Welcome to Part Eight of this module.
In the last video we looked at how to verify the authenticity of our downloads.
Specifically we verified that the Tor installer is the real deal.
Now it's time to talk about installing Tor and getting started with it.
But first what exactly is Tor and why is it important Tor is free and open source software for enabling
anonymous communication.
The name Tor is actually an acronym for what the original software used to be called which was The Onion
Router Tor Browser directs your internet traffic through a free worldwide volunteer overlay network
consisting of thousands of relays all for the purpose of concealing a user's location and usage from
anyone conducting network surveillance or traffic analysis using Tor makes it more difficult to trace
Internet activity to the user such as Web sites that you visit online posts et tours intended use is
to protect the personal privacy of its users as well as their freedom and ability to conduct confidential
communication by keeping their Internet activities from being monitored toward is not prevent an online
service from determining when it is being accessed through Tor.
The idea is to protect the user's privacy but not hide the fact that someone is actually using Tor.
This means that certain services can actively restrict or even block Tor users or in other ways curtail
their access to certain sites.
On the other hand it is through the use of Tor that we are able to reach locations on the internet not
normally accessible by ordinary browsers collectively and variously referred to as the deep web dark
net or onion land.
Before we go deeper into what Tor is it is first necessary to save what Tor is not Tor is not a virtual
private network or VPN for short.
If you're browsing the internet with the Tor browser web sites that you visit will see an IP address
associated with the TOR exit node not your own.
However if you load up another application outside of Tor such as perhaps a messaging program the program's
Internet traffic won't be automatically routed through Tor.
By comparison a VPN or a virtual private network routes all traffic through it.
There are pros and cons to both Tor and VPN and this will be explained in greater detail as we go along.
Onion Routing using Tor is implemented by encryption in the application layer of a communication protocol
stack nested like the layers of an onion Tor encrypts the data including the next node.
Destination IP address in the relay multiple times and sends it through a virtual circuit comprising
successive randomly selected tor relays each relay decrypt a layer of the encryption and sends the original
data to its destination without revealing or even knowing the source IP address because the routing
of communication was partly concealed at every hop in the Tor circuit.
This method eliminates any single point at which the communicating peers can be determined through network
surveillance that relies upon knowing its source destination an adversary may try to DNS minimize the
user by some means.
However one way this may be accomplished is by exploiting vulnerable software on the user's computer.
The National Security Agency of the United States actually has a technique that triggers a vulnerability
which they code named egotistical giraffe in an outdated Firefox browser version.
That was at one time bundled with the Tor package and in general targets Tor users for close monitoring
under its x Key Score program attacks against tor are an active area for academic research as well which
is in fact welcomed by the Tor project itself as it continually seeks to improve.
For these reasons it is absolutely imperative to make sure the Tor version that you are using is kept
up to date correctly configured and that you are using an authentic non tampered with copy.
There is one other thing to be aware of.
The bulk of the funding for tour's development has come from the federal government of the United States
initially through the Office of Naval Research and DARPA.
So chew on that as you consider whether or not to put full and absolute trust in it when you use tour
to browse the internet your Internet service provider cannot see or log the specific data being sent
to and from your computer.
In other words your ISP knows that you are using Tor because they can see that you are connected to
a tor entry node but they only see encrypted data going to and from the node they cannot track what
you do through traffic analysis.
Again this applies only to the Tor Browser and programs that are specifically configured to make use
of the Tor network.
Again Tor is not a VPN and will not protect every application that connects through the Internet on
your machine by default.
Tales may be an exception but we'll speak about that later.
All right.
That was a lot to take in so why don't we just install the darn thing.
OK.
But the last thing I'm going to talk about is why we want to bother with this at all.
Tor allows access to hidden web sites that normal Internet browsers cannot reach.
As I said these are known collectively as the deep web or dark net or onion land dark net is sometimes
a fitting term but I wish to avoid being overly dramatic an onion land sounds a bit silly.
So from this point onward I'm going to try to stick to the name deep web the deep web contains Web sites
that are not indexed by search engines.
It is to put it bluntly massive when you perform a Google search which I hope is rarely you are accessing
about 5 percent of the Internet.
The tip of the iceberg as it were everything beneath the waterline is the deep web non indexed sites
services and things that your average web search engines such as Google just can't or won't pick up.
And yes hidden sites and services as well.
An onion site uses a special type of you are old address and can be reached only by using Tor.
These include many valid and legal places as well as many illegal or unethical places.
More on this later this overview was long and wordy and I apologize for starting out this way but it
was necessary for you to have some idea what this is.
With that out of the way let's go ahead and install it to start off with.
We're going to select our language and our default directory and click install tours ask asking to run
for the first time.
