Tor for Technologists

How does Tor work?

The goal of Tor is to enable anonymous network traffic. The word Tor originally stood for The Onion Router (although Tor should not be capitalized like an acronym). Onion routing is the method that Tor uses to hide the IP address of the client. This also has the added benefit of making it extremely hard for anyone in between to see who is asking for what information on the Internet. In practice, this means that if someone is intercepting your traffic close to your computer, Tor will hide what servers you are talking to. If someone is intercepting traffic close to the server, they will not be able to see who is visiting that server.

Tor works by having thousands of volunteers hosting something called Tor Relays. These are fundamentally servers that spend all their time forwarding traffic. So when you want to access a service, the Tor client program that is running on your computer will choose three different relays. It will then take the packets of information and wrap them in encryption using public key cryptography. It will encrypt the packet three times over, to each one of the public keys of the relays that were chosen for this communication session. It will then send the triple-encrypted package to the first relay on the list. That relay will unwrap the encryption meant for itself - and what is left is a packet with two layers of encryption. The first relay will send the packet to the second relay, which will unwrap another layer of encryption. It sends this to the final relay which will unwrap the last piece of encryption. Since there is no encryption left, the final relay knows the real destination of the packet - so it contacts the original service requested. It then receives the answer and sends the information back, using the same process in reverse.

The final relay is usually called an exit relay. The first relay is usually called an entry relay. The way this works only the entry relay knows the real IP address of your machine - and only the exit relay knows which service you actually wanted to contact. And the service will only see the IP address of the exit relay. All of these things come together to protect the anonymity of the client quite well.

One important point is that you don't have to trust all the Tor relays in order to be able to trust the Tor network. Since anyone can set up their own relay, there is nothing that stops bad actors from setting up relays. Thus, Tor is designed to not be compromised even if this happens.

Tor is explicitly designed to be a low-latency network - that means it is possible to use it for things like Instant Messaging, audio conferencing or even video conferencing under good circumstances.

Anonymity is hard - what doesn't Tor protect against?

Tor is a tool, and just like any tool it has things it does well, and things it doesn't do so well. It is important to know that Tor can't protect against every threat out there. Even when you use Tor correctly, there are things to keep in mind.

The biggest day-to-day problem when it comes to anonymity and security with Tor is that if the traffic you are sending to a server isn't encrypted, then Tor will not help with that. Specifically, the traffic between you and the first two relays will be encrypted and hard to attack. However, the exit relay will be able to see all traffic that passes through. The way to protect against this is to either use a protocol that encrypt your information all the way to the endpoint (such as HTTPS or SMTP with STARTTLS). The other way is to use services that expose a hidden service - which ensures you get end-to-end encryption of all traffic.

Tor is usually classified as a low-latency network. This has a consequence for anonymity. Basically, Tor is designed in such a way that if an attacker can observe a large percentage of the network traffic between relays, it is possible for them to de-anonymize much of that traffic. The reason is that since Tor traffic is supposed to go out and come back in realtime, it can be possible to do correlation of packet times. This could lead to a privacy break. However, this is the way Tor was designed. Current research seems to imply that it is basically impossible to get total anonymity if you want something that is close to real time traffic. If you are fine with waiting a few hours for each packet to arrive, there are other kinds of techniques that can be used, but Tor is not designed for those use cases.

Tor can also not protect you if you make a mistake and expose your IP address in any way. A typical example of something that is a bad idea is to use Tor for peer-to-peer file sharing - not only does it destroy the Tor network - it also doesn't work to hide your address, since most file-sharing protocols expose your real IP address. If you want to be sure to not expose your IP address you also need to avoid running plugins that can expose it. This is one of the reasons why the Tor Browser Bundle doesn't ship with a Flash plugin - it is just too dangerous from a privacy-standpoint.

The same caveat is true if you expose your server as a hidden service. If you really want to keep it hidden you need to make sure that none of your server components expose your IP address in any way. This can be easier said than done, as the next section will talk about.

Is Tor broken?

When I talk to technologists about Tor, one of the more common questions I will get is whether I think Tor is broken or whether we really can trust it, whether the government has put a backdoor in it, etc. There are many rumors and theories about Tor out there, and in general they are just that - rumors and theories. That said, Tor doesn't protect against everything, as I mentioned above. However, I would be extremely surprised if Tor contains a backdoor. The code is open source and many, many experts have looked at it over the years. The protocol is also open and has been implemented more than once in other open source projects. It is of course not impossible that there exists a backdoor that no-one has noticed, but personally I wouldn't bet on it. I do recommend any technologist that is worried about this eventuality to spend a few hours and go through the source code. The project can always do with more eyeballs.

Everyday usage of Tor

Now that you have a better idea of what Tor is, it is time for us to quickly talk about how you can use Tor in your day-to-day job. As you can probably guess from the information above, Tor can be used for a lot of different purposes. But for the kind of work a developer is doing, the first and easiest thing you can do using Tor is to test your system in different ways. In many cases it's hard to see what a system looks like without cookies and personalization. Tor makes it very easy.

The other kind of testing you can do is to make it possible to very easily try a system in such a way that it looks like it comes from many different countries. It is possible to control which relays Tor will use in such a way that you can control which country your traffic will come out from.

As I mentioned before, putting SSH behind a Tor hidden service is a very useful way of getting access to your systems from anywhere on the planet, in a way that puts at least two layers of encryption on your connection. However, even for a setup like this, it's important to have good passwords (or only use public-key logins for SSH) and to make it impossible to login to the root account remotely.

Tails

If you happen to be in the kind of situation where Tor is absolutely necessary for you and you expect to be attacked by strong adversaries, you are in a tricky situation. Just installing Tor on your regular machine isn't necessarily going to be enough. Thus, there is a project called Tails, which is a Linux distribution that runs from a CD/DVD or USB drive. It is preconfigured to only send network traffic over Tor and also has many other privacy and anonymity features. It comes bundled with several different tools that will allow you to easily communicate privately, send encrypted email and also working with documents in a safe way.

The interesting thing with Tails is that it's completely amnesiac - it doesn't leave a trace on your computer after you have run it. It is possible to have it save a small amount of data, but by default no traces will be left.

Tails is not something you will need in your regular day-job, but there are certain cases where something like Tails can be extremely powerful. Every journalist should know how to use it - and so should every lawyer. It's a powerful tool and it's a good idea to be prepared to use it before it becomes necessary.

Conclusion

Tor is a fantastic tool that can do a lot of amazing things. It is one of the strongest examples of useful cryptography deployed in a safe way we have right now. As we have seen though, no tool is perfect. And in order to use Tor correctly, it's a good idea to know how it works. As a next step I would recommend you to download Tor and try it out. One of the interesting things about anonymity is that it loves company - even if you don't need the anonymity you are protecting others who do need it by using Tor. One day you might go forward and run your own Tor relay as well - something that improves the Tor network for everyone.