How much can I trust Tor?

Question

Greetings.

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress.

I am a political activist from India and I do not enjoy the freedom of press like the Western countries do. In the event my identity is compromised, the outcome can be fatal.

Answer 1

TOR is better for you than it is for people in countries whose intelligence services run lots of TOR exit nodes and sniff the traffic. However, all you should assume when using TOR is that, if someone's not doing heavy statistical traffic analysis, they can't directly correlate your IP with the IP requesting resources at the server.

That leaves many, many methods of compromising your identity still open. For instance, if you check your normal email while using TOR, the bad guys can know that address is correlated with other TOR activity. If, as Geek said, your computer is infected with malware, that malware can broadcast your identity outside the TOR tunnel. If you even hit a webpage with an XSS or CSRF flaw, any other web services you're logged into could have their credentials stolen.

Bottom line, TOR is better than nothing; but if your life is on the line use a well-secured computer for accessing twitter and wordpress using it, and don't use that computer for anything else.

Answer 2

You can not say TOR can solve all your problems. There can be many ways to compromise your identity, let us say you have a worm in your system ? Since you accept you are a political activist there would be so many people ready to exploit your Computer.

Answer 3

It does give you considerably more protection than browsing directly. There are some identified weaknesses which offer potential routes to attack your computer, however these can be mitigated using normal protection on your machine (ie patch/av up to date, run as unprivileged user etc) but the only real weakness in terms of compromising privacy seems to be the following:

Given enough nodes, an organisation could make reasonable estimates as to the identity of an individual by tracking the behaviour on various websites. I think it is reasonable to assume that 3-letter agencies in the US have this capability, but I wouldn't want to guess about others.

In summary - you don't have a huge amount of options, so TOR is probably what I would recommend, but can you provide extra protection by connecting from different locations, and avoiding accessing twitter and wordpress in the same session? (unless of course the two are supposed to be linked?)

Answer 4

You would also need to be careful of the fact that your ISP is in a position to see that 'your IP address' is using Tor, even though it can't tell what you're using Tor for. If conditions are so hostile that you could be brought under suspicion simply for appearing to be clandestine, then you should take care to use Tor everwhere except on an Internet connection which can be strongly associated with you.