Let's go ahead and do that.
The tour is now loaded for the first time and when we load tour we get the screen asking us if we want
to click connect or if we want to configure what's click configure.
And here we can specify that we want to use a proxy to connect to the Internet if applicable.
We can also click the Tor is censored in my country button and this may help with connecting to the
network in certain parts of the world.
So with that out of the way let's go ahead and click connect.
Connection to Tor may take a minute or two.
Also keep in mind that if you have any strict firewall settings you may need to whitelist the Tor browser
so that it can connect to the Internet.
OK.
So right away the first thing you might be tempted to do is to maximize the browser screen but as soon
as we do this.
Notice that we get this message up here in rather tiny text warning us that maximizing tor browser can
allow Web sites to determine your monitor size which can be used to track you.
We recommend that you leave tor browser window in its original default size.
So it is your option.
But that is something to remember.
You can however extend the window by a little bit as long as you don't maximize it.
All right.
So earlier I mentioned that the IP address that your destination sees will be that of the TOR exit node
rather than your own IP.
So let's see this demonstrated.
Let's go ahead and search for what is my IP.
We'll go ahead and just click on one of these links at random.
And here we see that this IP address which is located in Corona whoa I probably mispronounced that Poland
hobbyist Asli I am not in Poland.
However this is what any Web site will see when we're using Tor your exit node will be determined at
random.
You may also receive a warning and this site doesn't do it but sooner or later you'll see it warning
you that a particular Web site is trying to gain H HTML5 canvassing imaging data.
In other words it's trying to take your fingerprint and you really don't want to allow this.
So if it comes up click block and this would be a good example of Tor protecting us.
Now the IP address and location shown here again obviously not my real IP on location.
The exit node as I said is determined at random and it is the last hop in a very long network of Tor
relays that your connection is essentially bouncing back and forth between all of which are built when
you connect to Tor and chosen at random.
Now there is something very important that you need to keep in mind here.
Anyone can run a Tor relay and be an exit node.
You can run one.
I can run one.
Your friendly neighborhood CIA agent can run one anybody.
It isn't possible for the person or people running the node to see where the connection is originating
from.
But they can see any clear text data that goes out from an unencrypted exit onto the Internet.
In other words if you fill out any web forms and clear text using tor the exit node can potentially
see any data that you enter.
So you might not want to apply for a credit card or use Tor to access your personal e-mail.
I'm not saying that every exit node is untrustworthy but some absolutely are.
For all I know this one that we're looking at right now is run by hackers or federal agents looking
to sniff up any identifying information.
So in the event that we have some reason to distrust our exit node what can we do about this.
If we go to this little icon up here and click the new identity button tor will click yes and tour is
going to restart itself.
And this time we go to what is my IP notice that we now appear to be in Quebec Canada with an entirely
new IP address.
So it's very easy to rebuild the network with a single mouse click and it will be more apparent which
nodes are in your network.
When we get details.
Another thing to point out is that Tor can be very slow to load Web sites.
We haven't really seen an example of that yet but we will and that leg is a natural consequence of bouncing
your connection through a ton of encrypted relays.
It is normal and it is the price you pay for the security that Tor offers.
Speaking of security let's take a quick look at the security settings because this little map should
not be loading at all.
So we're gonna go up to here to the little onion icon and click security settings.
Notice that we are on standard by default.
I strongly recommend that you drag this up to the safest setting only lower this bar if you absolutely
have to access a Web site via tor that won't come up any other way but really you should never ever
drop this bar with our settings now on safest will click OK and let's go ahead and we're gonna jump
over towards a Web site called panic to click.
This is a handy Web site that test your browser to see how well it keeps you secure.
Try it with your ordinary day to day clear net browser some time and you might be alarmed at just how
much identifying data it actually leaks.
We're gonna go ahead and we're going to click test me.
This is going to take a few minutes particularly if the Tor relay connections are slow in a moment we'll
see the results from a battery of tests it runs against us.
Or more specifically the Tor Browser.
All right and if we scroll down here we can see that yes we have very strong protection against Web
tracking Tor does not check for Do Not Track policies by default.
That is something you can change in the settings.
And again I do recommend that you run this test against your own non tor browser and see how well you
do.
It might surprise you.
Now one thing to keep in mind is that with the security set on full your browsing experience is really
going to be badly diminished.
Javascript won't work properly or even at all and you weren't going to be streaming videos and things
like that.
That really isn't what tourists for a lot of fun tools that enhance our browser experience that we just
sort of take for granted like flash player for instance just don't work with Tor because they compromised
security coupled with the lag of loading pages due to the network relays and you might start to ask
yourself why you're bothering to use Tor at all.
