Tor Browser is a bastion of anonymity on the Internet, but even this tool does not provide complete privacy – and here’s why.
The desire to remain anonymous on the Internet has been around for as long as the Internet itself. Users used to think that hiding behind a nickname, they could write nasty things about their neighbors on local forums and no one would know. Now, such trolls can be identified in no time. Since then, technology has made a quantum leap: distributed networks, anonymous browsers, and other tools for personal privacy have appeared. One of them, Tor Browser*, was especially actively promoted ten years ago by former NSA agent Edward Snowden.
Can Tor provide complete anonymity today, or can we just not bother and switch to a classic browser like Google Chrome?
How Tor users are deanonymized
If you are hearing about Tor for the first time and have no idea how it works, check out our vintage material . There we answered the most popular questions: how anonymity is provided in the browser, who needs it and what people usually do on the dark web. In short, the anonymity of Tor users’ traffic is provided by a distributed network of servers, which are called nodes. All network traffic is encrypted multiple times, passing through several network nodes on the way between two communicating computers. No network node knows both the sending address of the data packet and the recipient’s address at the same time, and the nodes do not have access to the contents of the packet. Now that the short digression is over, we will focus on the real security threat to adherents of the anonymous Internet.
In September, German intelligence services identified one of the Tor users. How did they do it? The key to deanonymization was data obtained through so-called time analysis.
How does this analysis work? Law enforcement monitors Tor exit nodes (the last node in the Tor chain that sends traffic to its destination). The more nodes in the Tor network that authorities monitor, the more likely it is that a user hiding their connection will use one of the monitored nodes. Then, by timing individual data packets and matching that information with ISP data, anonymous connections can be traced back to the end Tor user, even though all traffic in the Tor network is encrypted multiple times.
The operation that led to the discovery and arrest of the administrator of the pedophile platform was made possible, among other things, because Germany has a record number of Tor exit nodes — about 700. The Netherlands is in second place (about 400 exit nodes), and the United States is in third (about 350 nodes). In other countries, the number of exit nodes ranges from a few to several dozen. And in this story of the deanonymization of the pedophile, international cooperation between these countries — leaders in the number of exit nodes — plays a major role. It is logical to assume that the more nodes a country has, the more of them can be controlled by the state, and therefore the likelihood of catching the criminals is higher.
Germany and the Netherlands are among the leaders in the number of Tor exit nodes not only in Europe but also worldwide. Source
The Tor Project responded to this story with a blog post discussing whether it was safe to use their browser. They concluded that it was safe: the deanonymized person turned out to be a criminal ( well, why else would the secret services be interested in him?) who used an old version of Tor and the Ricochet messenger . At the same time, Tor noted that they were not given access to the case documents, so the interpretation regarding the safety of their own browser may not be final.
This story is not new, the problem of time attacks has long been known to Tor representatives, world intelligence agencies, and scientists. Therefore, despite the fact that everyone knows about these attacks, they are still possible, and most likely, in the future, more and more criminals will be identified using time analysis. However, this method is not the only one: in 2015, our experts conducted a large-scale study in which they talked about other ways to attack Tor users. And even if some of these methods may not be relevant today in the same form, the principle of the attacks does not change.
“In general, it is impossible to achieve absolute anonymity even with Tor”
This phrase begins the “Can Tor Keep Me Anonymous” section of the Tor Browser support page . The developers provide tips that will only increase your chances of anonymity.
- Be careful what information you provide. Users are advised not to log into personal accounts on social networks, and not to write their real name, email address, phone number, or other similar information on forums.
- Don’t use torrents via Tor. Torrent programs often ignore proxy settings and prefer direct connections – this way they deanonymize all traffic, including Tor.
- Do not install or enable browser extensions. This advice, by the way, can also be applied to regular browsers, for which there are many dangerous extensions .
- Use HTTPS versions of sites. This recommendation, by the way, applies to all Internet users.
- While you’re online, don’t open documents you downloaded through Tor. Such documents, the Tor Project warns, may contain malicious exploits.
With all these recommendations, the Tor Project signs a disclaimer: “We have an anonymous browser, but if you use it incorrectly, you will still be found.” And this actually makes sense – the level of anonymity on the Internet depends primarily on the user and his actions, and not on the technical capabilities of the browser or any other tool.
There is another interesting item on the Tor support page: “What attacks is the Tor network susceptible to?” It specifically mentions possible attacks using time analysis with the note “Tor does not protect against this threat model,” although in the publication about the deanonymization of a user in Germany, the developers claim that they have been using the Vanguards add-on in Tor Browser, which protects against time attacks, since at least 2018, and in Richochet Refresh – since June 2022. From all this, the conclusion suggests itself: either the Tor Project does not update the documentation, or they are being disingenuous somewhere. Both are equally bad, because they mislead users.
So what to do with anonymity now?
It is worth keeping in mind that Tor Browser cannot provide 100% anonymity. At the same time, switching to other solutions built on a similar scheme (with a distributed network of nodes) is pointless – the time attack applies to all of them.
If you are a law-abiding person and use anonymous browsing to get rid of intrusive contextual advertising, secretly choose gifts for loved ones and for other similar purposes, then the incognito mode in any of the classic browsers will probably suit you. This tool, of course, will not provide the same level of anonymity as Tor and its analogues, but will allow you to make surfing the Internet a little more private. Just make sure that you correctly understand how this mode works in different browsers, what it can protect against and what it cannot .
In addition, any of our home security solutions have “Protection from online data collection” . By default, after installation, it detects attempts to collect data and records them in a report, but does not block them. To block them, you must either enable “Prohibit data collection” in the Kaspersky application, or activate protection with the Kaspersky Protection plug-in directly in the browser.
In addition, Kaspersky can block ads , hidden installation of applications , detect and remove stalker and advertising applications, and clear traces of your activity in the operating system. And the special component “Safe Payments” maximally protects all financial transactions, conducting them in a secure browser in an isolated environment and prohibiting unauthorized access of other applications to the clipboard and the creation of screenshots.
* On July 28, 2022, the Leninsky District Court of Saratov declared Tor Browser prohibited for distribution on the territory of the Russian Federation.
