    • @Michael89312
      @Michael89312 4 роки тому

      @@neotodsoltani5902 yea I was thinking this. would that show in TOR I guess in the usual place if TLS is being used?

  • @derekeden1163
    @derekeden1163 4 роки тому +1

    interesting video...hypothetically speaking, if you were engaging in illegal activity - could the exit node not be held liable given that the destination IP will know who they are? isnt this just like shifting the onus onto the exit node?

    • @hnasr
      @hnasr  4 роки тому +2

      That is a good question, i dont really know the answer.
      Technically all nodes facilitied the illegal activity. But I don’t think they should be held accountable.
      Its like arresting the black smith that made a knife because his knife was used in murder scene? I don’t know 🤷‍♀️
      Interesting question though

    • @derekeden1163
      @derekeden1163 4 роки тому +1

      @@hnasr found this
      www.reddit.com/r/TOR/comments/b7rfb4/are_exit_node_operators_legally_responsible_if/

    • @derekeden1163
      @derekeden1163 4 роки тому

      @@hnasr technically your example is not a direct comparison because the black smith never stabbed anyone..in this case the exit is actually the one committing an illegal act, albeit unknowingly

    • @derekeden1163
      @derekeden1163 4 роки тому

      but thank you for this video

  • @devashishkprasad
    @devashishkprasad 4 роки тому

    BEST EXPLANATION!!

  • @TheExoHaza
    @TheExoHaza 3 роки тому

    Thanks that was easy to follow and fun

  • @DeusVult1775
    @DeusVult1775 3 роки тому

    If TOR uses the nodes, and the nodes communicate with each other- wouldn’t you be able to be tracked via following the nodes back to the source? I don’t know much about computer stuff, I just got curious and looked this up.

    • @hnasr
      @hnasr  3 роки тому +1

      Each node only know the node before it and after it. So yes if you are running all the 3 nodes you will be able to track the request to its source. In reality its very hard to do.

  • @yashdesai8372
    @yashdesai8372 4 роки тому +2

    Crystal clear :)

    • @hnasr
      @hnasr  4 роки тому

      Yash Desai 💎🙏

  • @rohangaonkar8912
    @rohangaonkar8912 3 роки тому

    Nice explanation

  • @quicktutorials7662
    @quicktutorials7662 4 роки тому +1

    Great explanation! :)
    What software do you use for editing videos?

    • @hnasr
      @hnasr  4 роки тому +2

      Thanks!! I use iMovie and Canva

  • @ajasmt9530
    @ajasmt9530 4 роки тому +1

    This guy is awesome 👌😍

  • @shimon1
    @shimon1 4 роки тому

    something I don't understand - if the encryption process starts at the exit node and works backwards, doesn't it mean that the exit node knows who i am as well? if it is not the request I am sending, which contains my IP address, that is being transmitted when the encryption starts, what exactly is being transmitted? and where is it coming from?

    • @hnasr
      @hnasr  4 роки тому

      Shimon Abitbol I explained that in the video, the request packets are being encapsulated and and changed to reflect the correct SOURCEIP address so that each nodes knows the nodes before it.
      On top of that each layer is encrypted with the node’s key.

  • @usamatahseenulhaque9125
    @usamatahseenulhaque9125 4 роки тому

    Thnks for great explanation ....but How are t1 t2 and t3 desided are they desided form all the number of clients that are currently online on tor browser if i am using tor browser is someone elses network traffic going through my computer

    • @hnasr
      @hnasr  4 роки тому

      Usama Wizard those nodes are not normal clients, (tor browser) those must be an actual tor node. You download the software and agree to be a tor node so traffic goes through you.
      If you use the tor client you are a user..
      Hope that helps

  • @DarkEagle01
    @DarkEagle01 3 роки тому

    What about VPN over TOR?

  • @frankbraker
    @frankbraker 2 роки тому

    Why should I trust any TOR directory?

  • @void_star_void
    @void_star_void 5 років тому

    Superb explanation

  • @astronomer404
    @astronomer404 4 роки тому

    Could you please share the presentation Sir ??

  • @GM-wm8ex
    @GM-wm8ex 4 роки тому

    So, if the client sets up separate symmetric keys with all three relay nodes then won’t the relay nodes detect the client when the packet reaches the nodes? Because only the correct key can decrypt the packet and that key was generated with the client.

    • @GM-wm8ex
      @GM-wm8ex 4 роки тому

      Okay, that’s same question as Chima! But, it is widely accepted, so maybe you are missing something?

