1 00:00:00,000 --> 00:00:07,000 And this lecture, I'm going to show you how to properly verify and install the Tor browser on Linux 2 00:00:07,000 --> 00:00:08,000 computers. 3 00:00:08,000 --> 00:00:14,000 Skip this lecture if you already have the Tor browser installed or if you want to install it for Windows 4 00:00:14,000 --> 00:00:16,000 or Mac OS. 5 00:00:16,000 --> 00:00:20,000 I cover install it for Windows and Mac os in the previous lectures. 6 00:00:20,000 --> 00:00:25,000 So if you want to learn how to do that for these operating systems, please revise the previous two 7 00:00:25,000 --> 00:00:26,000 lectures. 8 00:00:26,000 --> 00:00:33,000 Now I'm going to be installing it on a Linux distribution in this lecture, but the installation process 9 00:00:33,000 --> 00:00:39,000 is the same on pretty much most Linux operating systems like Debian fedora and so on. 10 00:00:40,000 --> 00:00:45,000 So first of all, you want to go to the official download page of the Tor browser. 11 00:00:45,000 --> 00:00:48,000 I will include it in the resources of this lecture. 12 00:00:48,000 --> 00:00:52,000 You want to scroll down and select the language that you want. 13 00:00:52,000 --> 00:00:57,000 So I want to download the English version and I want to download it for new Linux. 14 00:00:58,000 --> 00:00:59,000 As you can see, you have two options. 15 00:00:59,000 --> 00:01:02,000 You can download a 32 bit and a 64 bit version. 16 00:01:02,000 --> 00:01:07,000 I have a 64 bit computer and therefore I'm going to click on the 64 bit. 17 00:01:07,000 --> 00:01:13,000 Once you do that, it will download it into your downloads directory and as you can see, I already 18 00:01:13,000 --> 00:01:14,000 have it downloaded in here. 19 00:01:15,000 --> 00:01:20,000 Now usually once you have the browser or the application that you want to download downloaded, all 20 00:01:20,000 --> 00:01:24,000 you have to do is simply run it and if it's compressed and compress it and run it. 21 00:01:24,000 --> 00:01:33,000 But because we are trying to protect our privacy and anonymity, it would be a good idea to verify that 22 00:01:33,000 --> 00:01:40,000 this file did not get modified as we downloaded it from the Internet, because if it got modified, 23 00:01:40,000 --> 00:01:46,000 it could contain backdoors or it could contain code that would render the privacy and anonymity features 24 00:01:46,000 --> 00:01:48,000 of this browser useless. 25 00:01:48,000 --> 00:01:54,000 Because when you download something from the internet, it passes through a number of nodes in which 26 00:01:54,000 --> 00:01:56,000 it can be modified. 27 00:01:56,000 --> 00:02:03,000 So it can be modified by your Internet service provider, it can be modified by your network administrator, 28 00:02:03,000 --> 00:02:09,000 and it can even be modified by hackers who managed to intercept the connection. 29 00:02:09,000 --> 00:02:15,000 So in order to verify the integrity of this file, we're going to use a signature file. 30 00:02:15,000 --> 00:02:22,000 Now, as you can see here in the download page, for every single download you have a sig. 31 00:02:22,000 --> 00:02:28,000 This sig is short for signature, and if you click on it, it will download the file similar to this 32 00:02:28,000 --> 00:02:29,000 one right here. 33 00:02:29,000 --> 00:02:34,000 Now you want to make sure that you download the signature for the file that you downloaded. 34 00:02:34,000 --> 00:02:41,000 So I downloaded the 64 bit version of the Linux installer and therefore you want to download this signature 35 00:02:41,000 --> 00:02:41,000 file. 36 00:02:42,000 --> 00:02:46,000 The reason for this is because each signature is unique to the file. 37 00:02:46,000 --> 00:02:53,000 That's why each file has its own signature, and the signature is created by the Tor developers when 38 00:02:53,000 --> 00:02:56,000 they created this file on their own system. 39 00:02:56,000 --> 00:03:03,000 Therefore, if this file gets modified in any way, shape or form, then the verification process using 40 00:03:03,000 --> 00:03:07,000 this signature will fail and therefore we will know that this file got modified. 41 00:03:08,000 --> 00:03:14,000 If we can verify this file using the same signature that the creators created, then that means that 42 00:03:14,000 --> 00:03:19,000 this file did not get modified since they created the file and created the signature. 43 00:03:19,000 --> 00:03:24,000 Now we're going to have a full section in this course about encryption and verification. 44 00:03:24,000 --> 00:03:28,000 So we're going to learn exactly how this works in details. 45 00:03:28,000 --> 00:03:34,000 But for now, we just want to make sure that this installer did not get modified as we downloaded it. 46 00:03:34,000 --> 00:03:39,000 Therefore, we're simply going to follow the instructions in the official to our website. 