Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress.

I am a political activist from India and I do not enjoy the freedom of press like the Western countries do. In the event my identity is compromised, the outcome can be fatal.

share|improve this question
13  
Not really an answer, but note that Tor only grants anonymity, whereas any information you send out (including your password) will be freely exposed. –  AviD Dec 9 '10 at 15:49
8  
Just an (obvious) comment: Be very vigilant about using SSL (HTTPS) through Tor. Twitter fx has an optional account setting to always use SSL, which you should use. Also consider browser plugins such as EFF's "HTTPS Everywhere", and manually enter URLs into the Address Bar with the HTTPS:// prefix. –  Jesper Mortensen Jul 17 '11 at 9:40
    
Have a look to this article: blog.torproject.org/blog/plaintext-over-tor-still-plaintext –  noktec Jun 26 '12 at 11:19
    
I think if you have javascript enabled in tor, it can use some code to reveal your ip address.<br /> is this true? –  user19852 Jan 19 '13 at 15:37
2  
eff.org/pages/tor-and-https –  sterz Sep 3 '13 at 20:38
show 1 more comment

6 Answers

up vote 38 down vote accepted

TOR is better for you than it is for people in countries whose intelligence services run lots of TOR exit nodes and sniff the traffic. However, all you should assume when using TOR is that, if someone's not doing heavy statistical traffic analysis, they can't directly correlate your IP with the IP requesting resources at the server.

That leaves many, many methods of compromising your identity still open. For instance, if you check your normal email while using TOR, the bad guys can know that address is correlated with other TOR activity. If, as Geek said, your computer is infected with malware, that malware can broadcast your identity outside the TOR tunnel. If you even hit a webpage with an XSS or CSRF flaw, any other web services you're logged into could have their credentials stolen.

Bottom line, TOR is better than nothing; but if your life is on the line use a well-secured computer for accessing twitter and wordpress using it, and don't use that computer for anything else.

share|improve this answer
1  
Thank you. For my part I use Linux even though I am not good at it. –  Freedom Dec 9 '10 at 15:27
    
What does "broadcast your identity outside the TOR tunnel" actually mean? –  Pacerier Jul 17 '12 at 20:32
1  
@Pacerier "Hi, I'm <name>, I live at <address>." –  Polynomial Aug 22 '12 at 11:56
    
@Pacerier For example, a remote access trojan on the system would both be aware of Tor running and possibly a direct route to the Internet. It could expose all this information in its C&C server traffic. Generally these aren't state-controlled but Snowden releases make it feasible enough, you ought not bet your life on it. –  deed02392 Mar 19 at 14:02
add comment

You can not say TOR can solve all your problems. There can be many ways to compromise your identity, let us say you have a worm in your system ? Since you accept you are a political activist there would be so many people ready to exploit your Computer.

share|improve this answer
1  
I use Linux and the laptop I use for my work is completely isolated. –  Freedom Dec 9 '10 at 15:28
3  
Using Linux is not, of course, a solution to malware on your system. Isolation is, of course. –  AviD Dec 9 '10 at 15:46
    
Very interesting. Which OS Suse, Redhat, Fedora, Ubuntu ? Do you think they don't have vulnerabilities ? –  Geek Dec 9 '10 at 16:04
    
I'm by no means advanced in security, but, while may be better than your average Win-dows box, "Linux" (which one?) does not equals "safe". There are OSes that try harder to be "secure at default", ie. openbsd.org/security.html –  naxa Oct 22 '12 at 18:59
add comment

It does give you considerably more protection than browsing directly. There are some identified weaknesses which offer potential routes to attack your computer, however these can be mitigated using normal protection on your machine (ie patch/av up to date, run as unprivileged user etc) but the only real weakness in terms of compromising privacy seems to be the following:

Given enough nodes, an organisation could make reasonable estimates as to the identity of an individual by tracking the behaviour on various websites. I think it is reasonable to assume that 3-letter agencies in the US have this capability, but I wouldn't want to guess about others.

In summary - you don't have a huge amount of options, so TOR is probably what I would recommend, but can you provide extra protection by connecting from different locations, and avoiding accessing twitter and wordpress in the same session? (unless of course the two are supposed to be linked?)

share|improve this answer
1  
I really don't think that the state machinery would spend that much time uncovering my identity, but thanks for the advice. –  Freedom Dec 9 '10 at 15:28
    
In which case Tor probably is right for you :-) –  Rory Alsop Dec 9 '10 at 17:32
    
freedom is way wrong - they are spending billions on network security and sniffing of all important internet traffic and real-estate. –  Rob Sep 10 '13 at 4:03
2  
@Rob He is talking about India. –  Falaque Dec 19 '13 at 14:15
add comment

You would also need to be careful of the fact that your ISP is in a position to see that 'your IP address' is using Tor, even though it can't tell what you're using Tor for. If conditions are so hostile that you could be brought under suspicion simply for appearing to be clandestine, then you should take care to use Tor everwhere except on an Internet connection which can be strongly associated with you.

share|improve this answer
add comment

2013 calling

I think this question deserves a new answer after what we know now. Given the financial sources of the Tor project and what we learned about the NSA inserting backdoors (e.g. see here) casts a shadow on the trustworthiness of the project.

From the annual report for last year (linked above):

excerpt from the fiscal report of the Tor project for 2012

However, keep in mind that the US government claims they want to enable all kinds of people around the globe to communicate unencumbered by local national censorship. You yourself probably fall into that category. It does of course not preclude eavesdropping on them, but it would give a motivation for financing the project other than the potential darker intentions one could think of in light of the recent leaks concerning global surveillance.

Also, this recent publication ("Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries") about how identifiable users puts a big question mark on the usefulness of Tor w.r.t. anonymity. Apparently that's a big concern of yours.

I don't know what resources the Indian government (assuming that's your "adversary") has available, but it's certainly a factor to be considered.

All that said, I think that in combination with other measures such as re-mailers, encryption, VPN and so on, you can probably evade successfully for some, possibly even a very long time. So Tor will be useful as one thread in a safety net. But be aware that this thread may turn out inefficient, so don't let it be the only type of thread in your safety net.

share|improve this answer
1  
+1 for great answer. –  Falaque Dec 19 '13 at 14:18
add comment

Rory It doesn't answer the question directly but it relates to it! Freedom likes to know how to not be traceable from his government due to his political activities on the web.

So taking the right measures along with using the proper tools will make hiding your identity even better assured.

You can tell someone to use windows without an antivirus/internet security yet you tell him to use TOR to protect his identity. what if you got a spyware ? Also using applications like torrent apps will certainly expose your IP regardless of whether you're using Tor or not.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.