To help better understand Tor, let’s look at the protocol, its working and why you should use it.
What is Tor?
Tor or The Onion Router is a network that comprises a group of volunteer-operated servers aimed towards providing complete anonymity to users by enhancing their privacy and security on the internet. The online traffic redirects through a relay network (kind of a virtual tunnel) consisting of more than seven thousand relays to transfer information over public networks without compromising on privacy and security. In a way, concealing user identity and protecting it from nefarious activities like network surveillance and traffic analysis. Taking into consideration the different ways to secure and protect online presence, Tor rises to the top as one of the simplest and most-effective solutions. Which, when compared with other solutions like proxies, is a more noob-friendly approach that does not involve the tedious process of setting up the service every time you want to go online.
How does Tor work?
In a nutshell, Tor runs on approximately seven thousand volunteer-operated servers located across the world. These servers act as nodes which hop the internet traffic between sender and receiver in an encrypted manner. The underlying protocol used for the Tor network is the project’s very own protocol, called The Onion Routing protocol. As the name suggests, the word ‘Onion’ signifies the different layers of encryption that the information (data + header) goes through before making its way from the origin to the destination address. To simplify the concept, let’s first understand the anatomy of information sent over the internet. A piece of information or data packet consists of two parts: data payload and header. A data payload can be anything sent over the internet; be it an email, a picture, an audio file, or even a web page. A header, on the other hand, is a collection of meta-information like the address of source and destination, size of data, timestamp, etc. Tor utilizes the ‘onion routing’ protocol, which is implemented by encryption in the application layer of a communication protocol stack. In layman terms, the information (data payload + header) is first encrypted and then sent across the network with several relay nodes, forming multi-layered encryption. Hence, securing the entire communication.
The multi-layered encryption in Tor resembles the multiple layers of an onion. And therefore, the analogy. Once the information is encrypted and sent across the network, it is then decrypted one layer at a time at each successive Tor relay. And the remaining part of the information is then sent over to the next relay. The process continues to take place across all relays on the network until the information reaches its destination. In an ideal scenario, the traffic redirects over three relays/nodes, namely: Entry/Guard relay – As the name suggests, it is the starting node on the network, through which, the information begins its journey to the destination. Middle relay – It is an important relay on the network and plays a significant role in transporting/relaying traffic through the network. Besides, it also prevents the entry relay and the exit relay from knowing each other’s address or identity. Exit relay – It is the last node on the network and responsible for sending information out of the network to its destination address. By sending information through relays, the last/exit node tries to masquerade as the original sender of the information, from where it originated. It is this complexity of the network that makes it difficult to track the information back to its origin server. And in turn, to the original sender. Albeit the Tor community is always striving to increase the privacy and security of the Tor network, nothing on the internet is fool-proof. With that said, even though the network does not have a single point of failure, the last/exit node can sometimes change the scenario. And the fact that the relays present on the network are run by people on their machines back in their home, can be daunting for some people to trust the person on the other side of the internet. Mainly because, oftentimes, people with malice intentions can cause a lot of trouble if they manage to get control over the exit node, as the information from the exit node is sent un-encrypted to its destination address, and gaining control over it could eventually give these people full control over the network. To ensure such things don’t happen, and that people’s privacy and security are not on the line when using the network, constant measures are taken by the open-source community running the Tor services.
How to use Tor?
Using Tor is as simple as finding a Tor client for your device (and platform) and surfing the internet on a browser. It is available in the form of software on the desktop for Linux, Mac, and Windows, and in the form of an app for Android on the mobile side of things. The good thing about Tor is that the Tor community is always striving to increase its reach and get more people into using the Tor network. And to make it easier for anyone to use the Tor network, the community distributes what it calls, the Tor Browser Bundle (TBB). On a ground level, the Tor browser is preconfigured to send and receive web traffic through the Tor network, so that you don’t have to go through the tedious process of manually configuring it yourself. The Tor Browser Bundle, commonly referred to as the Tor browser is primarily the main product of the Tor Project. It is a run-down version of the Mozilla Firefox browser, which is modified and integrated with add-ons like TorButton, TorLauncher, HTTPS Everywhere, and NoScript, to take care of things like routing, encrypting, privacy, security etc. Here are the links to the Tor browser for various platforms- For Desktop (Linux, Mac, Windows): Tor Browser For Android: Orfox For iOS: Onion Browser Though there are some other alternatives to the software and apps mentioned above, most of them lack positive reviews from both, the community and the people using it across the world, to be recommended. On top of that, the ease of use that the Tor browser provides over others makes it pretty much the ideal choice for most of the people using the Tor network.
Is Tor completely secure?
In the online world, anonymity, privacy, and security are the most confused and misunderstood terms. And oftentimes, people are found confusing one with the other. So, before jumping on to find how secure Tor is, let’s first understand the differences between these terms. A thing to consider, however, is that the definitions for each of them may vary throughout the internet. So in no way should the following be considered as the ideal definitions.
