Sorry for the dumb question, but I am new to TOR. I watched the Social Dilemma documentary on Netflix and got freaked out and downloaded the TOR browser. I know I sound naive, but I’m just trying to learn more about it and take more control over my privacy and personal data. I am also confused about the TOR+VPN situation, every time I open the browser, it makes a connection with a foreign country. So isn’t that what a VPN does anyway? Why do people then recommend using a third party VPN in conjunction with TOR?
Thanks for clarifying!
These are a bunch of very good questions.
Is logging into accounts […] while using TOR okay?
Some people blindly recommend to everyone not to use any accounts with Tor. Those generalized recommendations that claim to have the right solution for everyone are usually not very accurate to say the least.
The true answer is it depends on your goal. If you log into your Facebook account that is connected with information about your real identity you are of course not anonymous to Facebook anymore, so if you want to stay anonymous to a site you are visiting you should of course not enter any identifying information like you would normally do on social media and with many other accounts. However while Facebook or whatever site you logged into will know your identity, it will not know your location and IP address as it would if you used a normal browser. Tor will also hide your activity from your ISP and anyone watching your internet connection. They will know that you used Tor, but they won’t know you accessed Facebook for example. However you should know that many sites block accounts created over Tor or block you from logging in over Tor due to abuse. So you might want to use a regular privacy respecting browser like Firefox for your accounts. This also allows you to stay signed into your accounts while Tor Browser clears all cookies, logins, history and other browsing data on being closed signing you out everywhere.
Why do people then recommend using a third party VPN in conjunction with TOR?
Most likely because they don’t understand Tor. You simply don’t need a VPN with Tor.
isn’t that what a VPN does anyway?
Kinda, but Tor Browser does a lot more than a VPN and provides way stronger anonymity. A VPN simply routes your traffic through a VPN server hiding your IP address from the sites you visit and your internet activity from your ISP and others watching your connection. However this does not solve the problem of your traffic being traceable, it just shifts it to the VPN. The VPN will see everything your ISP used to see and while sites you connect to won’t know your IP address, the VPN will know your real IP address and which sites you visited. VPNs are privacy by policy. You have to trust the VPN not to keep any records of your activity without any guarantee for it. At any time the VPN can start or stop recording information about your activity. So even an audit by an independent company cannot guarantee the VPN is keeping its own promises and policy. Additionally VPNs are a single point of failure. Even if the VPN is not spying on you, you still have to trust it to secure its infrastructure against attacks. If an attacker gains access to the VPN server you are using they will be able to see and track your activity. Furthermore VPNs are an easier target to more advanced attacks on your anonymity like traffic correlation attacks than Tor is.
This is not even the biggest problem regarding anonymity and VPNs. Even if the VPN is trustworthy and not spying on you and there are no attackers spying either, most of the time the services and website you are using have much more effective ways of tracking you than your IP address and a VPN does exactly nothing against them. Cookies, browser fingerprinting, tracking and hardware IDs are much more accurate in identifying and tracking you than an IP address. VPNs simply do not grant you anonymity. They can be useful for hiding your internet activity from your ISP or people on your WiFi network if the VPN is more trustworthy than your regular network, however they simply do not make you anonymous to most services you are using.
Tor Browser however routes your traffic through three random servers of the decentralized Tor network. Each server (also called node or relay) only knows the station before and after it in the route your traffic takes (also called circuit).
The first node, the guard relay will know your real IP, your real identity, but it will not know your activity, it will only know the next node in your circuit, the middle relay. The middle relay will only know your guard relay and the last relay, the exit relay. It will neither know your identity nor your activity.
The exit node will know the destination of your traffic, but it will not know your identity. It only sees the middle relay before it. It can also not track your activity across multiple sites and build a profile of you, because Tor Browser builds a new circuit with different relays for each site. (Your guard node will stay the same though. That’s a security feature against a certain attack on Tor). The same applies for the site you’re visiting. It will only see traffic coming from the exit node, but won’t know its origin, your identity.
Tor is not privacy by policy like a VPN, it is anonymous by its design. No one besides you knows both your activity and your identity.
Additionally Tor Browser is designed to resist against tracking techniques like cookies or browser fingerprinting.
This got a lot longer than I had intended, but I think it is important to really understand how Tor works in order to use it properly and not to be fooled by false advice.
You can’t be anonymous when you have an account, but, you can use Tor to get some privacy.
Of course, any accounts that already have your information can’t magically become very private. However, you can still use Tor with these accounts, just know that they have your info.
And the VPN… Its complicated. But you probably don’t need one.
