About the Tor Browser

The Tor Browser might be seen as a mystifying and possibly ominous topic given where you might have heard about it in the news. This article is intended to explain first what it is and how it may be used, for the purposes of assisting business managers in assessing whether the Tor Browser and related technologies might apply to their business, or to confirm, if you have a basic conventional business, that there is no need for it. This article can also help business owners assess whether and how they might want to investigate and take action if employees are detected using these technologies on the company network.

All computers and mobile phones come with built-in web browsers, with well-known brand names: Edge for Microsoft Windows devices, Chrome for Google Pixel and Chrome devices, Safari for Apple iOS and macOS devices, Samsung Browser for Samsung Android-based phones, and the Firefox browser by the independent Mozilla project. These browsers are designed for easy and functional access to websites, with optional "privacy" features to defend against collection of information about you as you browse and interact with websites.

All the web browsers send what you type in the search/address bar to their respective publishers in order to present suggestions and to collect information about you and how you use their browser, with various levels of tying them to any accounts you might be logged in to.

And then web servers, which are computers that host the web sites you visit, use various techniques to collect information about you during your visits, all of it for the purpose of marketing to you directly through ads it chooses to display, or to sell information about you to marketers. Techniques include logging your IP address, which is a globally unique, specially-structured number of up to 12 digits which not only identifies your computer, mobile device, or business or home network, but includes information that enables the thousands of Internet traffic routing devices around the world to get responses back to you in milliseconds after you click on a website link.

Web servers also embed "scripts" in the web pages you view, which are required for all the interactive capabilities you expect to use on websites (such as playing videos or making purchases). But scripts also typically give instructions to your browser to collect information about you. Most of this is information left on your device by other sites you visited, obtained through cooperative technological tricks used by non-related sites without having to communicate directly with each other. Scripts can also extract basic data about your computer or mobile device, such as your screen size, or even how fast or slow you move your mouse. Extensions or add-ons you install within your browser likewise collect information, which may include the data you send back and forth. All of this, along with your IP address, can be put together by web servers to identify you, possibly by name and address, but at the very least as an entry in a list of people showing all of your interests and general demographic information.

Apple Safari is unique in that many privacy features are on by default (primarily blocking activities by scripts it detects as collecting information), whereas other browsers set themselves up to collect and share as much about you as they can, requiring you to dig through many settings to turn that off. Mozilla Firefox also starts up with significant privacy features enabled.

Most Internet users, especially those in the United States, barely care about any of this. This includes people who don't care about companies tracking the sites they go to, and those who might even like or are simply indifferent to the targeted ads displayed.

But a not insignificant number of people wish to ensure the servers they visit know as little about them as possible. Some do it as a matter of principle, proudly declaring they don't use Microsoft, Google, or Apple products because they're big greedy corporations or whatever. Some might do it out of genuine fear of being more effectively targeted for scams or being a victim of identity theft.

Of course, the background collection of whatever they can get about your general activities by browsers and web servers is to be distinguished from actual personal information a user might enter into websites or share in social media posts. Sometimes discussions about "Internet privacy" don't really distinguish these. Activities, device, and location information collected automatically by the systems you use and sites you visit may be correlated with information you entered when signing up for an account if you log in to that account on the same device. But, it's important to understand that controlling how the technology you use pokes around to figure you out requires technical solutions, whereas controlling what you share on the Internet is done entirely by your choices. This article is about the former, and particularly the apex of technological solutions, the Tor Browser and related services.

One significant factor in anonymizing yourself while browsing the Internet is hiding your IP address from the web sites you visit. This is not easy to do, because your IP address is managed and assigned to your device or network by whatever company you pay for Internet access (either your mobile phone provider, or a cable, fiber, or DSL provider at your home or office), so you can't pick what it is or change it easily. Also, web servers need your IP address to be able to send the web pages you're trying to view. However, there is a technology called Virtual Private Networking (VPN) that can provide IP address anonymity from web servers.

The browsers Edge, Safari, and Mozilla have built-in VPN offerings you can enable that give you a two-hop relay of your web traffic through their system. This not only hides your IP address from the web servers you visit, but by rotating through a pool of IP addresses as you might connect on different days, the other methods the sites use might guess it's the same computer you're using to visit them all, but they cannot confidently assume it is if the various visits are coming from different IP addresses.

To use VPN with browsers that do not support built-in VPN (Chrome and Samsung), or for enhanced features, you might choose to sign up for a third-party VPN service. Some VPNs install as web browser extensions, redirecting brower requests through the VPN. But it's not just browsers that access the Internet. Most installed desktop or mobile applications also contact their publishers with whatever information about you and your system they can collect. So, third-party VPN services can come as system software installed in your computer or phone that redirects all traffic from all processes on your device to go through the VPN. A drawback of this might be loss of connection speed, as the setting up of the VPN connection, and use of encryption, take processing power and time.

Paid third-party VPN services can also let you choose which IP address your connections appear to come from. This is a popular option for people who want to watch movies or sporting events that are blocked in certain countries due to content licensing agreements or other restrictions. Many of these streaming sites try to identify the source of a potential viewer by correlating the user's IP address to a geographical location. So if you are in Germany want to watch something that can only be seen by U.S. users, you would choose to have your connections to the streaming site come from a U.S.-based IP address.

