Tor Browser

Tor Browser
The Tor Project, Inc. · CC BY 3.0 us · source
Name	Tor Browser
Developer	Tor Project
Initial release	2008
Programming language	C, Rust, JavaScript
Operating system	Windows, macOS, Linux, Android
License	BSD, GPL

Tor Browser Tor Browser is a privacy-focused web browser packaged by the Tor Project to route web traffic over the Tor network, providing anonymity for end users. It integrates the Tor protocol with a hardened version of Mozilla Firefox and privacy-enhancing configurations to mitigate tracking and fingerprinting. Tor Browser is distributed for multiple platforms and is used by activists, journalists, researchers, and general users to access both public resources and onion services.

Overview

Tor Browser bundles the Tor network client with a modified Mozilla Firefox ESR codebase and a suite of privacy tools to create a portable browsing environment. The package aims to protect against network surveillance by relaying traffic through volunteer-operated relays such as Tor relays and exit nodes while offering access to onion services like sites hosted under .onion addresses. Stakeholders include the Tor Project, nonprofit organizations, civil society groups like Electronic Frontier Foundation, human rights groups such as Amnesty International, and media outlets including The New York Times and The Guardian that report on anonymity technologies. Funding and support have come from entities like the U.S. Department of State, the Swedish International Development Cooperation Agency, and private donors.

Features and Technology

Tor Browser incorporates privacy features from Mozilla Firefox, cryptographic primitives from projects like OpenSSL and libsodium, and networking layers from the Tor software suite. It uses onion routing concepts pioneered by academics at Naval Research Laboratory and organizations such as The Free Haven Project and RAND Corporation work on anonymity. Major technical components include circuit-building through relays (guard, middle, exit), directory consensus mechanisms maintained by directory authorities like tor26 and later directory scalers, and transport obfuscation tools including pluggable transports such as Obfs4 and meek to evade censorship used by states exemplified in cases like China's Great Firewall or Iran's filtering. The browser ships with fingerprint-resisting defaults, a built-in NoScript-like control influenced by NoScript extension design, and cookie isolation akin to container techniques seen in Mozilla Containers initiatives. It also supports security sliders and sandboxing strategies similar to approaches from Google Chrome and Microsoft Edge.

History and Development

Tor originated from research projects at the United States Naval Research Laboratory and early funding and stewardship involved groups like DARPA and the Electronic Frontier Foundation. The Tor Project was formed as a non-profit to manage development, with early academic contributors from institutions such as The Massachusetts Institute of Technology and University of Cambridge. Notable milestones include integration with Firefox ESR releases, introduction of onion services (previously hidden services), adoption of pluggable transports to counteract censorship events like those in Egypt during the 2011 uprisings, and porting to mobile platforms including Android. Development has been shaped by security audits from firms like NCC Group and collaboration with open-source projects such as Debian and GNU to package builds for distributions and repositories.

Security and Privacy Considerations

Tor Browser's anonymity model relies on path diversity across volunteer relays and cryptographic onion encryption, concepts linked to research from David Chaum and subsequent work at IETF on anonymity protocols. Threat models include global passive adversaries discussed in academic literature from University of Cambridge and Princeton University papers, targeted deanonymization attacks exemplified by incidents investigated by Carnegie Mellon University researchers, and traffic-correlation techniques described in publications from USENIX and IEEE. Security mitigations include circuit isolation, timing obfuscation recommendations from ACM conferences, and recommendations from privacy organizations such as Privacy International. Remaining risks involve compromised exit nodes observed in investigations by outlets like ProPublica and legal pressures such as law enforcement interventions in jurisdictions like Germany and United States courts that have impacted relay operators.

Usage and Distribution

Tor Browser is distributed via official bundles on mirrors and through software repositories maintained by projects like Debian and Fedora, and via mobile distribution channels supported by the Android ecosystem. It is used by journalists at organizations such as BBC and Reuters, by whistleblowers referenced in reporting by Wikileaks and The Intercept, and by researchers publishing analyses in venues like ACM CCS and USENIX Security. Deployment scenarios include secure communications in contexts like Arab Spring coverage, investigative reporting on topics such as Panama Papers, and by dissidents referenced in reports by Human Rights Watch. Accessibility initiatives have sought support from entities like Mozilla Foundation and academic programs at Stanford University and University of Oxford.

Criticism and Controversies

Tor Browser and the Tor network have faced criticism related to illicit use cases highlighted in investigations by Europol and reports in The Wall Street Journal, including marketplaces and forums referenced in law enforcement operations such as takedowns associated with operations by FBI and Interpol. Debates have arisen over funding from governmental sources, with scrutiny from media outlets like Wired and The Guardian and policy discussions in forums such as ICANN meetings. Security controversies include research disclosures by teams at Carnegie Mellon University and subsequent legal disputes, operational security lapses noted in analyses by EFF and audits by Cure53. Discussions on balancing anonymity with accountability have involved stakeholders such as United Nations special rapporteurs, legislators in bodies like the European Parliament, and civil liberties groups including American Civil Liberties Union.

Category:Free web browsers