I've known about Tor and onions for quite a while now, but haven't really gotten a chance to dive into them until quite recently. Because I've now had a chance to dive in, I figured I should write some blog posts about what it is, what tools are out there, and what my experiences have been with it. I also want to talk about its growing importance, and why you should know about it, use it, and support it.
Here's what this series is going to look like:
- Part 1: Basics about Tor, and the Tor Browser
- Part 2: Mirroring your site on Tor with EOTK
- Part 3: Spinning up an .onion, mining vanity .onion addresses, setting up a relay
- Part 4: Other aspects of Tor: Tor and python, SSL certificates, and .onion versions
I would not consider myself a Tor expert, certainly in respect to details of how the technology works. I've used the browser on and off for years, and I've more recently learned to mirror a site, and spin up a private service, which I'll talk about later in this series.
Tor is both software and a network. It provides the ability to browse and communicate anonymously and privately. It is often called "The Dark Web" by the mainstream media and others (it's also called DarkNet), and it is hard (but not impossible) to search (there isn't really a Google equivalent as of yet, although this site is trying). On balance, even though it can provide a haven for bad actors, it provides an essential good for people who need or want to avoid government and corporate surveillance or censorship.
And in the US, at least, as we move closer and closer to a surveillance state, being able to anonymously browse, and provide information to others is increasingly important, as is being able to circumvent censorship, whether it be governmental or corporate. Further, since tor is anonymous, it means that corporations (like Facebook and Google) can't track what you're visiting, and can't do targeted advertising. (There is advertising on the DarkNet, but it can't be targeted in the same way based on places you've visited, your searches, or your behavior.)
The name "Tor" is originally from the acronym of "The Onion Router." Onion Routing is implemented using layers of encryption - and as a message travels through multiple relays, the "onion" is peeled - each relay strips one layer of encryption, and the exit relay peels the final layer, and delivers the message unencrypted to the user's browser. The basic idea of how it works is that each relay only knows about the relay behind it, and so the user's location and identity is concealed. Further security can be provided by doing this over SSL, but as I'll talk about in the last part of this series, that has some caveats. In any event, all of this makes it very difficult to trace the internet activity of a user.
The Tor Browser is a browser (for all platforms) you can use just like any browser, except it will be able to visit .onion sites, where others cannot. It is a customization of Mozilla Firefox. It doesn't act that differently for non .onion sites, so you can use it if you wish as your normal browser. (It does have a tendency to drop cookies when the app is reloaded.)
A few places to go to once you download the browser (these are all onion links, they won't work without Tor):
- DuckDuckGo - 3g2upl4pq6kufc4m.onion
- Hidden Wiki - zqktlwi4fecvo6ri.onion
- ProPublica - p53lf57qovyuvwsc6xnrppyply3vtqm7l6pcobkmyqsiofyeznfu5uqd.onion
- Sci-Hub - scihub22266oqcxt.onion
- Freedom of the Press Foundation - freepress3xxs3hk.onion
- Facebook - facebookcorewwwi.onion - yes, Facebook has an onion site. They do track joins and usage using onions. But if you join using the .onion, and always login using the .onion, it probably means it would be impossible for them to know exactly who or where you are (that is, except when it comes to whatever it is you post, and who your friends are.)
- This is a great index of real-world onion sites, maintained by Alec Muffett.
OK, on to Part 2
