Agenda

• Fill in this section
• With your agenda for the day
• To help your audience stay focused!

Let's begin

• Do you use Tor?
• If not, why not?
• If yes, do you have any questions, concerns, issues, or doubts about using it?
• Do you teach others about Tor?

What is Tor?

• Tor is free software and an open network.
• Mitigates against tracking, surveillance and censorship.
• Run by a US non-profit and volunteers from all over the world.
• It's Tor, not TOR.

Why do we need Tor?

• Government mass and targeted surveillance.
• The business model of the Internet: big data, advertising, non-consensual tracking.
• Surveillance threats from family, bosses, bad people on the Internet.

little-t Tor or core tor

• Tor the network daemon (a computer program)
• Presents a SOCKS or http proxy
• Location and source anonymity, similar to a VPN or regular proxy (but better!)
• Network of relays in many parts of the world

How Tor relays work

Tor Browser

• little-t tor plus patched Firefox
• Anyone snooping can't see the websites you visit
• Websites can't track you or see other sites you visit (cross-tracking)
• Prevents other privacy violations like fingerprinting or 3rd party cookies
• Writes nearly nothing to disk
• No browser history
• Cross platform: Windows, macOS, Linux and Android

Tor Browser features

Tor Browser

Downloading Tor Browser

• The safest way to download is from https://torproject.org.
• If https://torproject.org is blocked, try mirrors:
• http://tor.calyxinstitute.org/
• https://tor.eff.org/
• Or try GetTor
• email gettor@torproject.org and in the message write "windows", "osx" or "linux" (no quotes, no subject line)

Running Tor Browser for the first time

Running Tor Browser for the first time

Using Tor Browser

• Default search engine: DuckDuckGo
• Bundled with NoScript, HTTPS Everywhere
• You should not add any other extensions nor enable any plugins (eg Flash)!
• Best practices
• Websites won't know anything about you unless you login and tell them.

Updating Tor Browser

Uninstalling Tor Browser

• Uninstalling Tor Browser is as easy as moving the folder to the trash! Then, empty the trash.
• Default Tor Browser folder locations:
• Windows: desktop
• macOS: move the Tor Browser application to Trash and also the TorBrowser-Data folder ~/Library/Application Support/
• Linux: home, or look for a name like "tor-browser_en-US"

Troubleshooting Tor Browser

• Is your system clock correct?
• Is the browser already running?
• Are you being censored?
• Is your antivirus or firewall blocking Tor?
• Do you have a very old operating system?
• Try uninstalling and reinstalling
• Get help at https://jqlsbiwihs.oedi.net and https://forum.torproject.net

Security Level

NoScript

• It's not advisable to change settings in the NoScript "options" menu.
• For example, adding sites to the "whitelist" can result in fingerprinting.
• Instead, only "temporarily trust" blocked objects, or use security slider (Standard, Safer, Safest)

DuckDuckGo

• DuckDuckGo is the default search engine in Tor Browser.
• Using Tor Browser prevents DDG from tracking users, even if they wanted to (they claim not to).
• Duckduckgo.com or https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/.

Plugins, add-ons, JavaScript

• Do not add any new add-ons/extensions to Tor, and don't enable any plugins.
• For example, Flash plugin can reveal your real location.
• JavaScript is enabled by default, but is sanitized to preserve anonymity.
• To prevent possible JavaScript vulnerabilities, use the "safest" setting in the security slider.

Things to know about mobile Tor

• The design of mobile devices makes full privacy impossible.
• Mobile Tor is best for censorship prevention.
• Can also provide better privacy for some threat models.
• We're making it better all the time and better options for mobile devices are coming out soon.

Orbot

Help using Tor

• Tor Browser Manual: https://tb-manual.torproject.org
• Support portal: https://jqlsbiwihs.oedi.net
• Tor Forum: https://forum.torproject.net
• Chat: IRC OFTC network - easy access through https://webchat.oftc.net channel #tor
• Community portal: https://sgapqzbrdr.oedi.net

If you find a bug in Tor

• GitLab: https://gitlab.torproject.org/
• Create a login: https://gitlab.onionize.space/
• Search for your issue to find any existing tickets.
• If no ticket opened, open a new ticket with detailed description of the problem.

I downloaded Tor Browser, but it won't connect

• If this screen takes a long time and does not connect, you may need a bridge or pluggable transport

When torproject.org is blocked

• Mirrors
• https://tor.eff.org/
• http://tor.calyxinstitute.org/ (if https is blocked)
• GetTor email: gettor@torproject.org
• Contact from a Gmail or Riseup account
• Flash drive with Tor on it from someone you trust
• Get the EXE, DMG, tar.xz, don't copy the installed folder
• Downloading Tor Browser from a non-official source is dangerous!

Bridges and pluggable transports

• Bridges are relays that are not listed publicly
• Get bridges directly from Tor Browser (moat)
• Or from the website https://bridges.torproject.org or send an email to bridges@torproject.org from a Gmail, or Riseup.net account
• Or get a bridge address from a trusted person
• Pluggable transports can be used like bridges to disguise Tor traffic (also called "built-in bridges")

Bridges and pluggable transports

Request a bridge

Or select a built-in bridge

Pluggable transports

• obfs4: makes Tor traffic look random; works in many situations including China (if not, try meek).
• meek-azure: makes it look like Microsoft traffic; works in China.
• snowflake: proxies traffic through temporary proxies using WebRTC. https://snowflake.torproject.org

What are Onion Services?

The regular internet allows adversaries to see what you are sharing and with whom, whether you're using Dropbox etc, downloading it from email or through your browser...

...so Tor devised a sneaky way to hide both the file data and the related metadata!

Onion Services

• Protection for both the user and the server
• User learns about xyz.onion
• Client and service meet at rendezvous point in the Tor cloud
• End-to-end encrypted without HTTPS
• Connections never go out to the "vanilla" internet

OnionShare

• Secure, private, anonymous file sharing done easy, built on top of the Tor network.
• Uses onion services to securely send files.
• Creates an onion service where the file can be downloaded.
• No need to trust third parties like Dropbox.
• Download from https://onionshare.org