Are you a Tor Browser user?

If yes, then what are the problems you see?

If not, then why don’t you use Tor Browser?

The Tor Project has the mission to advance human rights and freedoms by
creating and deploying free and open source anonymity and privacy
technologies. Based in United States, The Tor Project is a 501©3
nonprofit since 2006, and has been working with Internet freedom since
the mid 1990s. By providing uncensored web, Tor helps millions of people
around the world to access information using Tor Browser.

7 Likes

first problem I faced when trying it out on a LTE data network itself was that it took almost forever to get the thing set up and the browser launched. It was always stuck at a certain %. Normal browsing obviously happened at much more usable speeds. Makes it not a very useful option for common usage. Like you really need more patience than internet freedom to use it on some networks.

1 Like

Hi Kushal, I am a user of TOR but use it primarily for site testing and opening URLs which I do not want tracked back to my IP. Have a few more uses however it’s use is restricted due to concerns on speed and how it sometimes breaks the UI. I recognize these limitations are often what enables ad-tech but may be I have an over-expectation of using TOR more broadly for general browsing one day.

High hopes

7 Likes

Hey Kushal. So I’ve always been curious but never had cause to use it.

For me the biggest concern is that my data is private between me and the sites I visit, and HTTPS is enough for that. In the few instances that I need to unblock a site, I use a private OpenVPN server. Yes, my VPS provider could possibly track me, but that isn’t a huge concern for me.

Tor seems overkill for my threat profile. I’m curious why you use it, and how (do you leave it on all the time, or turn it on for a few sites, etc?).

2 Likes

I use Brave primarily and it comes with a TOR mode for private sessions which I use as needed. I don’t see the need to use TOR for all my browsing and some stuff I do use (like Steam) do not allow proxies to be used while connecting them.

4 Likes

I may have used Tor around 5 years ago, it was slow but ok if you are looking for privacy, then I started using VPN which was much easier to configure and available on different platforms. Updating Tor was also an issue.

1 Like

Thank you all for your replies.

If you want to know why should you use Tor more, please have a look at https://www.eff.org/pages/tor-and-https.

https://summertraining.readthedocs.io/en/latest/tor.html has some basic starting point if you are new to the Tor Project.

1 Like

What are your thoughts on privacy related features of Firefox? IMO they are a good start with 3rd party content and ad blocking. Their idea of DNS over HTTPs also seems interesting to me.

1 Like

What are your thoughts on privacy related features of Firefox? IMO they are a good start with 3rd party content and ad blocking. Their idea of DNS over HTTPs also seems interesting to me.

Firefox is slowly picking up many privacy features from the Tor Browser. Which is amazing as that helps to provide the same to many million users at the same time. But, this is not the same level of the Tor Browser.

https://panopticlick.eff.org/ test this on your browsers :slight_smile: You will have fun to learn how much fingerprinting is available on the modern day browsers.

4 Likes

I use Tor to access hidden services & sometimes just to proxy my connection. Most of the time I’m on a semi-high latency, low bandwidth network & Tor makes it slower.

@debapriyo I don’t know about mobile but on desktops you could run the the Tor daemon on startup & ask other applications to proxy through it. There’s a program called torsocks that you can use if the application can’t proxy itself.

@abhijit You could use it to support the project.

Few years back when I used to write simple php applications there was no good & free platform to host my project, I used to host it on my computer & run a hidden service (to show it to my friends).

2 Likes

i don’t get what to conclude from the fingerprint. it’s not clear how it is unique and how is that used uniquely.

i don’t get what to conclude from the fingerprint. it’s not clear how it is unique and how is that used uniquely.

Maybe this will help https://pixelprivacy.com/resources/browser-fingerprinting/

i don’t get what to conclude from the fingerprint. it’s not clear how it is unique and how is that used uniquely.

Okay here’s what I understand -

On the fingerprint result, there is a link with a breakdown. It tells me that:

  • 1 in 2503 browsers has my (DOM?) browser’s Canvas ID
  • 1 in 2753 browsers has my browser’s WebGL ID
  • 1 in 1047 browsers has my WebGL vendor ID.

Assuming no overlap (edge case), that means I can be identified out of 2503 * 275 * 1047 = 7.2 billion browsers.

There fortunately, is an overlap among those numbers, and the results page estimates that I am conveying at least 17.56 bits of info, which means I can be identified among at least 193,235 browsers. Combined with my IP address, that sounds more than enough to identify me uniquely even without persistent cookies.