Anonymity refers to when you want your online activities to be visible, but not your identity, i.e you are fine with people finding out what you do online, but do not want to reveal your personal information. Privacy, on the other hand, involves you taking control of preventing others from seeing any of the activities that you perform on the internet. Here, the concern is not hiding your identity, but the activities you do online. Security comes in different from the other two. It involves taking preventive measures to keep yourself safe on the internet from various online scams, attacks, threats, prying eyes, and a lot more. Coming back to the question of how secure Tor is, one thing that a lot of people need to understand is that on a broader spectrum the concept of internet security does not exist. And so it wouldn’t be wrong to consider that you are always being watched upon by someone, and therefore using the internet with that intent can prevent the damage to a certain level. As a solution, the Tor network is one of the few preventive measures available on the internet that makes sure you get some kind of anonymity on the internet while making sure your information is secure. Unlike any other measure, Tor also comes with its own set of drawbacks. Though the network is designed in such a way that it is nearly impossible to trace back to the origin of the information, the exit node can sometimes turn out to be the point of failure. To understand this, let’s say you’re using Tor to access Facebook. In which case, the request is passed through a series of different relays before it emerges out of the last/exit relay to connect with Facebook’s servers. When this happens, the request is made over an unencrypted link. This is the weakest link in the communication and can be utilized by someone for monitoring the traffic. After which, one can identify information like the website that is being accessed, and sniff personal information like login credentials in case the site is not using HTTPS (Hypertext Transfer Protocol Secure). It is for this reason that the Tor community follows several measures before allowing anyone on the internet to run an exit node (unlike other nodes) since the entire network’s security is dependent on this node. However, amidst all fears, a lot of people still use Tor while performing online activities. As it provides at least some level of protection to one’s identity on the internet, which is comparatively better in most aspects than taking no preventive measures or some measures, in general.
Should you use Tor?
If you are an average user who uses their device to browse (unquestionable) content and perform (unobjectionable) actions, you are fine with not using Tor, most of the times. Mainly because, with Tor, the traffic travels through several hops before it reaches its destination, causing a considerable drop in speed. And although you can use it on a daily basis to browse the internet anonymously and protect your privacy, the fact that you are using Tor appears suspicious to some websites to block your access and your ISP to have some consequences (in some cases). So, unless you are doing something that you want to circumvent through trackers or spying agencies on the internet, trading in for speed is not worth it. Apart from using services like Tor and feeling secured against various possible threats on the internet, it is always advised to be aware of the websites you access, the activities you perform, and the information that you put out on the internet, as an alternative method to protect yourself on the internet. Not to mention, following some of the best practices online like using a Password Manager to create and manage passwords, using a VPN to secure your internet access, etc.
Frequently Asked Questions
Now that you are aware of what Tor is, how it works, and why you should use it, let’s look at some of the most frequently asked questions about the topic and demystify the common myths.
Is Tor illegal?
The short answer is, No. Tor is not illegal, and you can use it personally unless you decide to indulge in illicit activities. In which case, you might end up in trouble. A common misconception that a lot of people have about Tor is that it is illegal. The reason behind which has to do with the wrong association people have created between Tor and dark web, that suggests using the service illegal. Whereas, truth be told, neither the Tor network nor the Tor browser is illegal unless a person indulges in some nefarious or illicit activities online.
Does Tor hide your IP address?
It does. Similar to how proxy/proxy server acts as a middleman between you (the source, requesting for service) and the server by allocating its own IP address, Tor also hides your IP address every time you send or receive data off the internet. It even encrypts everything (including the IP address) using advanced encryption standards to protect your privacy and security. As a matter of fact, the only IP address visible to your ISP is that of the exit/last node on the Tor network.
Is it safe to use Tor?
Like any other technology, Tor is not 100% secure or foolproof and has its own set of shortcomings and vulnerabilities, which can be leveraged by attackers to gain control over the network to perform any action. However, if used critically and responsibly, Tor can turn out to be an ideal tool to stay anonymous on the internet and protect your privacy. One of the best ways to use Tor effectively is to use the Tor over VPN setup. With this setup, you first connect to a VPN service and then connect with the Tor network. By doing so, the traffic is sent through the VPN server first before it reaches the Tor entry node. As a result, the VPN server can only see that you are connected to Tor and cannot tell where the traffic is going. In a similar way, it also tricks your ISP, and tricks into believing that you are connected to a VPN server, without giving away much information. Apart from this setup, there is another setup, called VPN over Tor, which sends the traffic through Tor first and then through the VPN server. And when compared with the Tor over VPN setup, it has its own set of advantages and disadvantages. However, taking several factors into consideration, the Tor over VPN setup comes out on top as the most effective setup of the two. As unlike the VPN over Tor setup, it does not connect to the Tor network directly, which is enough to send out alarming signals to your ISP letting them know you are connected to the Tor network. And in turn, get your services barred.
Is Tor better than VPN?
Both Tor and VPN allow users to browse the internet safely and securely and come with their own quirks. However, at a ground level, Tor is more of an anonymity tool, compared to VPN, which is focussed on privacy. When it comes to deciding which is the right fit for you, it is all about what you are trying to get out of these services. While VPN offers things like better speed, connectivity, compatibility, and ease-of-use, and comes in handy in situations when you need to access personal or bank information, do online shopping, use an open or public Wi-Fi, access geo-blocked websites, etc, Tor, on the other hand, provides complete anonymity, and comes out as the ideal tool when stakes are too high and a simple VPN is not enough to protect your identity. Which is why, out of the two, a VPN is more of a practical and easy-to-use tool to get around with securing yourself on the internet. And for a majority of people, that should usually suffice.
Is it illegal to be on the deep or dark web?
The internet you use every day comes under what is called the surface or visible web. It comprises the part of the internet that is indexed and visible to be crawled by a search engine. Generally speaking, the visible web constitutes 5% of the overall internet, leaving behind 95%, which is not indexed by the search engines. And therefore, the name. A subset of the deep web, called the dark web, is what people get confused with, and use interchangeably. To clarify, unlike the deep web, which comprises of webpages not indexed by the search engine, the dark web is dubious, and a part of the deep web used mainly for criminal and illegal activities. And although you can use Tor to access the deep web, visiting some of its parts, like the dark web, imposes a high-risk of compromising your privacy and security, and can land you in trouble.
