What is Tor (The Onion Router) and How to Use Tor to be Anonymous

Using The Onion Router (Tor) is as easy as using a web browser and will protect your online activities from snoops and tracking and also let you visit hidden ".onion" websites on the dark web. 

The Onion Router, better known by its acronym Tor, is a special kind of web anonymizing service. Tor is similar in some ways to a VPN but, at the same time, also nothing like them. For this reason Tor deserves its own detailed materials. If you want to use Tor to be anonymous online, keep reading.

What is Tor?

Tor is a term used to describe a bundle of free, open source apps available for download at https://www.torproject.org/ that aim to provide users with online anonymity.

Tor is cross-platform and compatible with Windows, Linux, Android, iOS, and Mac O/S.

The concept behind Tor was originally developed by the US Naval research laboratory for protecting government communications. Tor helps you to achieve anonymity online and protect yourself from network surveillance by enabling anonymous connections through a worldwide network of more than 3,000 relays (explained below).

Tor's two main functions are to allow users to browse the web anonymously and to bypass censorship. While Tor cannot 100% guarantee absolute anonymity, it makes it much more difficult for snoops to detect, trace or block your web-based Internet activity.

How Tor Works

Crucially, Tor camouflages your connection by sending data packets through a virtual path of randomly selected relays (also called nodes) set up by Tor and its volunteers all around the world. Anybody can set up a relay and doing so helps support the important cause of online anonymity.

By default, data sent over the Tor network travels through at least three relays before reaching its final destination (for example, the web page you want to visit). Two relays act as inside relays, transmitting the data within the Tor network, and the last relay functions as an exit relay (or exit node) which transmits the data outside the Tor network to the final destination.

In addition, data transmitted over the Tor network is encrypted. This protects your data from being monitored whether by your ISP, governments, hackers or other potential snoops and adversaries.

These features mean that the destination of your web requests will be able to detect only the transmitted IP address of the exit node (the last contact point of your request with Tor). Your true IP address remains untraceable because your data travelled through a number of relays before reaching the exit node.

The exit node remains unaware of the source of the original request, protecting your IP address. So even if a snoop could trace the IP address arriving at the exit node before the request was forwarded to the final destination, your IP address is still protected by 2 more intermediate relays.

Now you start to understand why it is called the onion router: the protection it offers is similar to the multiple layers of an onion.

For example, with Tor enabled if you visit www.cogipas.com the route this request (data) takes looks like this:

>> you enter the URL >> multiple internal gateway nodes >> exit node >> destination

As you can see, Tor introduces a number of intermediary steps (the italicized ones) in what would normally be the process.

Tor May Slow You Down

All this serves to conceal the routing of transmitted data, protects your privacy and keeps you anonymous by masking your true IP address, but often slows things down.

Your traffic will be traveling to different Tor relays and nodes located in different parts of the world and at varying speeds. For these reasons, your speeds when connected to Tor may be slower.

But protecting your privacy at the expense of a potential small drop in your web browsing speed seems a small price to pay.

How to Get Started Using Tor

To start using Tor, visit https://www.torproject.org/ and download and install the Tor Browser for Windows.

It contains a tailored version of the Mozilla Firefox web browser app which is pre-configured and requires no additional installation or settings to change.

An installation wizard will guide you. After choosing your language and the location on your device for the installation (the default locations are fine) the installation will take a few moments. At the end of the installation process you will be prompted to Run Tor Browser.

Now an important step: you will be prompted for 1 of 2 different connection settings. This will be determined by how you answer a question (see screenshot).

For most people, the first option ‘I would like to connect directly to the Tor network’ will be fine (the balance of this section assumes you have made this choice).

Top Tip – The second option applies if, for example, you are in a country that censors or restricts Internet access (in this case Tor’s user interface, Vidalia, will also be installed allowing you to bypass censorship by connecting to Tor through something called a bridge – discussed later).

The installer will proceed to connect you to the Tor network and, once successful, to launch the Tor Browser.

Once Tor Browser has started, you use it like you would any other web browser. You can be confident that you are anonymized when visiting websites with the Tor Browser because the associated data is being sent through the Tor network.