Here is how VPNs work, whether as a built-in function in a web browser, installed as a third-party VPN extension in the browser, or installed as networking software to route all communications from your computer through the VPN: The VPN provider offers an entry point server owned or otherwise controlled by the VPN provider for your browser or device to send its requests, such as to connect to a streaming soccer game. The VPN then looks at the actual IP address of the web server your browser or device was trying to reach, and then relays it to another server it owns or controls, called the exit node, which then conveys the request directly to the web server. The web server sees this as coming from the IP address of the exit node (and from the country you specified, if you're using that feature).

VPN providers advertise this is highly private, but of course if all your traffic is going through this VPN provider, then they can see all the traffic if they want. Of course, your communications with the web server can be encrypted between the web server and your computer, but the VPN provider can still at least see what sites you visit. And for any unencrypted communications with web servers, the VPN provider can see all of it. So, while you may be hiding your identifying information from the web servers you pull up in your browser, your privacy is only ensured as much as you trust the VPN service you use to respect it.

And many people who do want to be proactive about privacy are happy with this.

But to get to the next level, where it is technically impossible for anyone to relate your IP address to the web sites you visit, requires use of the Tor Browser. This is free download just like the other browsers, but it is part of a cooperative system of volunteers who have built a VPN service called the Tor Network that incorporates zero-knowledge principles using three hops. There is an entry node (called the "guard" in the Tor world) which the Tor user's request to access a web page goes to, then there is a middle node, and finally the exit node that makes the direct request to the web server. Because of layered encryption with encryption keys controlled by the user's Tor Browser, and three hops within the Tor Network for all communications, the exit node does not know and cannot find out which node was the entry node for this communication, even as it sends the web server's response back towards the Tor user through the same circuit. The middle node knows the entry node, but does not know the IP address of the Tor Browser user or any web server the Tor user is communicating with.

Tor is based on T.O.R., which stands for "The Onion Router". This name is used as a descriptor for the way encryption works, where layers are peeled off as with an onion, in order to support the zero-knowledge mechanism.

There is much more to this which is far too complicated to explain in perfect detail, including how encryption keys are negotiated between the Tor Browser and the three nodes it will use without revealing the IP address of the browser to anything but the entry node; how cyptography is used to prove the identity of nodes found in the directory (to prevent someone from intercepting communications meant for an entry node and faking all the layered encryption negotiation while tracking all the keys and thus being able to see all the traffic); and how circuits and encryption keys are rotated and destroyed to prevent cryptoanalysis.

In addition to this robust system of hiding IP addresses and ensuring privacy through the Tor network, the Tor Browser itself supports the most strict technological measures to impede web site scripts from collecting information, using tricks such as providing false information about the device when the script tries to collect it, and isolating each tab as if they're running on totally different computers, so as to limit the technological tricks websites can use to share information about you and what you're doing with each other. The Tor Browser also uses different circuits for each website you might have open at the same time, meaning different entry and exit nodes, so there's no way to correlate even multiple tabs being open as from the same computer. The circuits also rotate regularly, which isn't a typical feature of a conventional VPN, which will tend to stay using the same IP address for all websites the user is visiting.

The Tor Browser is typically touted as being used by anyone who needs anonymity from oppressive government, such as journalists or whisteblowers. Or by government or military agents who are engaged in law enforcement or intelligence activities. However, it does have a dark reputation due to its use by criminals either selling illegal drugs or weapons (which of course require clandestine methods for delivery, bringing its own intrigue), or hosting illegal photos and videos on websites.

There is even the term "dark web", which has sinister connotations, but really just refers to web servers (and other communications services) that are only reachable using the Tor Browser. These are also called "Onion sites" because they use non-standard protocols for making their existence known, they don't use the domain name lookup system of the regular Internet, and they can be reached without the user even knowing the IP address of the web server. This establishes anonymity of web servers, so conceivably a dissident can share information using a dark web server on the Onion network, and the government targeted by the site cannot track down its location, as its IP address cannot be known.

Finally, as for ordinary users just wanting to browse the web normally without worrying about being identified, many mainstream websites block or impede the Tor Browser, especially sites that tend to want to collect user information, such as search engines or other major content providers. It is easy for web server administrators to identify users of the Tor Browser, since anyone can get a list of the IP addresses of Tor exit nodes, and Tor users' attempts to access websites will all come from those IP addresses. By blocking use of Tor, users may resign to reverting back to mainstream browsers which allow tracking more easily.

Tor is not perfect; like anything, compromises are possible. Tor running on an operating system such as Microsoft Windows, for example, may be prone to flaws in the Windows operating system, which can leak a user's real IP address. How much of a concern this might be depends on why you're using Tor. If you're doing something illegal, it would be more of a concern than if you just in general like the idea of not being tracked for ordinary use of the web. To address this, the Tor Browser can be used on a bootable USB stick running a minimal Linux variant called Tails, which uses the Tor Network and the Onion routing system for all network communications, and is thus highly resistant to IP address leaks.

Apart from all this, Tor Browser users need to understand that of course if they create login accounts and enter their real email address or other real contact information into a web server that they wanted not to know their identity, then there was really no purpose in using Tor.

One final note: While topics of anonymity, legal and illegal activities, government actions, etc., were described above with neutral affectation, this article in no way endorses use of Tor for any illegal or immoral activities. Use should be only for research and development of private communications, cryptography, intelligence and counterintelligence; or simply for lawful use of Internet resources while taking advantage of technology that can help minimize personal information collection for people who, for their personal or philosophical reasons, wish not to have their lawful activities logged and/or correlated to their identity.