<story><title>Bitcoin over Tor isn&apos;t a good idea</title><url>http://arxiv.org/abs/1410.6079</url></story><parent_chain></parent_chain><comment><author>chatmasta</author><text>I researched TorCoin. I feel like I know a fair amount
about Tor and BitCoin.&lt;p&gt;What worries me most about Tor is that people do not
realize how trivially an exit relay can MITM your traffic.
The value proposition of Tor is NOT keeping all your traffic
safe. It&amp;#x27;s &lt;i&gt;anonymizing&lt;/i&gt; your traffic from end to end, so
that nobody who sees your data knows both where it came from
and where it&amp;#x27;s going. They can still see the data itself.&lt;p&gt;For all intents and purposes, traffic from Exit -&amp;gt; Internet
is plaintext. The relay operator can MITM it. Tor is only
safer than a VPN or proxy because the exit relay does not
know your &lt;i&gt;identity&lt;/i&gt;. It can still access the data you
transfer through it. [4]&lt;p&gt;Anyone can start a Tor exit relay, and setting up a MITM
proxy on it is trivial. Siphoning bitcoin transactions
is equally trivial. Just listen for the proper traffic patterns.&lt;p&gt;You should not be transferring any business-critical
data over Tor. It&amp;#x27;s a great tool for protecting your
identity, but not your data.&lt;p&gt;With HTTPS, you&amp;#x27;re relatively safer, since you&amp;#x27;ll get
an alert if a relay is MITM&amp;#x27;ing you and modifying the
certificate. But with plain HTTP, you won&amp;#x27;t even
know when you&amp;#x27;re getting MITM&amp;#x27;d.&lt;p&gt;More Resources:&lt;p&gt;[1] &lt;a href=&quot;http://security.stackexchange.com/questions/34804/how-safe-is-tor-from-mitm-snooping-attacks&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;security.stackexchange.com&amp;#x2F;questions&amp;#x2F;34804&amp;#x2F;how-safe-i...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https://blog.torproject.org/category/tags/mitm&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.torproject.org&amp;#x2F;category&amp;#x2F;tags&amp;#x2F;mitm&lt;/a&gt; (includes links to research papers)&lt;p&gt;[3] &lt;a href=&quot;https://www.petsymposium.org/2014/papers/Winter.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.petsymposium.org&amp;#x2F;2014&amp;#x2F;papers&amp;#x2F;Winter.pdf&lt;/a&gt;&lt;p&gt;[4] Emphasis on &amp;quot;for all intents and purposes.&amp;quot; Not a true
statement universally.</text></comment>
<story><title>Bitcoin over Tor isn&apos;t a good idea</title><url>http://arxiv.org/abs/1410.6079</url></story><parent_chain></parent_chain><comment><author>s_q_b</author><text>Tor and Bitcoin hide fundamentally &lt;i&gt;different things&lt;/i&gt; in their pseudonymity specs. It&amp;#x27;s like people think Tor is magic anonymity peanut butter they can spread on whichever project they wish.</text></comment>