Please note that only data sent using Tor Browser is being anonymized and sent through the Tor network. Any websites you visit using a different web browser will not be anonymized. This is important because your device may open links, for example contained in email messages, with a different web browser.

You may have noticed that the process of connecting to the Tor network is different from a using a web anonymizing VPN service. With a VPN you usually launch a separate app that enables the VPN and then you use your everyday apps, including web browser. In contrast, with the Tor Browser, all the web browsing activities you conduct with it are automatically anonymized.

Top Tip – Although it is possible to manually configure other apps supporting SOCKS proxy protocol to send data through the Tor network, it is highly recommended that only advanced users ever try this as doing so may still leave you open to a number of other ways that your IP address could be exposed including via cookies, JavaScript, browser plugins, etc.

If you explore Tor Browser’s settings you will see that its plugins are either empty or disabled and that it comes preconfigured with a number of plugins and add-ons to enhance your online anonymity (see screenshot). For example, the HTTPS-Everywhere add-on ensures that you connect with a secure (HTTPS) connection to websites supporting them.

To ensure that your true IP address is indeed being shielded and kept anonymous by the Tor network, visit a trusted ‘What’s my IP Address’ pages on the web such as those at https://www.cogipas.com/whats-my-ip/ to confirm that you are connected to the Tor network and that your true IP address is not being transmitting.

Finally, when you are finished anonymously browsing the web and you close the Tor Browser, it will automatically delete your web browsing history. Because it is user-friendly and gaffe-resistant, using Tor Browser is the easiest, most popular and safest way to send data through the Tor network.

Tor’s Limitations

However, Tor isn’t fool-proof.

If you want to reduce the risk of your web browsing activities being tracked and profiled online, and to stay hidden from snoops or overcome censorship, Tor is a great (and free!) choice. Nevertheless, if you want to rely on Tor to engage in Snowden-like whistle-blowing or other similarly super-sensitive activities, you need to know that Tor does have some limitations you need to be aware of.

For example, older versions of the Tor browser were found to be vulnerable to JavaScript attacks. Such attacks were used to reveal users’ IP addresses. Apparently, this vulnerability was used by the FBI to track down the founder of the biggest Darknet hosting platform, Freedom Hosting (see box).

Newer versions of Tor browser don't suffer from this vulnerability. 

Be aware that some websites, including popular ones such as Wikipedia, Google, Ynadex and Facebook, block traffic sent from Tor relays in order to combat potential misuse (spam for example).

When using Tor, you may be faced with lots of annoying CAPTCHAs (though that is starting to change).

Keep in mind that your true IP address is shared with entry relays on the Tor network. Tor hides traffic from nodes along the way, but not from the exit node or the final destination, so it does not prevent traffic from being analyzed upon leaving the Tor network.

In addition, Tor does not encrypt traffic that leaves the Tor network from an exit relay to the final destination server. This means that the exit node can “see” any traffic passing through it (unless end-to-end encryption was used such as the HTTPS protocol). Consequently, an exit node could in theory be able to access your transmitted data including login, password, cookie and other potentially personally identifiable information.

• Related: you can always use Tor together with a VPN service for even more protection

In addition, Tor is simply unsuitable from the get go for some activities, including torrent file-sharing.

Tor is simply not engineered to work effectively with the huge volumes of data often associated with torrents. Trying to use Tor for torrents will not render you anonymous. Your true IP address will leak and be visible.

If you want to download torrents anonymously, you will have to use tools and techniques other than Tor. 

In addition, unless you take some complicated steps that only advanced users should consider, you cannot mask that you are using Tor. This is because the addresses of Tor exit nodes are publicly accessible and traffic coming from Tor can be detected through sniffing and deep packet inspection (DPI) techniques. These identification techniques allow website operators, governments and sophisticated adversaries to prevent connections from Tor exit relays or to limit their functionality.

Another related risk comes from website traffic analysis.

When an adversary knows about the websites you may be interested in, they can monitor and analyze the patterns that flow between these websites and the users accessing them. These patterns can be used as a way to track you down.

To minimize this risk, Tor started transmitting data in uniform sized chunks making it harder for adversaries to track patterns, but this does not completely eliminate the risk.

