Tor (network)

• 1. Introduction

  ›

  Tor is a network built to hide who is talking to whom, and in 2012 the United States National Security Agency wrote a classified slide deck about it titled "Tor Stinks." One line from those slides reads: "We will never be able to de-anonymize all Tor users all the time." The same deck concedes that manual analysis could unmask a very small fraction of them. That is a striking admission about a tool whose roots lie inside the American government. Today Tor runs on more than seven thousand relays operated by volunteers around the world. Millions of people send their internet traffic through those relays along random paths. Who built it, and why would a military laboratory want strangers to use it? How can a network hide both ends of a conversation at once? And if even the NSA could not break it, how do the people who rely on it still get caught?

  361930

• 2. Naval Research Origins

  ›

  In the mid-1990s, three people at the United States Naval Research Laboratory worked out the idea that became Tor. They were mathematician Paul Syverson and computer scientists Michael G. Reed and David Goldschlag. Their aim was to protect American intelligence communications online. The technique they devised is called onion routing. Messages are wrapped in encryption at the application layer, with each wrapper nested inside the next, like the layers of an onion.

  The working software came from a second team. Syverson joined computer scientists Roger Dingledine and Nick Mathewson to build an alpha version, then called The Onion Routing project. The shorter name Tor was derived from that title afterward. The alpha launched on the 20th of September 2002, and the first public release followed a year later.

  In 2004, the laboratory released the code under a free license. The Electronic Frontier Foundation, known as the EFF, began paying Dingledine and Mathewson to keep developing it. Two years on, in 2006, those two and five others founded The Tor Project. It is a Massachusetts-based 501(c)(3) research-education nonprofit that maintains the software. The EFF served as its fiscal sponsor in the early years. Early backers included the U.S. Bureau of Democracy, Human Rights, and Labor, the International Broadcasting Bureau, Internews, Human Rights Watch, the University of Cambridge, Google and the Netherlands-based Stichting NLnet.

  The project has always invited scrutiny. Attacks on Tor are an active area of academic research, and The Tor Project itself welcomes them.

  378912

• 3. Three Hops of Secrecy

  ›

  On a user's own computer, a small Tor program listens at localhost on TCP port 9050, or on port 9150 when the Tor Browser bundle is used. Applications that understand the SOCKS protocol can be pointed at that port. From there, Tor periodically builds virtual circuits through the network and sends the traffic along them from relay to relay. The last relay in the chain is called the exit node. It forwards the original packet to its destination, so the destination sees the exit node as the sender.

  The design rests on separating who you are from where your traffic goes. The IP addresses of the sender and the recipient are never both readable at any single hop. Anyone eavesdropping at one point along the path cannot directly identify both ends. Encryption between relays provides perfect forward secrecy.

  Tor works at the level of Transmission Control Protocol streams, which makes it independent of any one application. Internet Relay Chat, instant messaging and web browsing are the usual uses. Some entry relays, called bridges, are kept secret, so users can slip past censors who block the public list of relays.

  Servers can hide too. A server configured to accept connections through Tor is called an onion service, a feature first specified in 2003 and running on the network since 2004. It was once known as a hidden service. Instead of an IP address, visitors use an onion address. The network looks up the matching public key and introduction points in a distributed hash table, and it can reach servers sitting behind firewalls or network address translators. Because the connection never leaves the network, it is always encrypted from end to end.

  Onion services are unlisted by design. Pastebin, Twitter, Reddit, assorted forums and specialized search engines all circulate lists of known addresses. Despite the website association, any TCP service can sit behind one, including secure shell remote login, chat over IRC and XMPP, and file sharing. A service called Tor2web lets an ordinary browser reach onion sites, but it strips away the visitor's anonymity.

  In 2023, with the release of Tor 0.4.8, the project added a proof-of-work defense meant to protect onion services from denial-of-service attacks.

  3433163239

• 4. Browsers, Bundles and Rust

  ›

  In January 2008, Steven J. Murdoch announced the Tor Browser Bundle. It combined a modified Mozilla Firefox ESR browser with TorButton, TorLauncher, NoScript and the Tor proxy. It can run from removable media and works on Microsoft Windows, macOS, Android and Linux. When a session ends, the browser deletes sensitive data such as cookies and browsing history. The default search engine is DuckDuckGo, which replaced Startpage.com.

  The browser offers three security levels. Standard leaves every website function switched on. Safer disables features known to be common attack routes, and makes audio and video click-to-play. Safest allows only what static websites and basic services need, with JavaScript off everywhere. Because the main Tor website can be risky or blocked in some places, a GitHub repository lists download links hosted on other domains.

  On the 29th of October 2015, the project released Tor Messenger Beta, a chat program based on Instantbird. It had Tor and OTR built in and used by default. Its developers wrote the chat protocols in JavaScript, a memory-safe language, rather than rely on libpurple. In April 2018 the project shut it down, citing three reasons. Instantbird's developers had dropped support for their own software, resources were limited, and known metadata problems remained.

