Tor: An anonymous Internet communication system

by Nitesh Dhanjani

Related link: http://tor.eff.org/



Tor has been around a while, but I have only recently had the chance to look into it in more detail:

Tor is a network of ‘virtual’ tunnels that allows you to connect to hosts on the Internet with increased privacy. You can use it to keep remote hosts (such as web servers you may be connecting to) from learning about your location (IP address). Tor does this by routing outgoing connections from your computer via “onion routers”, i.e. specifically designates hosts that have been setup to participate in the system. To quote from the Tor website:

“To create a private network pathway with Tor, the user's software or client incrementally builds a circuit of encrypted connections through servers on the network. The circuit is extended one hop at a time, and each server along the way knows only which server gave it data and which server it is giving data to. No individual server ever knows the complete path that a data packet has taken. The client negotiates a separate set of encryption keys for each hop along the circuit to ensure that each hop can't trace these connections as they pass through.

Once a circuit has been established, many kinds of data can be exchanged and several different sorts of software applications can be deployed over the Tor network. Because each server sees no more than one hop in the circuit, neither an eavesdropper nor a compromised server can use traffic analysis to link the connection's source and destination…”


Great! In addition to help protect everyday privacy by allowing web surfing to be anonymous for the ordinary user, Tor sounds like an excellent idea for those who wish to establish outbound connections via ISPs that prohibit certain protocols (since Tor uses proxy software to tunnel the connection via it's routers). Also, I'm pretty sure Tor will begin to be quite popular among BitTorrent users! However, do note that while Tor attempts to anonymize your location, it does not protect against protocol specific issues:

"Tor can't solve all anonymity problems. It focuses only on protecting the transport of data. You need to use protocol-specific support software if you don't want the sites you visit to see your identifying information. For example, you can use web proxies such as Privoxy while web browsing to block cookies and withhold information about your browser type.

Also, to protect your anonymity, be smart. Don't provide your name or other revealing information in web forms. Be aware that, like all anonymizing networks that are fast enough for web browsing, Tor does not provide protection against end-to-end timing attacks: If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your chosen destination, he can use statistical analysis to discover that they are part of the same circuit."


Appropriate links:
The Tor web-site.
Tor documentation.
Download Tor.
OS X specific instructions.

2 Comments

jwenting
2005-01-21 00:36:17
hardly anonymous
Instead of giving a hundred websites a tiny bit of information each you're giving one site your entire life history.


Hardly a promising outlook, in fact it's an ideal way to enact largescale identity theft.
The proxy (because that's what it is) can easily record your every password and all other private information.

niteshd
2005-01-21 09:27:15
hardly anonymous
The proxy runs on your local system. You aren't giving any 'one site' your entire life history. You might want to read the Tor white-paper and 'How it works' section.