Tor - Anonymous Communication Network

About 2 min read

Tor (The Onion Router) is a communication network that ensures the anonymity of the sender by routing traffic through multiple nodes, adding a layer of encryption at each stage. Because the encryption is layered like the skin of an onion, it is called "onion routing." While journalists, human rights activists, and whistleblowers use it to evade censorship and surveillance, it is also known as the underlying technology of the dark web.

Development History

Research on onion routing began in the mid-1990s at the U.S. Naval Research Laboratory (NRL). Its original purpose was to allow U.S. intelligence agencies to communicate anonymously over the internet. However, because anonymity cannot be achieved if the only users are U.S. government personnel, it was released to the public as an open-source project in 2002. It is developed and operated by the nonprofit organization The Tor Project, and it consists of relay nodes contributed by volunteers around the world. Anyone can start or shut down a node at will, so the number in operation is not fixed. Part of the funding comes from grants from U.S. government agencies, but its operation is independent.

How Onion Routing Works

Before transmission, the user's data undergoes three layers of encryption. Each node decrypts only its own layer and forwards the data to the next node. Because no single node can grasp the full picture of the communication, it becomes extremely difficult to link the source to the destination.

Legitimate Uses

Tor is not a tool for criminal purposes; legitimate uses account for the majority. Journalists and activists under authoritarian regimes use it to disseminate information while evading censorship. SecureDrop (a whistleblowing platform) runs on Tor, and outlets such as The New York Times and The Washington Post have adopted it to protect the anonymity of their sources. Corporate security teams also use Tor when investigating whether their own information is being bought and sold on the dark web. For ordinary users as well, it is an effective means of avoiding tracking by ISPs and ad networks.

Relationship with the Dark Web

On the Tor network there are hidden services (Hidden Services / Onion Services) accessed via `.onion` domains. These cannot be found by ordinary search engines and make up part of the dark web. As explained in the article Password Leaks on the Dark Web, the buying and selling of leaked credentials takes place on the dark web. However, the vast majority of Tor users are simply accessing ordinary websites anonymously, and dark web use is only a tiny fraction of the whole.

The Difference from VPN

The article VPN Basics and How to Choose One explains in detail the means of protecting your privacy on a daily basis.

Limitations and Vulnerabilities

Tor is not omnipotent. Because encryption is removed at the exit node, non-HTTPS communication can be intercepted by the operator of the exit node. With timing attacks (traffic correlation analysis), attempts to break anonymity by matching the communication patterns of the entry and exit nodes have been researched. In addition, if an application other than the Tor Browser (such as an email client) communicates without going through Tor, the IP address leaks. There are also techniques for identifying Tor users through browser fingerprinting. Please also refer to the article Balancing Privacy and Convenience.

How to Read a Result That Found Nothing

What separates practice in this kind of checking work is less how a discovery is handled than how a result that found nothing is read. First, the range that can be checked is limited from the outset. In areas where search mechanisms do not operate, a location can only be reached if it is already known, and whether it can be viewed depends both on whether the other side is publishing it and on whether it is running at that moment. While it is not running, the same content can exist without being visible, so a result stating that a check found nothing does not show that nothing exists; it shows that nothing was visible in that range at that time. This distinction rarely survives in the records, because rounds that found nothing are written up briefly and the information about how far the check reached, and where it did not, is not retained. Second, the definition of what is being looked for determines the result. It is necessary to decide in advance what counts as related to you, and a method that relies on strings written in a particular form will pick up only what is written in that form. Rewritten forms and partial mentions are not picked up by the same handle. Anything outside the definition should be treated not as absent but as not searched for, even though the two look identical in the record of results. Third, the time something is posted and the time it was obtained are separate. Observing a posting does not indicate when the material was acquired, and the interval between the two is not constant. What is posted may be part of an older collection, or a mixture drawn from several origins. An observation therefore cannot be used to determine which range was affected from when; all it establishes is the fact that the material is posted.