47 00:03:39,000 --> 00:03:43,000 To do this, you're going to need to run a number of commands on the terminal. 48 00:03:43,000 --> 00:03:47,000 But don't worry, the commands are actually simple, even though it might seem like it's a little bit 49 00:03:47,000 --> 00:03:48,000 difficult. 50 00:03:48,000 --> 00:03:51,000 And I'm going to walk you through it step by step. 51 00:03:51,000 --> 00:03:57,000 So the first command that we need to run is a command to fetch or download the developer's key. 52 00:03:58,000 --> 00:04:00,000 This is the command right here. 53 00:04:00,000 --> 00:04:01,000 I'm going to copy it. 54 00:04:02,000 --> 00:04:07,000 I'm going to go to a new desktop and I'm going to run the terminal. 55 00:04:07,000 --> 00:04:10,000 So I'm going to click on all applications and type terminal to run it. 56 00:04:11,000 --> 00:04:13,000 And we have it right here. 57 00:04:13,000 --> 00:04:18,000 So I'm going to click it and I'm simply going to paste the command that I copied. 58 00:04:19,000 --> 00:04:21,000 Now, the command is actually very, very simple. 59 00:04:21,000 --> 00:04:24,000 It's using a program called GPG. 60 00:04:24,000 --> 00:04:28,000 This is a program that you can use to create and verify and encrypt data. 61 00:04:29,000 --> 00:04:36,000 We're saying that we want to download to locate a key, and the key that we want to download or locate 62 00:04:36,000 --> 00:04:42,000 belongs to a user that has the email of Tor browser at Tor project dot org. 63 00:04:43,000 --> 00:04:44,000 We're going to hit Enter. 64 00:04:46,000 --> 00:04:47,000 And perfect. 65 00:04:47,000 --> 00:04:48,000 As you can see, it's still us. 66 00:04:48,000 --> 00:04:55,000 The public key for Tor browser developers has been located and you can see the email in here and it's 67 00:04:55,000 --> 00:04:57,000 telling us that this key is imported. 68 00:04:57,000 --> 00:05:01,000 And also you can see the key fingerprint right here. 69 00:05:01,000 --> 00:05:03,000 We'll get back to that in a second. 70 00:05:03,000 --> 00:05:07,000 So now the key is imported into GPG, the program. 71 00:05:07,000 --> 00:05:12,000 What we want to do next is actually store it in a file and we're going to go back to the instructions 72 00:05:12,000 --> 00:05:13,000 to see how to do that. 73 00:05:13,000 --> 00:05:15,000 And we have the command right here. 74 00:05:15,000 --> 00:05:21,000 So again, we're going to copy it and we're going to paste it in here. 75 00:05:21,000 --> 00:05:24,000 Again, we're using the same program GPG To do that. 76 00:05:24,000 --> 00:05:27,000 We're saying that we want to output a file. 77 00:05:27,000 --> 00:05:32,000 Like I said, we want to store it and we want to store it in a file called Tor Dot KeyRing so you can 78 00:05:32,000 --> 00:05:34,000 name this file whatever you want. 79 00:05:34,000 --> 00:05:40,000 And we're saying that we want to export a key that has the following fingerprint. 80 00:05:40,000 --> 00:05:46,000 So note this fingerprint right here is the same as the fingerprint of the key that we just imported, 81 00:05:46,000 --> 00:05:48,000 the third developer's key. 82 00:05:48,000 --> 00:05:50,000 So what we're saying this key is already imported. 83 00:05:50,000 --> 00:05:55,000 We're saying that we want to export it, we're selecting it using the fingerprint, and we're saying 84 00:05:55,000 --> 00:06:00,000 we want to output it or store it in a file called Tor Dot KeyRing. 85 00:06:01,000 --> 00:06:06,000 We're going to hit enter and the command will get executed without showing any errors, meaning it got 86 00:06:06,000 --> 00:06:08,000 executed successfully. 87 00:06:08,000 --> 00:06:13,000 But just to double check, we can use the RLS command, the list command to double check that we have 88 00:06:13,000 --> 00:06:16,000 a file that is called Tor Dot KeyRing. 89 00:06:16,000 --> 00:06:22,000 If I hit enter you can see that we have the file in here, meaning that we manage to store the imported 90 00:06:22,000 --> 00:06:25,000 key in here into this file. 91 00:06:26,000 --> 00:06:33,000 So the last step is to actually use this key along with the signature in here to verify that this package 92 00:06:33,000 --> 00:06:35,000 did not get modified. 93 00:06:35,000 --> 00:06:38,000 And to do that we're actually going to use the same program. 94 00:06:38,000 --> 00:06:46,000 GPG We're going to say that we want to verify, we're going to specify the keyring file that we just 95 00:06:46,000 --> 00:06:48,000 downloaded or stored in here. 96 00:06:48,000 --> 00:06:55,000 So it's called Talking Ring and then we're going to give it the location where we have the signature 97 00:06:55,000 --> 00:06:57,000 file in here. 98 00:06:57,000 --> 00:07:03,000 So as you can see, it's in my downloads and it's called Tor browser Linux, whatever, dot ISC. 99 00:07:03,000 --> 00:07:05,000 So the path is going to be. 100 00:07:06,000 --> 00:07:09,000 Downloads Tor browser. 