117

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress.

I am a political activist from India and I do not enjoy the freedom of press like the Western countries do. In the event my identity is compromised, the outcome can be fatal.

  • 28
    Not really an answer, but note that Tor only grants anonymity, whereas any information you send out (including your password) will be freely exposed. – AviD Dec 9 '10 at 15:49
  • 20
    Just an (obvious) comment: Be very vigilant about using SSL (HTTPS) through Tor. Twitter fx has an optional account setting to always use SSL, which you should use. Also consider browser plugins such as EFF's "HTTPS Everywhere", and manually enter URLs into the Address Bar with the HTTPS:// prefix. – Jesper Mortensen Jul 17 '11 at 9:40
  • 6
    eff.org/pages/tor-and-https – sterz Sep 3 '13 at 20:38
  • 3
    I would suggest using Tor through a VPN too, so that your ISP which may be state controlled, can't see you're using it. – deed02392 Mar 19 '14 at 14:02
  • 3
    counterpunch.org/2014/07/18/… – TecBrat Jul 21 '14 at 14:44
78

Tor is better for you than it is for people in countries whose intelligence services run lots of Tor exit nodes and sniff the traffic. However, all you should assume when using Tor is that, if someone's not doing heavy statistical traffic analysis, they can't directly correlate your IP with the IP requesting resources at the server.

That leaves many, many methods of compromising your identity still open. For instance, if you check your normal email while using Tor, the bad guys can know that that address is correlated with other Tor activity. If, as @Geek said, your computer is infected with malware, that malware can broadcast your identity outside the Tor tunnel. If you even hit a webpage with an XSS or CSRF flaw, any other web services you're logged into could have their credentials stolen.

Bottom line, Tor is better than nothing; but if your life is on the line, use a well-secured computer for accessing Twitter and WordPress using it, and don't use that computer for anything else.

  • 1
    Thank you. For my part I use Linux even though I am not good at it. – Freedom Dec 9 '10 at 15:27
  • 13
    @Pacerier "Hi, I'm <name>, I live at <address>." – Polynomial Aug 22 '12 at 11:56
  • 1
    What about TAILS? – KnightOfNi Jul 1 '14 at 23:40
  • 1
    Tor is casual anonymity if used without additional measures against leaking of data into the internet. Even if you use the Tor browser bundle, you will expose a lot of "noise". Especially if used on commercial operating systems which rely on cloud based services, submitting telemetry and frequently sync data. Tails is a very convenient way to make it harder for some parties to identify you. But it most likely won't help against gov. attacks. If you want to work anonymous, anything which can communicate to the outer world must be disabled and physical access to the computer must restricted. – Axel Napolitano Mar 9 '17 at 22:53
  • 1
    If you want to go one step further you should consider that usage of such tools may make you suspicious. And this shouldn't be underestimated. If used with your own ISP, the ISP may and can detect that you are using TOR. Beside all other decisions, you should be aware that security is not convenient and that you have to change the way you use technology and services. A static mail address? Forget it! Carry a phone while wanting to surf the internet? Forget it! Use the same internet access point more than once? Forget it! Use you "anonymous" device for all day work and games? Forget it! – Axel Napolitano Mar 9 '17 at 23:06
41

2013 calling

I think this question deserves a new answer after what we know now. Given the financial sources of the Tor project and what we learned about the NSA inserting backdoors (e.g. see here) casts a shadow on the trustworthiness of the project.

From the annual report for last year (linked above):

excerpt from the fiscal report of the Tor project for 2012

However, keep in mind that the US government claims they want to enable all kinds of people around the globe to communicate unencumbered by local national censorship. You yourself probably fall into that category. It does of course not preclude eavesdropping on them, but it would give a motivation for financing the project other than the potential darker intentions one could think of in light of the recent leaks concerning global surveillance.

Also, this recent publication ("Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries") about how identifiable users puts a big question mark on the usefulness of Tor w.r.t. anonymity. Apparently that's a big concern of yours.

I don't know what resources the Indian government (assuming that's your "adversary") has available, but it's certainly a factor to be considered.

All that said, I think that in combination with other measures such as re-mailers, encryption, VPN and so on, you can probably evade successfully for some, possibly even a very long time. So Tor will be useful as one thread in a safety net. But be aware that this thread may turn out inefficient, so don't let it be the only type of thread in your safety net.

  • 2
    This is a really bad conspiratorial answer essentially calling out finances and claiming it affects the security of an open source tool, especially when you mention an unrelated NSA program. Then you link to a single (of many) research papers that only work in a lab environment, i.e. without the natural jitter and latency of the real world. – forest Feb 24 '18 at 3:47
33

You would also need to be careful of the fact that your ISP is in a position to see that 'your IP address' is using Tor, even though it can't tell what you're using Tor for. If conditions are so hostile that you could be brought under suspicion simply for appearing to be clandestine, then you should take care to use Tor everwhere except on an Internet connection which can be strongly associated with you.

  • 1
    You can use an obfuscated bridge to hide that fact from your ISP. That is what they are for. – forest Feb 24 '18 at 3:51
21

It does give you considerably more protection than browsing directly. There are some identified weaknesses which offer potential routes to attack your computer, however these can be mitigated using normal protection on your machine (ie patch/av up to date, run as unprivileged user etc) but the only real weakness in terms of compromising privacy seems to be the following:

  • Given enough nodes, an organisation could make reasonable estimates as to the identity of an individual by tracking the behaviour on various websites. I think it is reasonable to assume that 3-letter agencies in the US have this capability, but I wouldn't want to guess about others.

In summary - you don't have a huge amount of options, so TOR is probably what I would recommend, but you could provide extra protection by connecting from different locations, and avoiding accessing twitter and wordpress in the same session? (unless of course the two are supposed to be linked?)

  • 2
    I really don't think that the state machinery would spend that much time uncovering my identity, but thanks for the advice. – Freedom Dec 9 '10 at 15:28
  • In which case Tor probably is right for you :-) – Rory Alsop Dec 9 '10 at 17:32
5

You can not say Tor can solve all your problems. There can be many ways to compromise your identity, let us say you have a worm in your system? Since you accept you are a political activist there would be so many people ready to exploit your computer.

  • 1
    I use Linux and the laptop I use for my work is completely isolated. – Freedom Dec 9 '10 at 15:28
  • 4
    Using Linux is not, of course, a solution to malware on your system. Isolation is, of course. – AviD Dec 9 '10 at 15:46
  • 1
    Very interesting. Which OS Suse, Redhat, Fedora, Ubuntu ? Do you think they don't have vulnerabilities ? – Geek Dec 9 '10 at 16:04
  • 3
    I'm by no means advanced in security, but, while may be better than your average Win-dows box, "Linux" (which one?) does not equals "safe". There are OSes that try harder to be "secure at default", ie. openbsd.org/security.html – n611x007 Oct 22 '12 at 18:59

protected by Community Sep 14 '15 at 12:34

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.