Question: I'm a Tor newbie that wants to use Tor to log in to a few communities online, and I have a few questions about the safety of it. Before you say anything, I won't use sites like Facebook that know my real life identity, or sites that are very important (like online banking). I'm generally not doing anything too interesting over Tor and don't expect to be especially targeted by hackers or law enforcement.

As I understand it, when logging in to a website, my username and password can be stolen when I send them through Tor. What is the likelihood of this, and steps can I take to minimize such risk?

If I change my password immediately after logging in, will that prevent hackers from getting in, or will Tor continue to transmit these details while I use the website?

I understand Tor reroutes my traffic every 10 minutes. Will this also re-transfer my details, making it more likely to get routed through a malicious node the longer I stay on the site? Can I prevent re-routing, so that only 1 exit node can potentially see my details, instead of 100+? Besides, some websites automatically log out if the IP address changes, which is just annoying.

Can I store a cookie with my login details on my computer, so that I don't have to log in every time I start the browser? I understand that this will somewhat reduce my privacy.

Or would it be better to leave the Tor browser running throughout the day, so that I only have to log in once? Would that not compromise my anonymity, in other words, the longer I stay on the site, the more likely the NSA or someone else will connect the start node and the end node?

Thanks for any replies.

Answer: 
Welcome to Tor community! So - step by step to your questions:

* No information, *including* login and password can be stolen if it's transferred via HTTPS **and** the certificate genuinity is verified. Use Perspectives project and/or Convergence to check it all up locally and in decentralised manner - it will save your day not just inside Tor, btw.
* Tor is a very configurable tool, and it can be tuned up to change it's circuits in a decent privacy-oriented manner, so password change will not be intercepted. **However it does not negate a need in two-factor authentication**. Google Authenticator is free and easy to use and adopt, for example.
* No cookies! **Ever!** It's not so laborious to type your password.
* It's better to use a dedicated Tor node of yours running 24/7/365 and route all your traffic through it - I'm doing it myself on Orange Pi PC single-board computer. Feel free to ask and I'll give you all the details how to do it if you need.

Post Scriptum. If you have any further questions - ask them! I'll be glad to help you
I would like to add 1 tiny part in this and that is about storing passwords. I might be old fashion but i never ever ever store passwords anywhere everything can be hacked. I simply write them down in a book. You have to break into my house to search for it to get the passwords. :)