{"id":131,"date":"2019-10-06T12:37:11","date_gmt":"2019-10-06T12:37:11","guid":{"rendered":"https:\/\/osintme.com\/?p=131"},"modified":"2019-10-20T20:51:51","modified_gmt":"2019-10-20T20:51:51","slug":"the-onion-router-tor-the-truths-and-myths-of-anonymity","status":"publish","type":"post","link":"https:\/\/osintme.com\/index.php\/2019\/10\/06\/the-onion-router-tor-the-truths-and-myths-of-anonymity\/","title":{"rendered":"The Onion Router (TOR) – the truths and myths of anonymity"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In the last article<\/a> I mentioned using TOR as part of the TAILS operating system.<\/p>

TOR in its early stages was really a precursor of digital privacy. The concept originated in the 1990s and it was based upon the research initiated by computer experts working with and funded from the US Naval Research Laboratory.<\/p>

The detailed history of “onion routing” and the TOR project can be found here<\/a>.<\/p>

Essentially, TOR started out as free open source software, which at its core embraced the idea of a decentralised network. Any network traffic routed through the TOR network is encrypted and it does not go directly from A to B; instead, it randomly bounces through a network of relays (referred to as TOR nodes), which are run by volunteer users all around the world.<\/p>

Routing traffic through multiple servers while protecting it each step of the way with layers of encryption brought to mind the “onion” parallel.<\/p>

\"Image<\/p>

Any online resources are accessible using TOR (pretty much anything in the “normal” Internet, or “clearnet”), however there is a number of Internet sites out there with top level domains of .onion<\/strong><\/em>. These resources are only accessible via the TOR protocol and are commonly referred to as “the dark web”.<\/p>

To illustrate it with an example: to access the most popular online encyclopedia, you go to www.wikipedia.org<\/a> by typing this URL in your browser. In the dark web, to access anything you must first know the exact URL, which is impossible to type out or even remember, because it will typically look like this: zqktlwi4fecvo6ri.onion.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The TOR browser<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The development of TOR browser initiated in 2008. Anybody who attempted to use this technology in its early stages will remember the hardship associated with correctly configuring the tunnelling protocol connection.<\/p>

Thankfully, in its current form the TOR browser is a fully configured, ready to go state-of-the-art product that can be used by anybody with bare minimum of effort and expertise. And it’s based on the free and open source Firefox browser.<\/p>

Here’s the TOR browser download link:<\/p>

https:\/\/www.torproject.org\/download\/<\/a><\/p>

\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Demystifying TOR<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Whether you consider TOR to be part of mainstream digital privacy tools or not, it’s hard to shake off certain myths and untruths about it, now heavily embedded in the popular imagination.<\/p>

Here are some common misconceptions regarding TOR:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

1. TOR is illegal<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Generally speaking, this is not true.<\/strong> It’s not illegal to rout and encrypt Internet traffic, it’s not illegal to safeguard your privacy, it’s not illegal to access the dark web.<\/p>

[Unless you live in a country whose authoritarian regime regularly breaches the privacy of their citizens and bans the use of such services – like China, Iran, Russia and so on].<\/em><\/p>

In any other normal jurisdiction, the question of legality should be asked in respect of actions of specific users, who might use TOR to access services that allow them to purchase drugs or stolen goods, access child abuse material, etc.<\/p>

It is worth noting that more that half of all content available on the dark web is not illegal.<\/p>

Remember – anonymity does not equal criminality!<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

2. TOR is completely secure<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This is also not true<\/strong>. Because TOR operates as a decentralised network, it is possible to attack it by controlling a substantial number of TOR nodes.<\/p>

If a single party was to control enough relay points, it could disrupt the network’s anonymity by observing Internet traffic and analysing its metadata in order to link specific users to specific activities.<\/p>

Moreover, the encryption of TOR traffic works only if its destination also offers encryption. Connecting to a website that utilises the unsecured HTTP protocol carries a big risk of dropping encryption upon arrival at the website and could lead to exposing sensitive information.<\/p>

Likewise, if accessing any website where you have to log in, even if it uses HTTPS, you identify yourself with your login credentials.\u00a0<\/p>

Opening downloaded files while still browsing within TOR can also de-anonymise the user. These files can be designed to link to certain Internet resources while by-passing the TOR network and can leads to revealing the real IP address of the user.<\/p>

Remember – the safest option is to combine TOR usage with a trusted VPN!<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

3. TOR was created by US government - so it can't be secure<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This claim is the exact opposite of the previous one. And like the previous claim, this is also not true<\/strong>.<\/p>

TOR was not exactly created by the US government, it was created by individual researchers who received funding from the US Naval Research Laboratory.<\/p>

It is also a known fact that:<\/p>

a) the US government also uses TOR for their own purposes<\/p>

b) the US government funds the researchers at the TOR Project to allow them to continue their work.<\/p>

It is illogical to think that the US government would develop a technology like TOR for its own use, then make it public and then weaken it by implementing a backdoor in it, thus crippling everybody’s potential to use it, including their own.<\/p>

The people behind the TOR Project themselves addressed the “backdoor concern” in the following way:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\"There is absolutely no backdoor in Tor. We know some smart lawyers who say that it's unlikely that anybody will try to make us add one in our jurisdiction (U.S.). If they do ask us, we will fight them, and (the lawyers say) probably win.\n\nWe will never put a backdoor in Tor. We think that putting a backdoor in Tor would be tremendously irresponsible to our users, and a bad precedent for security software in general. If we ever put a deliberate backdoor in our security software, it would ruin our professional reputations. Nobody would trust our software ever again \u2014 for excellent reason.\"<\/div>\n\t\t\t\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

source:<\/strong> <\/em>https:\/\/2019.www.torproject.org\/docs\/faq.html.en#Backdoor<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

4. TOR is slow and inefficient<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Answering this question can be tricky as the above metrics are subjective, depending on each individual user. Trying to be objective, I’ll settle on partially true<\/strong>.<\/p>

The process of routing Internet traffic through various nodes around the world will certainly impact your connection speed. TOR is definitely slower than any clearnet browser.<\/p>

Moreover, when using clearnet search engines such as Google, your searches within the TOR browser will be hampered by alerts on “unusual activity” and by captcha.<\/p>

On top of that, TOR is sometimes being used for illegal activities like DDOS attacks or for downloading files via peer-to-peer software, which negatively affects connection speed for every TOR user who is currently online.<\/p>

However, one has to understand that the slower connection is the price we pay for increased security and privacy. TOR is still an efficient tool and it still gets the job done; the difference is that when security and privacy take precedence, speed and performance become a secondary concern.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Explaining certain misconceptions and untruths about TOR.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":70,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[18],"tags":[16,19,14,15,9,17],"class_list":["post-131","post","type-post","status-publish","format-standard","hentry","category-digital-privacy-security","tag-anonymity","tag-dark-web","tag-privacy","tag-security","tag-tor","tag-vpn"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/comments?post=131"}],"version-history":[{"count":14,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/131\/revisions"}],"predecessor-version":[{"id":186,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/131\/revisions\/186"}],"wp:attachment":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/media?parent=131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/categories?post=131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/tags?post=131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}