NWA-PCUG Newsletter Article, May 2011
Tor, Anonymity On-line
By Dick Maybach
n2nd (at) charter.net
(click to email author)

Tor protects your privacy when you are on-line in two ways: (1) it prevents other users of the network you use to reach the Internet (for example a public Wi-Fi hotspot) from seeing the data you exchange and with whom you communicate and (2) it hides your identity from those with whom you communicate. For most of us, item (1) is more important. For example, when we use a Wi-Fi hotspot to access the Internet, every byte we send and every one we receive is accessible to all its other users. One defense would be to add a separate defensive tool for every offensive one, which is the approach taken to foil Windows viruses. The result will surely be the same – an ever-increasing kit of defensive programs to counter the never-ending supply of offensive programs. A much sounder approach is to run Tor, which defends against all such attacks; as a result you need install only one tool. Item (2) is probably less important to you; it prevents sites you visit from knowing who you are or what other sites you've visited. We are seeing ever more intrusions into our privacy by governments and businesses, and Tor was developed to help us preserve our privacy, safety, and dignity in the face of this. Although Tor is legal in all countries, you can do illegal things using it. In this way, it's similar to the gas pedal on your car, which is essential if you want to go someplace, but must be used with restraint to avoid awkward and expensive discussions with the law.

Tor hides not only what you say, but also who you say it to. You could use it to communicate back home from a location where disclosing your country of origin or religion might expose you to unpleasantness or risk. This feature also allows you to circumvent restrictions that your ISP has placed on the Web sites you visit. It's used by individuals, businesses, activists, reporters, the military, and law enforcement for investigations and to protect themselves, their organizations, and those with whom they communicate. Using it, you can surf the Web, exchange e-mail, use instant messaging, and transfer files. However, please don't just install it and assume you're safe. You need to change some of your habits, and reconfigure your software. Tor by itself is NOT all you need to maintain your anonymity.

Tor consists of two parts – a public, secure virtual private network (VPN) and the software to access it. The software is free and available for Windows, Mac OS X, Linux, and some smart phones at http://www.torproject.org/. Most PC and Mac users will want the Tor Browser Bundle, which includes the Firefox browser. (For reasons you can read on the Tor Web site, neither Internet Explorer nor Safari is suitable for secure browsing.) The Tor VPN is distributed and accessible worldwide, is free, and is provided and maintained by volunteers. Because the network consists of thousands of independent Web sites, it's quite robust; there is no single point of failure.

How does Tor work? When you access the Internet with it, you first communicate with a Tor Directory Server over an encrypted link (one with a URL beginning https;//). Here, you obtain a list of available Tor Nodes. The Tor software on your computer selects at least three of these; call them Node 1, Node 2, and Node 3. It then sets up a secure link to Node 1, which forwards your traffic to Node 2, which forwards it to Node 3. All these links are secure, and only Node 3 can decrypt your packets. Finally Node 3 sends your packets to your desired end site. Note that if the end site is secure (indicated by a URL beginning with https://), even Node 3 can't read your data. Packets coming to you follow the reverse path, Node 3 encrypts them in such a way that only you can do the decryption. As far as the end site knows, it is communicating with Node 3; it has no way of finding your computer's URL. An observer on your local network knows only the URL of the Tor Directory Server and Node 1; he can't find the location of the end site or read any of your packets. Only Node 1 knows your location, and only Node 3 knows that of the end site. Note that Node 3 can also see the data you exchange, unless you're using end-to-end encryption, i.e., talking to a site with a URL beginning https://.

When you install Tor, you will also install the Torbutton add-on for Firefox, which allows you to turn Tor anonymous browsing on and off. Turning Tor on changes some of Firefox's operation. * None of the cookies you acquired during normal browsing will be available. This is because cookies can tell the site you are communicating with a lot about you and which sites you've visited. As a result, you will have to reenter passwords where they are required. These cookies will return when you toggle Tor off.
* Some sites will be displayed in a foreign language. Since they don't know where you are, they assume you are located in the same country as Node 3. See the Tor site for work-arounds.
* You will see moderate delays while surfing the Web. There are at least three intermediate sites on the path to your final destination, and several layers of encryption are involved. While the delays are noticeable, I haven't found them to be obnoxious, and I consider it a good trade-off to achieve better security.

Many users need only browser access to the Internet when away from home, since through it they can also exchange e-mail and transfer files. (I've found that the FireFTP add-on is convenient for the latter, but see the Tor site for instructions on how to configure it and follow these exactly.) If you want to use secure instant messaging, use Pidgin, which Windows and OS X users can obtain by installing the Tor IM Bundle, available on the Web site. (Pidgin is in most Linux repositories.) You can't use Tor for file sharing, i.e., using BitTorrent; instead use the I2P network, http://www.i2p2.de/. See the Tor site for how to configure other Internet access programs, including some that provide access to your home computer. However, if you really need access to files on your home computer, it would be better to transfer them to your laptop or to a cloud service before you go. Otherwise, a power transient or other failure could disable your computer until you return home to restore it.

Accessing the Internet away from home without Tor is like driving without insurance, you can almost always get away with it. That doesn't mean it's a smart thing to do.

Click here to return to top



==================================================================