Anonymous surfing on the Internet

The Internet is a veritable cornucopia for data collectors of all kinds. Secret service agencies, marketing agencies, and criminals are lying in wait to gather up and abuse the personal data of unsuspecting surfers. In many cases, it is the browser, or the add-ons used by the browser, that provide access by data spies who, through the application of sophisticated website programming techniques, invade and diminish the personal privacy of others.

The standard settings for the typical web browser without protective extensions leave the user wide open to real risks. Surfing habits can be captured and identified. The user is vulnerable to malware attacks. Manually harden the software thus makes sense, but this process requires experience with techniques for guarding against cyberattacks. The Tor browser offers a much simpler solution for users wanting to block snooping and overzealous data collection.

How It Works

The Tor bundle combines several reliable technologies from open source software, thereby achieving a very high level of security. The Tor network and the Firefox web browser function as the central components of the bundle. The Tor team has enriched Firefox with several preconfigured add-ons and then configured the browser so that it searches for access to the Internet exclusively via onion routing. You could manually install both components but that would take a lot of configuration work. Therefore, the Tor browser package is ideally suited for the security-minded user lacking subject matter expertise in cybersecurity and data privacy.

The Tor concept had been developed by the year 2000. In 2002, a pre-alpha version of the Tor project was introduced to the public, allowing users to anonymize their connectivity data for the Internet. The Tor project is suitable for secure browsing but also for IRC, email, and messaging services. The software operates on the onion principle. The data traffic of the Tor client is directed to a so-called entry guard, which is the entry node. This node transmits the traffic to another Tor node, a so-called relay node, that then sends the information on to an exit node, which serves as a doorway to the regular Internet.

The advantage of this approach is that none of the nodes knows all of the information about a particular connection. For example, the entry guard knows where the request originates, but not to whom it is addressed. This information is only known by the exit node, which in turn does not know where the request originates (see Figure 1). The so-called mixed cascade changes its route every 10 minutes so that the packets run continuously via new nodes. It is not known beforehand which nodes these will be; therefore it becomes extremely difficult to attack and reveal the connection.

Figure 1: None of the three relay nodes of the onion routing system has complete information about a connection.

Tor, however, encrypts data only during traversal of its relay nodes. If you use the unencrypted HTTP protocol, then the information transmitted outside of the Tor network will remain visible. This means that an attacker could capture passwords that might be transmitted.

The Tor Browser

The bundle from the preconfigured Tor client and the modified Firefox browser is available in various languages [1]. After downloading the version suitable to your architecture, you can unpack the archive with

tar -xvf tor-browser-linuxVersion.tar.xz

in the terminal. Then, move the newly created tor-browser_de directory into a folder such as /opt and switch to tor-browser_en-US/Browser .

Enter ./start-tor-browser to begin setting up the software. Using its graphical user interface, the tool will first ask how you would like to make contact with the Tor network. A user with direct connection to the Internet would probably select a direct connection and click on the connect button. After accessing the network, the modified browser based on Firefox version 31.6.0 ESR will start. In the upper portion of the screen, you will find menu options for the browser security levels with a slider to set your preferences (Figure 2).

Figure 2: Security level preferences can be easily set with a slider.

Setting the levels is important because completely blocking all of the web techniques currently in use means that much of the content available over the Internet, especially multimedia content, does not display correctly. Therefore, you should avoid pushing the slider to the maximum level of protection if you are a frequent visitor of sites with lots of optical gimmicks or multimedia content. Additionally, you will find some settings for privacy above the slider. These are already activated in order to prevent spying by tracking services.