TOR: Can exit nodes eavesdrop on communications?

[Werner Schram]

arshad wrote:
> thank you very much werne.
> your reply is very clear,
> you have any suggestion on what to use for encryption?
>   
Unfortunately, it is up to websites to decide if they provide 
encryption. You can see if a site is encrypted by looking at the address 
bar. If the address starts with https:// your connection is encrypted. 
If the address starts with http:// your connection is not encrypted. 
Fortunately, most sites that require personal details from you, provide 
encryption. And if they don't, you shouldn't use them.

To make it slightly more complicated (but also more complete), you 
should always make sure the certificates the site uses for encryption 
are in order. If you use a recent and updated browser, this is done for 
you. If something is wrong with the certificate, you will see a big 
warning. You should always read those warnings, and only add exceptions 
if your are really sure about what you are doing.

I hope this information is clear, and I'm not scaring you of too much ;) 
To summarize: Always look for https in your address bar when giving out 
personal details, and never ignore the big certificate warnings your 
browser shows you!

Regards,
Werner