Statisticians please correct me if my understanding is wrong.

1 Like

You will have fun to learn how much fingerprinting is available on the modern day browsers.

“fun” :nerd_face:

I don’t even understand basic math properly, I can not answer to your question. Good luck in finding the answers.

1 Like

Haha! I’m fairly confident in my understanding, but could have overlooked something, hence the disclaimer.

Thanks for the link, opened my eyes about how useless incognito/private mode can be.

thanks for the explainer although I was not clear about the bits into browsers conversion. i still have the fingerprinting explainer article to finish…
why are these ID’s you mention above not designed to be randomized, except maybe the vendor ID, which I’m guessing has some fixed parts like a MAC address?
It still says that your browser is your ‘persona’ that is tied to all your browsing habits across sessions without the use of cookies. I’m guessing not just the collection of info from tracking a browser actiivity but getting it in the hands of some entity who wants to profit or harm is the real worry behind being “unique’d” out. Combining with IP address isn’t much useful in this day, when people are more mobile and move devices between networks.

So, as I understand it, the problem is not unique IDs, but a combination of unique identifiers.

For example, I may have an AMD RX 580.
That means I am one in (say) 1 million users that have this card.

I also use Firefox. There may be 13 million Firefox users but the number of users that have both Firefox and RX580 will be only 320,000.

Of that I run at FHD resolution. I am now one in 200,000.

I use MacOS. One in 30,000.

I have Adobe flash, Unity and Google Docs as plugins. One in 7,000.

(IP) I am in Bangalore. One in 200.

(IP) I am with act broadband. One in 50.

And so on.

The numbers are made up but I think you get the idea. It’s not unique identifiers per se, it’s generating a unique identifier by combining different data points that your browser is leaking about you.

The TOR Project recently announced that they had found a bug in the browser and were working on a patch for the same. The bug allowed the JavaScript to run which could be used to track the user’s real IP.

It is believed that this vulnerability was known to NSA since at least 2013 and was exploited in, what the agency called, project egotistical giraffe.

Another attempt to track the traffic even when a user used TOR was to stain it. This was done in the project Mullenize by the British GCHQ.

{I must admit here that I have a strong suspicion (read: conspiracy theory) that TOR is an NSA/CIA/FVEY funded program. My suspicion only grew stronger after Crypto AG.}

Also, I have a few questions which might come across as naive, however, I shall be grateful if anyone can answer them:

  1. It is a common observation when visiting torrent sites without VPN that they are not only able to track and display my location with much accuracy, they are also aware of the resolution and cores of my laptop. Does the same happen even when I use the TOR browser? { use the inbuilt TOR in my brave browser ever since I came to know of Chrome’s bad habits}

  2. When browsing the onion sites via TOR do we need to always cover our laptop’s camera? Is the threat always looming?

  3. When using TOR, is it advised to close other sessions on our browser i.e. the ones on the regular browser? Can we be tracked by any site because we have multiple sessions on?

The name of the project is “Tor”, not “TOR” :slight_smile:

Next, this particular issue in the Tor Browser would allow to execute JS on the safest mode. Just having JS enabled does not mean that people can track your real IP. On an average day, most of the users will never disable JS for daily browsing experience. One particular example where people disable JS is SecureDrop source interfaces, where people connect to leak information.

Now, as you pasted linked from Snowden’s leak to prove that 3 letter agencies can break in via Tor Browser, please read the Tor Stinks from the joint GHCQ/NSA, where they talk about difficulties in identifying the users (biggest reason to find people: DUMB Users).

One the initial funding of the Tor Project was from US Navy. The Tor Project is an US 501(c)3 nonprofit, so you will be able find details on funding from the public reports. Now, as you are worried about govts sponsoring privacy projects, I would say you will be horrified to know that most of the privacy projects do get funding from various govt funds. You should read about OTF.

No, if you use the Tor Browser, then the websites will not know about your real identify, unless you are providing it.

The onion services are just yet another web service, but, you are visiting them over the Tor Browser, which has better security than the other browsers. You should always cover up your webcam, the chances of people breaking into your computer via a malware is much higher than from an onion service.

Totally depends on what sites and what exactly you are doing. If you have the same site open in multiple browsers on your systems, the chances are that you will mixup, and will try to open a site in your normal web browser than over the Tor Browser.

5 Likes