    • @hnasr
      @hnasr  4 роки тому

      G M yes I missed to mention a very important point in the video. The client enters the Tor network using an Onion Proxy which negotiates the keys on behalf of the client with the 3 tor nodes. So the tor nodes don’t know the identity of the client. 👍
      Usually the onion proxy is also the first node or the entry node which already knows the client so it negotiates the keys on its behalf.

  • @palaniappanrm6277
    @palaniappanrm6277 4 роки тому

    The info that the exit node at max will know the ip A is connecting to and not the actual data right because the data will be encrypted between A and B?

    • @hnasr
      @hnasr  4 роки тому

      Palaniappan RM the exit node will see the data (except if its encrypted with TLS) but exit node doesn’t know the IP address of A

    • @palaniappanrm6277
      @palaniappanrm6277 4 роки тому

      @@hnasr TLS between A and B mostly will be there right?

    • @hnasr
      @hnasr  4 роки тому +1

      Mostly correct for all websites (HTTPS)

  • @filipposilva8677
    @filipposilva8677 2 роки тому

    How could someone circumvent this process? Seems almost impossible

  • @PramodKumar-hu7mt
    @PramodKumar-hu7mt 5 місяців тому

    Very good video....design pattern in java udemy course please.. and let me know what your future udemy courses

  • @glennrichards5945
    @glennrichards5945 4 роки тому

    So basically, through a series of nodes, we encrypting the data 3 times and sending it to the server right?

    • @hnasr
      @hnasr  4 роки тому +1

      Correct and the client knows how the decrypt all 3 layers

    • @glennrichards5945
      @glennrichards5945 4 роки тому

      @@hnasr thank you! You're video was very helpful. I'm gonna hit subscribe. I hope u keep posting good quality videos

  • @aaabbb-qv4ff
    @aaabbb-qv4ff 5 років тому +1

    Very nice explanation, you should definitely do a movie about dark net.

  • @ayoubbetane5878
    @ayoubbetane5878 4 роки тому

    what a Great explanation i like it

    • @hnasr
      @hnasr  4 роки тому

      Thanks Ayoub

  • @telisijohn2054
    @telisijohn2054 4 роки тому

    How does the ISP know to block a traffic for a TOR server? Do or can their Edge router decrypt and encrypt the packet to identify the circuit number before forwarding it to the next hop?

    • @hnasr
      @hnasr  4 роки тому

      Telisi John I was thinking the ISP can block the IP addresses of the most common TOR directories out there.. so clients cant even get to create a circuit.
      I don’t believe they can decrypt the traffic since they shouldn’t have the key.

    • @telisijohn2054
      @telisijohn2054 4 роки тому

      Thanks. I forgot about the ISPs can in fact blockhole traffic destined for TOR server if they see it fit. How about torrent servers designed for educational purpose, can you stream traffic from torrent servers using TOR?

    • @hnasr
      @hnasr  4 роки тому

      Yes Of course you can stream over tor since tor operates at TCP layer (4ish). and torrent uses tcp

    • @muiriosvanbrugh7146
      @muiriosvanbrugh7146 4 роки тому

      Using Deep packet sniffer they can identify the traffic flow as Tor and block it that way. If they do block it based on traffic flow then you would need to use a pluggable transport; this makes tor traffic flow look like innocent-looking traffic.

  • @Ali_Alhajji
    @Ali_Alhajji 4 роки тому

    Does T1 know for sure that I'm the origin of all this process? Or it thinks that I'm just another relay for another TOR client behind me?

    • @hnasr
      @hnasr  4 роки тому +1

      Correct T1 knows that you are the origin and it knows your IP address (unless you used a Proxy to connect to T1) in this case T1 will know the Proxy's IP..
      T1 does not know where you are going just that you are using Tor
      T3 knows that someone is going to B but doesn't know who (It knows T2 wants to go there)
      There is something I missed in this video is key exchange . The client (you) negotiate key with first node using DH. Then establishes a TLS connection the first node. It then uses the first node as a proxy to negotiate the key with second node. So second node only knows that first node is talking to it but the first node can’t even get the key that is negotiated with node 2 because of property of Diffien helman (DH) ( check out my TLS video to learn more)
      Once we have the second key, we do the same thing, connect to first node and proxy to second node which will connect us to third node which only sees node 2.
      We then negotiate 3rd key.
      Very smart and extremely hard to break.
      Hope that helps!
      (TLS 1.3 video ua-cam.com/video/ntytZy3i-Jo/v-deo.html)

    • @Ali_Alhajji
      @Ali_Alhajji 4 роки тому

      @@hnasr very clear. But I wonder if it's possible to build something similar to TOR, but with all nodes are unable to make sure if the received packet came from an origin or from a relay node? 🤔🤔 Food for thought

  • @itsmeafreak
    @itsmeafreak 4 роки тому

    Great talk!