Generally speaking, risks to your anonymity on Tor usually result more from your own activities, such as trying to use it with unsupported, insecure or “leaky” (poorly designed) apps that reveal your IP address.

Best Practices for Using Tor

In order to benefit as much as possible from Tor (and to minimize the possible risks) follow these recommendations to best protect your anonymity on the web:

• Always use Tor Browser, which is configured to protect your anonymity while browsing the web. 
   
• Don’t use browser plugins, add-ons or other extensions than those already pre-configured with Tor Browser. In addition, keep turned off Flash, ActiveX, Java and JavaScript. Also avoid streaming video or audio in Tor Browser because these activities may reveal your true IP address. 
   
• Avoid opening documents downloaded through Tor when you are online. Such documents, including DOC or PDF files, may contain hidden elements initiating a communication (for example, automatically trying to load some code or an invisible image outside of the Tor connection). This could inevitably expose your true IP address. To ensure your online anonymity, open any downloaded items after disconnecting from Tor or, ideally, when you have gone completely offline. 
   
• Don't use Tor for torrent file-sharing. Instead, consider a VPN for torrenting. 
   
• Use a different user account or profile on your device when using Tor compared to when conducting your “normal” web browsing. 
   
• Use HTTPS encryption as much as possible when visiting websites. This will encrypt and protect your traffic when it is being transmitted from an exit node to the final destination. As mentioned earlier, Tor has the HTTPS Everywhere plugin which forces websites supporting HTTPS to connect to you with an encrypted connection. Unfortunately, not all websites support secure https connections, but HTTPS Everywhere helps ensure you connect as securely as possible. You should always check to make sure that URLs (website addresses) begin with https://. Using HTTPS encryption makes it all the more difficult for an adversary to intercept your information as they would need to break the end-to-end encrypted transmission.

Follow these guidelines and you can be confident that you will be as safe as possible using Tor.

More About Using Tor (Advanced Users only!)

The materials below are for advanced users only and a continuation of the general materials above. 
 

Configuring Relays

Tor provides you with an opportunity to give back and contribute to expanding Tor's network of relays.

If you choose Run as a client only, Tor will not use your connection to build a network for other users. This is the default setting.

To act as an inside relay, select the option Relay traffic inside the Tor network. This means that Tor will use your device only as an entry or internal (middleman) relay. This is also a relatively safe activity as you are handling data inside the Tor network.

If you choose the option Relay traffic for the Tor network (exit relay), your device will act as an exit relay and your IP address will be associated with data leaving the Tor network to its final destination. You will not know what kind of information is exiting through your device. It is the sender who benefits from Tor anonymity, not the exit relay. Notwithstanding these risks, passionate privacy and anti-censorship enthusiasts may wish to act as an exit node and in doing so help out the wider Tor community.

The last box Help censored users reach the Tor network is necessary for establishing a bridge. Why you might have to establish a bridge is explained a little later in this chapter. 
 

How to Access Tor if you are Blocked from it or Helping a Blocked Friend Access Tor

Some censors block access to root directories as a way of preventing people from connecting to Tor. There are only a handful of root directories to which users must connect in order to receive information about Tor’s relay addresses.

Even when some users manage to obtain the list of Tor relays, this does not guarantee access to Tor because censors could block the IP addresses of all Tor relays.

In order to avoid such censorship, Tor introduced bridge relays, which are not listed in Tor directories and can be used as entry points for downloading directories as well as for building a network. There is no complete public list of bridge relays and therefor censors will not be able to block all bridges, even if they block all Tor relays known to them.

If your Internet service provider or government where you live restricts your access to Tor you may need to set up a bridge relay. Bridge relays are special relays designed to avoid censorship. It is difficult for censors to block access to specific websites visited through Tor, so instead they try simply to restrict access to the Tor network itself.

Public bridge addresses are available at https://bridges.torproject.org. Tor renews the addresses on this page every few days making it more difficult for censors to block these relays. An alternative way to obtain a bridge relay address is to send an email to bridges@torproject.org with the request “get bridges” in the body of the email. If you are worried about using your personal email address for this purpose, you can use a disposable email address service for this task.

