Continuing my previous posts on encrypting e-mail in a useful direction, I thought that I would discuss the use of Tor.
Tor is a tool supported by the Electronic Frontier Foundation (EFF), of which I am a dues paying member. The EFF are amongst those nice people currently suing AT&T for helping the government run a secret “wiretap the Internet” room under an AT&T hub in San Francisco (and likely others around the country as well). This was what prompted me to write about encrypting e-mail earlier this month and to begin doing so when possible.
In any case, the EFF’s Overview of Tor describes it and its uses with:
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. [...] Individuals use Tor to keep websites from tracking them and their family members, or to connect to news sites, instant messaging services, or the like when these are blocked by their local Internet providers. Tor's hidden services let users publish web sites and other services without needing to reveal the location of the site. Individuals also use Tor for socially sensitive communication: chat rooms and web forums for rape and abuse survivors, or people with illnesses. Journalists use Tor to communicate more safely with whistleblowers and dissidents. Non-governmental organizations (NGOs) use Tor to allow their workers to connect to their home website while they're in a foreign country, without notifying everybody nearby that they're working with that organization. Groups such as Indymedia recommend Tor for safeguarding their members' online privacy and security. Activist groups like the Electronic Frontier Foundation (EFF) are supporting Tor's development as a mechanism for maintaining civil liberties online. Corporations use Tor as a safe way to conduct competitive analysis, and to protect sensitive procurement patterns from eavesdroppers. They also use it to replace traditional VPNs, which reveal the exact amount and timing of communication. Which locations have employees working late? Which locations have employees consulting job-hunting websites? Which research divisions are communicating with the company's patent lawyers?
What Tor does is create a secondary network on top of the Internet. Individuals or organizations run Tor severs that route Tor traffic from Tor server to Tor server, regardless of where the end users are in the world. Locally, Tor runs as a proxy on your computer. When you use Tor, instead of sending your traffic, such as web requests, directly out to the Internet, you send them to your local Tor proxy. This then routes your traffic from Tor server to Tor server until it sends it out to your destination site. See the diagram from the overview below:
This allows users to not display their home IP address, often associated with your account at your Internet Service Provider, to the end site. This makes access effectively anonymous in that the server accessed only knows the last location in the chain. For example, a few minutes ago, I checked the IP address that I was using through Tor and it showed me as coming out of France even though I’m in Oakland, California. Minute to Minute, the Tor network plots different paths in order to switch servers around.
This can be used for more than just web traffic as well, though that is probably the most common usage. Some individuals run IRC servers within the Tor network or even websites and file storage servers that are only accessible if you are going through the Tor network. These are accessed through addresses ending in a .onion extension for the domain.
An example of that these websites is the primary wiki for Tor discussions. Tor has a public wiki at http://wiki.noreply.org/noreply/TheOnionRouter but the main internal Tor site is at http://eqt5g4fuenphqinx.onion. If you click on this link now, you will get an error as it isn’t a real domain. If you are going through the Tor network, you will be shown a website that says “Welcome to core.onion.” On this site is a truly anonymous wiki and messageboard where people post links to servers and resources. While I can say that not everything is savory there, it is a place of pretty good anonymity on the network.
Tools for Tor Use
If you wish to try Tor out, it is relatively simple to do so. I’ll give pointers to a few tools for this.
The primary tools that I use are:
Vidalia is a GUI for controlling Tor that works on Windows, Mac OS X, and Linux. It makes it easy to start and stop Tor, monitor traffic, and otherwise eases use. Privoxy is the proxy that you run locally in order to filter your traffic to Tor. Torbutton is an add-on for Firefox that allows you to easily turn Tor usage on and off when running the browser.
You will only need to install two packages though. The download page at Tor.eff.org has bundled downloads that install Vidalia, Privox, and Tor through a unified installer. You just download the bundle from the site (or through a torrent file), use the installer, and then Vidalia is available in your UI to turn everything on or off.
At that point, if you are running Firefox (which you should be anyway, right?), you can add Torbutton as an add-on within it. Torbutton adds a button in the lower right part of your status bar (or one to your toolbar if you want) which says “Tor Disabled” or “Tor Enabled”. This will switch back and forth when you click on it. If you use Vidalia to start Tor up and click on this button in Firefox, all web traffic will be routed through Tor until you click on it again. Torbutton has a number of options around cookies and your browser history but, by default, does not write Tor traffic to your browser history. Because browser cookies are left by most sites, it is probably a good idea to configure the cookie options in order to avoid revealing your identity.
Once you are using Tor through Firefox, you can then browse the http://eqt5g4fuenphqinx.onion site or anonymously access normal websites. It is only once it is turned on that you can access any sites with .onion top level identifiers.
This is a pretty cursory overview but I do encourage people to give Tor a try. It is a good technology to be familiar with, even if you don’t feel a need to use it all of the time. I’ve found that the entire net is available, though often a bit more slowly. The only issues that I’ve seen is that Google often identifies Tor servers as bots and does not want to serve up searches without proving you are a human first. This is a minor hurdle though.