Also, Tor doesn’t make a connection with a foreign country. It makes a connection with a Tor node, a server running some software. This node might be in a foreign country, however it might also be in your country. But where the node is doesn’t matter much.
Most of what I have said here assumes things and is more of a FAQ type. I don’t want to debate the fact that a Tor node in PRC (or any other country) would matter.
I also have a noob question, why is everyone so worried about people tracking them, what could you possibly be doing that would need you to be completely anonymous? I understand not wanting to get all your banking data out there, but for the normal everyday law abiding citizen, what is the benefit of googling dog food or whatever boring thing I’m doing…anonymously…?? Not trying to be rude, I’m genuinely curious…
Logging into accounts on Tor isn’t usually recommended if it’s one that already has your true IP address or at least some info on the real you, and also Tor is way more stronger than a VPN when it comes to obliterating any possible way of tracking you, and just better with privacy in general, and the only reason people say that Tor+VPN is a good idea comes from one thing, fake news. There are countless people trying to recommend using a VPN and Tor together, and I’m just gonna say it’s not needed, first of all, it defeats the purpose of hiding you with Tor, and usually isn’t good for anonymity, but Tor’s official site says if you use specific configurations, you can actually increase privacy when using a VPN+Tor, but this doesn’t mean I recommend it, I’m just getting this off the official site.
If using accounts with identifiable information, do so apart from any times you do anything over tor you wish not to be connected to.
When in doubt, compartmentalize.
It depends on your goals really.
It is important to really understand how Tor works in order to use it properly and not to be fooled by false advice.
Someone give this man an award!
Wow, thank you for the detailed explanation, it is really helpful!
Reading your comment made me think of another question. Can you use Tor to access region locked content, like Netflix from Europe or wherever in the world? (I’m in the US)
fantastic explanation!!! thank you soo much for the knowledge!!!
How does tor resist cookies or fp?
Ah okay, that makes sense, thank you for explaining! I appreciate it!
some people still believe in their rights and the 4th Amendment. look up Edward Snowden. I have nothing to hide so I shouldn’t be worried is like saying I dont have anything to say so I shouldn’t care about the 1st Amendment.
but for the normal everyday law abiding citizen
You aren’t: everybody is breaking the law constantly, sometimes knowingly (have you ever jaywalked? Not come to a complete stop?) and often without any idea. It’s really important that we all come to understand that there aren’t criminals and normal people, but rather a whole gradient of law-breaking. This is important because the authorities can and do make investigation and prosecution decisions based on who they feel like targeting; in recent times this comes up largely in discussions about racism in policing, but it’s broadly applicable.
Ok, so now that that’s covered, let’s discuss privacy. Aren’t there things in your life that you don’t want other people to see? Your nude body? Why, if being naked isn’t illegal? The reality is that privacy does actually matter, intrinsically.
I personally use Tor for two reasons. The first is that data companies are terribly invasive and I don’t want to make it easy for them to follow me around. The second is that we need to do perfectly normal things with tor in order to make “using tor” not a signal that someone is needs extra attention from government agencies - otherwise it really restricts the usefulness of it for whistleblowers and other people avoiding censorship.
does the “normal law abiding” citizen open up the contents of his mailbox at the weekly town hall meeting?
it’s the same logic here, privacy and the desire for privacy == criminality.
Could you give me the link where that part is mentioned please
It’s possible to choose the country for your exit node by editing the torcc configuration file (location depends on your OS)
EDIT: Yes, as u/HackerNCoder mentions, limiting your exit nodes can decrease your anonymity, so use it wisely
Altough I haven’t tried it myself, I think that latency may be a bit high for streaming, so perhaps technically you can but it might be considered bad etiquette as it puts stress on the network (but correct me if my info is outdated and capacity is higher than I imagine it here)
i think you can, but this is a prime example of a use case for a vpn. i frequently use ProtonVpn to see british or australian tv
Defense against cookies is pretty simple: Tor Browser clears all cookies, logins, history and other browsing data on being closed. It is set to Firefox’s Always Private mode and those data is never written to disk.
Fingerprinting is a bit more complicated and it is described in more detail in this blog post by the Tor Project.
Tl;Dr: Tor Browser is modified from Firefox aiming to make all Tor Browser users look the same making individual users indistinguishable. The crowd of other Tor users gives you your anonymity. Tor Browser users have the same fingerprint as many others. This is part of the reason why you should not change settings without knowing what they do. You might inadvertently change properties that are detectable by the sites you visit and then stand out from the other Tor users making you easier to identify.
Appreciate the reply, and I never said I don’t ever break the law. I meant generally speaking I’m not a career internet criminal, and was assuming most of the other Tor users aren’t either.
Sure, I’d be happy to.