  In 2016, developer Mike Perry announced a prototype Tor-enabled smartphone built on CopperheadOS. It was called Mission Improbable. Copperhead's lead developer Daniel Micay welcomed it.

  Other programs build on Tor as well. Briar routes all its messaging through Tor by default, and OnionShare sends files over it. The Guardian Project develops Orbot, which is also available for iOS, along with Orfox, the mobile counterpart of the Tor Browser. Onion Browser serves iOS users. Brave added Tor to the private-browsing mode of its desktop browser in 2018, in version 0.23.

  The core of Tor is written mainly in C. Starting in 2020, the project began rewriting it in Rust under the name Arti, publicly announced in July 2021.

  In September 2024, the security-focused operating system Tails became part of the Tor Project, joining a family that includes Qubes OS and Whonix.

  8786899181

• 5. Who Needs Anonymity

  ›

  In November 2013, Tor had about four million users. According to the Wall Street Journal, about 14% of its traffic in 2012 came from the United States. People in countries that censor the internet formed the second-largest group. The Tor Project says its users include ordinary people who want privacy from websites and advertisers, as well as activists, journalists and military professionals. Survivors of domestic violence and the social workers who help them also use it to guard against digital stalking. News organizations including The Guardian, The New Yorker, ProPublica and The Intercept pair Tor with SecureDrop to protect whistleblowers.

  The darker uses are just as real. The Economist, writing about Bitcoin and Silk Road, called Tor "a dark corner of the web." Criminal enterprises, hacktivist groups and law enforcement agencies have all used it, at times at cross purposes. Illicit markets draw on its infrastructure, often alongside Bitcoin. Even so, the FBI's complaint against Silk Road operator Ross William Ulbricht acknowledged that Tor has "known legitimate uses."

  The EFF's Eva Galperin told Businessweek in 2014 that "Tor's biggest problem is press." Her point was that nobody hears about the person who was never stalked by an abuser, only about the offender who got away. The Tor Project's own FAQ makes a similar argument. Criminals already have better privacy options than Tor provides, so taking it away would not stop them. Ordinary people who follow the law are the ones who need it.

  In March 2015, a briefing from the United Kingdom's Parliamentary Office of Science and Technology agreed that banning online anonymity systems was not an acceptable policy option. The briefing said Tor plays only a minor role in the online viewing and distribution of indecent images of children, partly because of its inherent latency. It also pointed to the Internet Watch Foundation's use of Tor and to its value for whistleblowers.

  In August 2014, Tor's executive director Andrew Lewman said that agents of the NSA and Britain's GCHQ had anonymously sent the project bug reports.

  2526272829

• 6. Where the Layers Thin

  ›

  Nine directory authority nodes hold the keys to Tor's shared picture of the network, and their addresses are hard coded into every client. Every hour they vote on which relays are good, which serve as guards or exits, and how much traffic each can handle. Clients download the latest result at startup. Compromising a majority of the authorities could skew that result in an attacker's favor. A congestion attack could also stop them from voting, though it would be visible.

  The deepest limit is timing. Tor is designed to resist an attacker who sees only one point on a connection, such as one relay, the destination server or the user's internet provider. It does not protect against someone watching traffic as it enters and as it leaves the network. Statistical analysis can then link the two. No documented case of this at scale exists. After the 2013 Snowden leaks, the NSA was still unable to conduct dragnet surveillance on Tor itself and instead attacked other software used alongside it, such as web browsers.

  Co-founder Nick Mathewson put the problem this way: "No adversary is truly global, but no adversary needs to be truly global." He explained that an attacker running just two poisoned nodes, one entry and one exit, can identify the unlucky users whose circuit crosses both. He gave the 2016 figures of around 7,000 relays, 2,000 guards and 1,000 exits. That makes the odds about one in two million, give or take.

  Traffic can also leak at the edge. Tor cannot encrypt the stretch between an exit relay and the destination server, so a malicious exit can capture and alter whatever is not otherwise protected. Such exits have recorded usernames and passwords and rewritten Bitcoin addresses to redirect payments. Tor Browser now allows only HTTPS or onion service connections by default.

  Details about a device, such as screen resolution, installed fonts and language settings, can narrow down who a user is. This is called a fingerprint. In 2011, researchers with Inria attacked BitTorrent users by exploiting clients that connected both through Tor and outside it.

  Websites can fight back, too. Tor does not hide that a visitor comes from an exit relay, and the BBC blocks the IP addresses of all known exit nodes from its iPlayer service. Because so many users share so few exits, sites may blame one person for another's behavior, or flag a single session that appears to hop between countries. The result is blocking or captchas.

  A researcher named Sarah Jamie Lewis wrote OnionScan, a program that checks onion services for exactly these kinds of misconfiguration.

