Tor has a known weakness: The last node through which traffic passes in the network has to decrypt the communication before delivering it to its final destination. Someone operating that node can see the communication passing through this server….
He was surprised to discover that 95 percent of the traffic that passed through his Tor nodes was not encrypted.
Even more surprising was the number of embassies and other government agencies that were using Tor, and using it incorrectly.
That prompted Egerstad to narrow his search to e-mail correspondence with a focus on government agencies. He wrote a script to search for .gov domains and keywords such as “embassy,” “war” and “military,” and focused on sniffing port-25 traffic, the port through which e-mail passes.
Tor Means Eavesdropping Fun