Another thing that I recommend you do is to go to this little letter s up here in the upper right corner.
It's called no script.
Make sure that it has a little red line through it and that global scripts are disabled.
It won't have the little red line on the tour start page when you when you first load the browser because
tor considers that to be privileged for some reason but anywhere else you go.
Scripts should be blocked at all times.
Newer versions of Tor block these by default so you need to specifically disable it.
If you wanted to allow scripts which is never really recommended older versions which you shouldn't
be using anyway allowed scripts by default and many users were compromised by this.
Always check to make sure this is working correctly.
Don't just assume that it's configured in the way that you'd expect from a security project because
it isn't always another thing to be aware of is that the default search engine with Tor is duck duck
go which is a great search engine that does not track you but may be a tad slower than what you're used
to.
And while I hate to admit it and would never encourage anyone to use google it is a fact that sadly
there are times that you just won't get the same quality of results with duck duck go as you would with
Google.
So that is something to keep in mind.
I would not recommend using Google with Tor.
Don't get me wrong but it is something that you can do if you want to.
You can change the default browser by going into the browser settings when you use Tor to browse the
internet.
Your Internet service provider as well as anyone else who is capable of seeing your connection will
know that you are using Tor.
This may cause certain groups like hackers or government agencies to focus attention on you and try
to determine what it is that you're doing.
I will be covering virtual private networks in the video right after the next one which will be on tails
and I'll be covering how to use a VPN in conjunction with Tor to hide this information as an extra layer
of security.
Now there are pros and cons to doing that and they are very complicated to go over so I will be covering
that subject later but I just wanted you to know that it will be coming up if you are wondering we will
be discussing it now.
As was said tor can be used for regular anonymous browsing but it can also be used to access hidden
sites on the Internet or the deep web as it were.
This will be shown in more detail in the next video covering the tales operating system and that is
because it isn't especially why is to access the deep web from a Windows computer.
There are many little subtle ways that Windows can either betray you or retain evidence of what you're
what you've been doing.
When you're using it this is particularly true of Windows 10 visiting an onion link isn't in and of
itself an illegal or unethical thing to do.
There are many valid hidden sites and services out there and people like journalists often make use
of them when traveling to parts of the world where their lives may be in danger.
That being said there are many sites and hidden services that are of an illegal or unethical nature
because of the rules of the platform that this class is being presented on.
I cannot show these.
These would include unsavory places like online marketplaces that sell substances or services that are
considered to be contraband in nature.
There are also sites that contain leaked secret information.
The character of which may be against the terms and conditions of the platform that you're currently
watching this video on.
All I can say about these aspects of the deep web are use them.
At your own risk simply visiting such a Web site may or may not be illegal.
Depending on where in the world you live and the nature of the site itself it's not against the law
simply because it's an onion link.
But if it contains illegal content you could end up in hot water legally speaking.
If this is a subject of interest to you you only need to conduct a search preferably using Tor inductor.
Go for directories containing deep web links.
But again you must take into account the laws of the country where you live.
Concerning these things and remain lawful at all times.
Things like online drug markets do exist and they operate outside of the law often using cryptocurrency
to facilitate anonymous transaction.
The subject of crypto currencies will be covered as well in later in this module.
Just be careful when visiting onion links.
Any such link that you click on is done at your own risk and you should never click on such a link unless
you are sure of what it is.
So with that out of the way what is an onion link.
Well here are a few examples so I'm going to just grab these two that I have set up copy and paste them
into new tabs.
Okay so notice how weird these addresses are.
They are strings of letters and numbers ending in a dot onion proton mail.
Here is a free email service that claims to be secure and not evil is a search engine that seeks to
index Deep Web sites that normal search engines do not.
Not Evil is one method to search for hidden sites and services.
But again I warn you to be very careful.
You're responsible for anything you click on.
As a final closing point tor can be used in windows but the reason I say it is better to use tables
is because the tables operating system has many built in security features that Windows simply lacks.
Tails is a system that you live boot and it changes all of your computer's unique identifiers so that
even if information about you were to leak there's a good chance it won't be information that connects
back to you.
Everything you do using tables gets wiped out of existence when you shut it off at least in terms of
anything being stored on your computer.
That could be used to reconstruct your activities.
It is possible to use Tor in Cali Linux but this is strongly discouraged.
Cowley runs you in route and it is simply not intended to be an anonymous operating system.
It's just not what Carly's for.
There's no good reason to use taurine Cowley when you can just load up tales or even use it in Windows.
However if you really must do so you can.
All right.
So this covers the basic introduction to the Tor Browser.
As I said the next video we'll be covering tails and going into greater detail with more examples of
these things.
Thank you for your attention.