101 00:07:09,000 --> 00:07:12,000 I'm going to type T and hit tab to autocomplete. 102 00:07:13,000 --> 00:07:19,000 And as you can see, because it is the only file that starts with a T, it ought to be completed to 103 00:07:19,000 --> 00:07:20,000 the name of the package. 104 00:07:20,000 --> 00:07:27,000 So I'm just going to add that a C to specify the signature file because if you go back in here, you 105 00:07:27,000 --> 00:07:31,000 can see the signature file has the same name as the package file. 106 00:07:31,000 --> 00:07:34,000 And the only difference is this one ends with a dot ask. 107 00:07:36,000 --> 00:07:38,000 So now we're giving it the signature file. 108 00:07:38,000 --> 00:07:39,000 We're giving it the key ring. 109 00:07:39,000 --> 00:07:43,000 Next, we need to give it the actual package file that we want to verify. 110 00:07:43,000 --> 00:07:50,000 So again, it's in downloads and I'm going to type T and tap to autocomplete and that's it. 111 00:07:51,000 --> 00:07:57,000 So we're using GPG, the same program we're telling it, we want to verify, we're giving it the key 112 00:07:57,000 --> 00:07:59,000 ring file using the key ring argument. 113 00:07:59,000 --> 00:08:02,000 This is the file that contains the key from the previous step. 114 00:08:02,000 --> 00:08:09,000 And then we're giving it, first of all, the signature file and then followed by the actual package 115 00:08:09,000 --> 00:08:13,000 that we want to verify we're going to hit, enter and perfect. 116 00:08:13,000 --> 00:08:18,000 As you can see, we're getting a message telling us that this is a good signature from the Tor browser 117 00:08:18,000 --> 00:08:19,000 developers. 118 00:08:19,000 --> 00:08:26,000 This means that this package did not get modified since the Tor browser developers created this signature 119 00:08:26,000 --> 00:08:27,000 using their key. 120 00:08:28,000 --> 00:08:33,000 So now we can interact with this package, use it, and use the Tor browser with confidence, knowing 121 00:08:33,000 --> 00:08:39,000 that it's going to work exactly the same way that the developers intended to work and that it did not 122 00:08:39,000 --> 00:08:42,000 get modified as it was downloaded. 123 00:08:43,000 --> 00:08:46,000 So from now on, the installation is actually pretty simple. 124 00:08:46,000 --> 00:08:49,000 We're going to, first of all, need to uncompressed this archive. 125 00:08:49,000 --> 00:08:56,000 So I'm going to right click it and extract it here and then we're going to open up the new directory 126 00:08:56,000 --> 00:09:02,000 that was created and we're simply going to be able to run the Tor browser by executing this file. 127 00:09:02,000 --> 00:09:04,000 So we're going to go to the terminal. 128 00:09:04,000 --> 00:09:06,000 I'm going to clear it. 129 00:09:06,000 --> 00:09:10,000 I'm going to navigate to the location where this file is stored. 130 00:09:10,000 --> 00:09:15,000 So it's in my downloads in the Tor browser directory, in another directory called Tor Browser E and 131 00:09:16,000 --> 00:09:16,000 us. 132 00:09:16,000 --> 00:09:19,000 So we're going to use the CD command to do that. 133 00:09:19,000 --> 00:09:26,000 We're going to go into downloads, I'm going to type T and tab to Autocomplete and another T and a tab 134 00:09:26,000 --> 00:09:27,000 to autocomplete. 135 00:09:28,000 --> 00:09:35,000 I'm going to do LS to list the files and directories and notice that this file is in green, meaning 136 00:09:35,000 --> 00:09:42,000 that it is an executable so I can start it by typing dot forward slash followed by the file name. 137 00:09:42,000 --> 00:09:47,000 So again, I'm going to type s and a tab to autocomplete and I'm going to hit Enter. 138 00:09:48,000 --> 00:09:52,000 And as you can see, we get the default window for the Tor browser. 139 00:09:52,000 --> 00:09:57,000 I'm going to check this box to always automatically connect to the Tor network and I'm going to click 140 00:09:57,000 --> 00:10:00,000 and connect to connect to it and start the browser. 141 00:10:01,000 --> 00:10:04,000 Now, don't worry about how this browser works and about its features. 142 00:10:04,000 --> 00:10:08,000 We're going to cover all of that in the next lectures. 143 00:10:08,000 --> 00:10:14,000 But for now we have a clean, unmodified version of the Tor browser installed on our Linux computer. 144 00:10:15,000 --> 00:10:21,000 And like I said, you can follow these installation steps on pretty much any Linux distro and it should 145 00:10:21,000 --> 00:10:22,000 work exactly the same.