  • @vim55k
    @vim55k 4 роки тому

    Would you do video about vpn? Technology I mean, not the if I should...

    • @hnasr
      @hnasr  4 роки тому

      I actually do have a video comparing it to a proxy ua-cam.com/video/npnqyRT77Zc/v-deo.html

  • @wongsiutingbrian2552
    @wongsiutingbrian2552 5 років тому +1

    great stuff!!

  • @robinacy8143
    @robinacy8143 3 роки тому

    how do i access it?

  • @shimronnetia
    @shimronnetia 4 роки тому

    nice homor.. very insight topic

  • @rogernevez5187
    @rogernevez5187 4 роки тому

    9:23 *Your client makes a request to a Tor Directory.*
    Is this a direct request ??? Does the Tor Directory server knows the IP of the client ????

    • @hnasr
      @hnasr  4 роки тому

      Yes the directory knows the client IP, but it doesn’t tell what websites the client is consuming. All it does is reveals that this client uses TOR

    • @rogernevez5187
      @rogernevez5187 4 роки тому

      @@hnasr This seems bad. It means that the directory servers know all IPs that uses Tor.

  • @flooorwalker
    @flooorwalker 3 роки тому

    If you were a professor I would have actually graduated from college

  • @htech7840
    @htech7840 3 роки тому

    So our provider can see our traffic! Because the IP Source is in clear!

    • @hnasr
      @hnasr  3 роки тому +1

      Your provider will see that you are sending traffic to the first TOR node IP address. ISP will not see your final destination in TOR

    • @htech7840
      @htech7840 3 роки тому

      @@hnasr Then the traffic can be read!

  • @eriknelson9282
    @eriknelson9282 4 роки тому

    ooooooo that's a NICE packet

  • @erensrtky
    @erensrtky 5 років тому

    İf we use tor, is that mean we are may become a exit node ?

    • @hnasr
      @hnasr  5 років тому +1

      Eren Sertkaya no , you become a tor server node when you install the tor server node software. When you use tor as a client you only download the client tor software.. good question!

    • @grgr8238
      @grgr8238 5 років тому +1

      No you become only spied by CIA running tor relays

    • @erensrtky
      @erensrtky 5 років тому

      ​@@hnasr Thanks for your good explanation :)

  • @efvanonalisa5124
    @efvanonalisa5124 3 роки тому

    The onion rounter can create visit to dark web
    The onion rounter can visit dark web

  • @rheinalbatros6669
    @rheinalbatros6669 4 роки тому

    Great!

  • @sammywilliam8156
    @sammywilliam8156 3 роки тому

    Basically it is super fire fox

  • @kellysmith7357
    @kellysmith7357 3 роки тому

    I love onions!

  • @yas.mineah
    @yas.mineah 3 роки тому +1

    07:06 Raison I subscribed .
    You're cool .❤️❤️❤️

  • @olehhrabovskyi5991
    @olehhrabovskyi5991 3 роки тому +1

    Man, you are crazy, but like for nice explanation.

  • @a.a7907
    @a.a7907 4 роки тому

    Tor browser was made to track their clients.

    • @hnasr
      @hnasr  4 роки тому

      I wouldn’t be surprised. It has access to pretty much everything. Unless you can compile it from Source You can’t trust it.

  • @SubieZo
    @SubieZo 4 роки тому

    left after 2min ....

  • @oukhajouanas9852
    @oukhajouanas9852 3 роки тому

    انا عربي لم افهم ماتقوله يا اخي

  • @gamedevelopment552
    @gamedevelopment552 3 роки тому

    Your English is so different 🤣🤣

  • @hillelspivakov4848
    @hillelspivakov4848 4 роки тому

    Nice video. Thank you. Can you please do less jokes?

    • @Resedda
      @Resedda 4 роки тому

      There are tons of boring explanations about this topic out there. Get out of this funny one if it doesnt pleases you.

  • @اخيلوكت
    @اخيلوكت 2 роки тому

    ط1

  • @medin.n
    @medin.n 4 роки тому +3

    The accent ...

    • @gomrecords2592
      @gomrecords2592 4 роки тому

      HAhAgAg aaaGAgAGaGaGAgGaGAgaAGGbaBaGAGGaGavBaB

  • @syedrizwan7722
    @syedrizwan7722 4 роки тому +2

    unnecessarily long

  • @Crroow
    @Crroow 4 роки тому

    Try to put your back into it, or at least prepare your presentation.