Until this year, the internet privacy tool Tor was scarcely heard of outside the tech community. Since revelations about the surveillance strategies of US and UK spies.
But while the NSA has tried to crack its security, Tor’s principal source of funding has been other parts of the US government.
While a criminal contingent may use the site to disguise identities, its creators point to a wider group of legitimate users including journalists, activists, law enforcement professionals, whistleblowers and businesses.
In a year Tor has grown from 500,000 daily users worldwide to more than 4 million users, provoking an increasingly public debate along the way.
Tor is short for The Onion Router (thus the logo) and was initially a worldwide network of servers developed with the U.S. Navy that enabled people to browse the internet anonymously. Now, it’s a non-profit organization whose main purpose is the research and development of online privacy tools.
If you want to be anonymous—say, if you live under a dictatorship, you’re a journalist in an oppressive country, or a hacker looking to stay hidden from the government—Tor is one of the easiest ways to anonymize your traffic, and it’s free. It’s far from perfect, though (we’ll get to that in a moment).
On a more general level, Tor is useful for anyone who wants to keep their internet activities out of the hands of advertisers, ISPs, and web sites.
That includes people getting around censorship restrictions in their country, police officers looking to hide their IP address, or anyone else who doesn’t want their browsing habits linked to them.
The good news is that they went for a browser exploit, meaning there’s no indication they can break the Tor protocol or do traffic analysis on the Tor network. Infecting the laptop, phone, or desktop is still the easiest way to learn about the human behind the keyboard.
Tor still helps here: you can target individuals with browser exploits, but if you attack too many users, somebody’s going to notice. So even if the NSA aims to surveil everyone, everywhere, they have to be a lot more selective about which Tor users they spy on.
Just using Tor isn’t enough to keep you safe in all cases. Browser exploits, large-scale surveillance, and general user security are all challenging topics for the average internet user.
These attacks make it clear that we, the broader internet community, need to keep working on better security for browsers and other internet-facing applications.
How to use the Tor Browser:
For most people, using Tor Browser is as simple as downloading it and running it, the same way you’d download Chrome or Firefox.
If you’ve never used Tor, the first thing you’ll notice is that it’s slow — or at least, slower than regular internet browsing.
Still, Tor has gotten quite a bit faster over the years, and with a good internet connection, you can even watch YouTube videos over Tor.
Using Tor Browser comes with one major annoyance: Many prominent web services block access to Tor, often without useful error messages. If a site you normally visit suddenly returns 404 when visiting over Tor, the service is likely blocking Tor traffic and being needlessly opaque about it.
Sites that do not block Tor might push you to click through a ton of captchas. It’s not the end of the world, but it is annoying.
How Tor Browser works:
Tor Browser routes all your web traffic through the Tor network, anonymizing it. As the images below illustrate, Tor consists of a three-layer proxy, like layers of an onion (hence Tor’s onion logo).
Tor Browser connects at random to one of the publicly listed entry nodes, bounces that traffic through a randomly selected middle relay, and finally spits out your traffic through the third and final exit node.
As a result, don’t be surprised if Google or another service greets you in a foreign tongue. These services look at your IP address and guesstimate your country and language, but when using Tor, you will often appear to be in a physical location halfway around the world.
If you live in a regime that blocks Tor or need to access a web service that blocks Tor, you can also configure Tor Browser to use bridges. Unlike Tor’s entry and exit nodes, bridge IP addresses are not publicly listed, making it difficult for web services, or governments, to blacklist those IP addresses.
Is Tor Browser legal?
For most people reading this article, Tor Browser is completely legal to use. In some countries, however, Tor is either illegal or blocked by national authorities. China has outlawed the anonymity service and blocks Tor traffic from crossing the Great Firewall.
Countries such as Russia, Saudi Arabia and Iran, are working hard to prevent citizens from using Tor. Most recently, Venezuela has blocked all the traffic.