  3451606280

• 7. Hunting the Hidden

  ›

  The relays that joined the network on the 30th of January were removed on the 4th of July, according to a security advisory the Tor Project issued in July 2014. They had used a Sybil attack to claim 6.4% of guard relay capacity. Some also acted as onion service directory nodes, which altered request traffic in a way that let an adversary's guard relay recognize the same request. That revealed both the onion service involved and the IP address of whoever asked for it. The application was patched to block the modification.

  On the 7th of November 2014, the FBI, ICE Homeland Security Investigations and European agencies carried out Operation Onymous. It produced 17 arrests and the seizure of 27 sites containing 400 pages. A Europol representative would say only: "This is something we want to keep for ourselves." A BBC source mentioned a technical breakthrough, while a Tor Project representative suspected ordinary police work. In November 2015, court documents revealed that the FBI had obtained IP addresses of onion services and their visitors from a "university-based research institute." Experts, including Edward Felten of Princeton University, concluded it was the CERT Coordination Center at Carnegie Mellon University. Concerns included research on users who never consented and a lack of disclosure.

  Earlier, in 2011, a Dutch authority had found the IP address of a Tor onion service from an unprotected administrator account. The FBI traced it to Aaron McGrath. After a year of surveillance, it launched Operation Torpedo, arrested him and installed its Network Investigative Technique malware on the servers of the three onion sites he controlled. The exploit targeted a Firefox flaw that was already patched, so only users who had not updated were caught. A Flash application sent their IP addresses straight to an FBI server, exposing at least 25 US users. McGrath received 20 years in early 2014.

  In August 2013, older Tor Browser Bundle versions turned out to be open to a JavaScript shellcode attack, because NoScript was not enabled by default. The attack pulled out MAC addresses, IP addresses and Windows computer names. News reports tied it to the arrest of Freedom Hosting's owner, Eric Eoin Marques, on a provisional extradition warrant on the 29th of July. The FBI acknowledged the attack in a court filing in Dublin on the 12th of September 2013. A training presentation leaked by Edward Snowden gave the exploit the code name EgotisticalGiraffe.

  In 2022, Kaspersky researchers found malware disguised as Tor Browser behind a top-ranked Chinese-language YouTube video. It was built to identify users rather than to steal data for profit.

  Most arrests trace to human error. The AlphaBay marketplace, which relied on Tor and Bitcoin, fell in July 2017 after elementary mistakes outside the network. A 2012 NSA assessment revealed by Der Spiegel called Tor alone a "major threat" and Tor combined with other privacy tools "catastrophic."

  5258596775

• 8. Funders, Libraries and Censors

  ›

  As of 2012-80% of The Tor Project's $2M annual budget came from the United States government. The State Department, the Broadcasting Board of Governors and the National Science Foundation were major contributors. DARPA, the Naval Research Laboratory and the Government of Sweden also gave, as did Human Rights Watch, Reddit and Google. Critics said the project "more resembling a spook project" than a tool built by a culture that values accountability. Dingledine replied that Defense Department money was closer to a research grant than a procurement contract. Lewman insisted the service never collaborated with the NSA to reveal users. The agency itself called Tor "the king of high-secure, low-latency Internet anonymity."

  In March 2011, the Free Software Foundation gave The Tor Project its award for projects of social benefit. The citation said Tor had enabled roughly 36 million people to experience freedom of access and expression online, and called it pivotal in dissident movements in Iran and Egypt. In June 2013, Edward Snowden used Tor to send information about PRISM to The Washington Post and The Guardian.

  In July 2015, The Tor Project teamed with the Library Freedom Project to put relays in public libraries. The Kilton Library in Lebanon, New Hampshire, became the first U.S. library to host a node. The pilot was paused when the city manager and a deputy sheriff worried about the cost of defending search warrants. The service returned on the 15th of September 2015. On the 10th of December 2015, Representative Zoe Lofgren wrote to the Department of Homeland Security, saying she was disturbed by any pressure on services that protect privacy. Kilton's IT manager Chuck McAndrew argued that librarians have always cared about protecting privacy. In March 2016, a New Hampshire bill allowing libraries to run privacy software passed the House 268-62. The Las Naves Public Library in Valencia, Spain, was the second library to host a node.

  Censors have pushed back. Iran tried to block Tor at least twice in 2011, and one attempt failed in under a day. Turkey blocked Tor in December 2016, and Venezuela blocked it in June 2018, including bridge connections. On the 8th of December 2021, Russia's agency Roskomnadzor announced a ban. Russian courts lifted the blockade on Tor's website on the 24th of May 2022, then reinstated it on the 21st of July 2022. After the invasion of Ukraine, the BBC and VOA pointed Russian audiences to Tor, and Russian use of its Snowflake tool rose. China has effectively blocked it.

  In January 2026, Iran International reported that Tor was seeing use after the 2026 Iran protests, though with limited success.

  79106698