Just Add Onions for Online Privacy?

Tor Browser Offers Enhanced Privacy and Safety

For the uninitiated: Tor (short for The Onion Router) is a decentralized, global network of anonymous proxy servers. Each node in Tor acts much like a VPN (virtual private network) server. It accepts your browser’s requests for Web content, connects to the server(s) on which the objects reside, downloads copies and transmits them to your browser. The Tor node acts as your proxy; hence the term “proxy server.” The benefit of Tor is that the remote server does not get any data about you, since you never connect to the remote server; a Tor node does that on your behalf.

Tor promises to protect against tracking, surveillance, and censorship while you browse the Web. The Tor Browser blocks cookies and deletes your browser history when you close it. For each web page you visit, your request is sent through several Tor relays scattered around the world. At each relay, your traffic is re-encrypted and assigned a new IP address. The website you visit can't tell where you are connecting from. And your Internet Service Provider (ISP) can't see what sites you visit. They'll only see that you're connecting to the Tor network, but not where you go from there.

So what about the onions? The onion metaphor is used because on each hop along the Tor network, your request is wrapped in another layer of encryption, calling to mind the layers of an onion. The onion routing protocol was invented in 1995, at the U.S. Naval Research Lab. Mathematicians David Goldschlag, Mike Reed, and Paul Syverson were looking for a way to create internet connections that don't reveal who is talking to whom. Their work was picked up in the early 2000s by MIT, received funding from the Electronic Frontier Foundation, and in 2006, the nonprofit Tor Project was founded to maintain Tor's development.

As you can imagine, a software tool conceived by math nerds and MIT grads was a bit geeky and difficult for the less-technically savvy people to use, so the Tor Browser was created to put a user-friendly interface on it. The Tor browser is based upon Firefox, and the Tor Project team is a coalition of part-time developers. You can download the Tor browser here.

It is theoretically possible to backtrack a Tor network request to see where it actually originated. However, it would take a determined attacker with lots of time and computing resources to do so. To frustrate such espionage, the Tor developers are constantly improving the product to make it more secure. Tor, they say, is the strongest tool for privacy and freedom online. But on the Tor Frequently Asked Questions (FAQ) page, the first question is "Am I totally anonymous if I use Tor?" And the answer is: "Generally it is impossible to have perfect anonymity, even with Tor." That is followed by a list of things you should do (or NOT do) to improve your anonymity while using Tor. I strongly recommend you read through that list before merrily wandering off into Tor land.

Why Use Tor?

There are many good reasons to use Tor, but some of them are bad. Tor provides cover for activists, journalists, authors, and others whom a repressive government might want to track down or merely associate with certain “forbidden” content on the Web. On the other hand, Tor also covers the tracks of illegal arms and drug dealers, child traffickers, copyright violators, mobsters, miscreants, and malefactors.

But that’s not us, right? We are going about lawful business using a network that runs through parts of the world where privacy is banned, or where additional layers of privacy are desired.

I found installation of the Tor Browser to be quite straightforward. If you've ever downloaded software via the Web, you'll find it familiar. In less than 5 clicks, I was up and running with Tor. On the downside, websites I visited loaded noticeably slower than usual, especially those with many images. One other glitch was that some pages loaded in languages other than English, because the proxy that was used to connect me was located outside the USA.

Pirates, Rabbit Holes, and Latency

Thinking of “sketchy sites to check out with Tor” led me first to The Pirate Bay. (In case you're not familiar, TPB is described by Wikipedia as "an online index of digital entertainment media and software." That's a polite way of saying that it's a search engine for pirated movies and music.) I got an "unable to connect" error. Solution: I tried again later, and it worked. If you have trouble connecting to a website, or need help with Tor, see the Tor Project’s FAQ page.

Elsewhere on the Internet, Tor mostly behaves well, but slowly. On my gigabit connection, Fast.com reported Tor’s download speed as between 12 and 27 Mbps with a 360 ms latency. The same test a moment later but using Chrome without Tor yielded 820 Mbps with 9 ms latency. (Latency is the time delay between a request and the response on a network.) In my testing, some sites that work just fine in Chrome, Edge or Firefox failed to load, or loaded partially with the Tor browser. In most cases, reloading solved the problem.

Pages will load significantly more slowly via Tor than they do over the regular Internet. I did get a bit impatient waiting for the last bits of a page to load, perhaps as long as 45 seconds after the first bit arrived. But YouTube audio and video files play just fine on Tor; there is no choppiness, at least with 480p resolution. Download speed is not the problem; that 360 ms latency is. Once a video file starts streaming it does so continuously at an adequate speed. But a web page that fetches content from 15 different sources takes 0.3 x 15 = 5 seconds longer to load due to the high latency of each fetching. The delay might be reduced if Tor downloaded pages via multiple parallel connections, but that does not seem to be the case in my experience.

Extra Onions, Hold the Liver

Along those lines, there are multiple levels of security available. With the default "Standard" level, all Tor browser features are enabled. The "Safer" level disables "certain features that are often dangerous", such as Javascript on non-HTTPS sites, certain fonts, and math symbols. Audio and video that would normally autostart will be forced into click-to-play mode. The "Safest" mode is recommended only for static sites and basic Web services; Javascript is completely disabled. When I tried to test my speed on Fast.com in Safest mode, it failed and said I was not connected to the Internet, or returned a speed of zero.

It's also worth noting that the Tor developers recommend against installing Firefox add-ons with Tor Browser, because some add-ons can bypass proxy settings and break anonymity. Torrent (file-sharing) applications are also a possible source of privacy leaks on the Tor network. And of course, Tor cannot protect your privacy on a website that requires a sign-in, or if you explicitly provide personally identifying information on a Web form. By signing in, you have identified yourself to that website. And as I mentioned above, there are some other important do's and dont's on the Tor Frequently Asked Questions (FAQ) page.

So for browsing the mainstream Internet, the Firefox-based Tor browser is easy to use and provides considerable anonymity, meaning it would be extraordinarily expensive to figure out who is behind Tor’s proxies. I don’t live in or visit China, Russia, or North Korea, have no plans to join a covert organization, and a life of crime does not appeal to me. But if anything should change it’s great to know that Tor is available to cover my tracks, and that it works so well.

Have you tried Tor? Your thoughts on this topic are welcome. Post your comment or question below...