Unlike running an exit relay, running a bridge relay just passes data to and from the Tor network, so the bridge operator faces little risk.

If you wish to help a friend circumvent censorship, just create a bridge for them by filling in the necessary information for the Sharing setting as shown below.

Accessing Tor through a Proxy 

If Tor is blocked by your local network and a bridge does not work, try configuring Tor to use any HTTP/HTTPS or SOCKS proxy to access the Tor network.

To set up a connection through such a proxy click on Setting on the Vidalia control panel, then Network shortcut and fill in the necessary information needed to access the proxy such as its hostname or IP address, port number, the type of proxy and perhaps a username and password (these last 2 items may be needed for premium (paid) proxy services).

Accessing Tor through Pluggable Transports 

Bridge relays are effective against censorship done by blocking IP addresses, but censors may apply other means for blocking access to Tor, such as filtering out actual content.

Furthermore, some censors are able to block users from accessing Tor bridges themselves. The censors detect Tor traffic flows and block Tor clients using deep packet inspection (DPI), a form of network surveillance and filtering discussed earlier. 

To bypass such censorship Tor developed obfuscated bridges. Obfuscated bridges use something pluggable transport to transform Tor traffic between the client and the bridge. Transforming the traffic in this way makes it more difficult for censors to detect Tor traffic. More information about pluggable transports can be found at https://www.torproject.org/docs/pluggable-transports.html.en.

Advanced Tor Vulnerabilities

Apart from the risks of having your Tor access censored, Tor has certain limitations in and of itself.

For instance, Tor aims to conceal the connection between a Tor user and a final destination, but it cannot prevent traffic from being analyzed upon leaving the Tor network.

In addition, unless you take some of the more complicated steps outlined above for advanced users, you cannot mask that you are using Tor, because the addresses of exit nodes used by Tor are publicly accessible and traffic coming from Tor can be detected through sniffers and the deep packet inspection (DPI) techniques described above. This means of identification allows website operators, governments and sophisticated adversaries to prevent connections from Tor exit relays or limit their functionality.

Another vulnerability of Tor relates to the correlation of data passing through network relays. Techniques exist that allow adversaries with limited view of the network to detect nodes that are used to relay the anonymous streams. Using sophisticated methods, these unrelated streams can be linked to the same source. In particular, adversaries may oversee some of your traffic if they control the entry relay or the exit relay by watching the servers’ responses. 

However only if the adversaries control both of these relays will they be able to associate you specifically with the traffic. In this case the adversaries can simply correlate the data entering the first and the last relay with responses from a server. This is called a correlation attack.

Tor Project is working on reducing the risk of such correlation attacks. When Tor uses three relays, a small risk arises that an adversary could conduct a correlation attack and therefore compromise the network.

In order to reduce this risk, Tor introduced guard nodes. Tor selects a small number of relays to act as guard nodes and uses one of them for all chains created by a specific user as long as the relay remains functional. There is no guarantee that a guard node is not controlled by an adversary, but in general the system of guard nodes reduces the risk of the network being compromised because the risk of having unreliable guard node is smaller than the risk of having an unreliable entry node in one of many virtual connections.

Further potentially undermining your anonymity are autonomous systems. Autonomous systems are when a collection of independent IP networks and routers are under the control of a single entity. Overall, the Internet has many of these autonomous systems.

When using Tor, the traffic goes through multiple different autonomous systems. There is a risk that the same autonomous system would be on the route between you and the entry node as well as between the exit node and the final destination you wish to visit. The consequence of this will be the same as if the entry and exit relays were controlled by the same adversary.

However this risk is reducing due to the expanding number of relays and Tor’s continuing efforts to improve security.

But many people face difficult circumstances, living under the shadow of Internet censorship, suppressed speech or oppressive regimes. So if you are an Internet campaigner and/or live in a country with an oppressive regime where Internet freedoms and curtailed, you will need to give these risks more consideration.

Related:

• All Your Activities are Being Tracked and Profiled
• Online Privacy Checks You Should Do Right Now
• How to Choose the Best VPN for You