Monthly Archives: March 2017

Need to hire an assassin, buy some contraband, view illegal porn, or just bypass government, corporate, or identity thief snooping? Tor is your answer. Tor, which stands for "The Onion Router" is not a product, but a protocol that lets you hide your Web browsing as though it were obscured by the many layers of an onion. The most common way to view the so-called Dark Web that comprises Tor sites is by using the Tor Browser, a modded version of Mozilla Firefox. Using this Web browser also hides your location, IP address, and other identifying data from regular websites. Accessing Tor has long been beyond the ability of the average user. Tor Browser manages to simplify the process of protecting your identity onlinebut at the price of performance.

What Is Tor? If you're thinking that Tor comes from a sketchy group of hackers, know that its core technology was developed by the U.S. Naval Research Lab and D.A.R.P.A.. The Tor Project non-profit receives sizeable donations from various federal entities such as The National Science Foundation. The Tor Project has a page listing many examples of legitimate types of Tor users, such as political dissidents in countries with tight control over the Internet and individuals concerned about personal privacy.

Tor won't encrypt your datafor that, you'll need a Virtual Private Network (VPN). Instead, Tor routes your Internet traffic through a series of intermediary nodes. This makes it very difficult for government snoops or aggressive advertisers to track you online. Using Tor affords far more privacy than other browsers' private (or Incognito) modes, since it obscures your IP address so that you can't be tracked with it. Standard browsers' private browsing modes discard your cached pages and browsing history after your browsing session. Even Firefox's new, enhanced private browsing mode doesn't hide your identifiable IP address from the sites you visit, though it does prevent them tracking you based on cookies.

Starting Up Connecting to the Tor network entails more than just installing a browser and firing up websites. You need to install support code, but luckily, the free Tor Browser bundle streamlines the process. Installers are available for Windows, Mac, and Linux. Tor Project recommends installing the browser on a USB drive for more anonymity and portability; the drive needs to have 80MB free space.

We tested a standard Windows installer, with choices to create desktop icons and run the browser immediately. The browser itself is a heavily modified version of Firefox 38.5 (as of this writing), and includes several security plug-ins as well as security tweaks such as not caching any website data. For a full rundown of the PCMag Editors' Choice browser's many features, read our full review of Firefox.

Before merrily browsing along anonymously, you need to inform Tor about your Web connection. If your Internet connection is censored, you configure one way, if not, you can connect directly to the network. Since we live in a free society and work for benevolent corporate overlords, we connected directly for testing. After connecting to the Tor relay system (a dialog with a progress bar appears at this stage), the browser launches, and you see the Tor project's page.

Interface The browser's home page includes a plea for financial support to the project, a search box using the anonymized Disconnect.me search, and a Test Tor Network Settings link. Hitting the latter loads a page that indicates whether you're successfully anonymized. We recommend taking this step. The page even shows your apparent IP addressapparent because it's by no means your actual IP address. We verified this by opening Microsoft Edge and checking our actual IP address on Web search sites. The two addresses couldn't have been more different, because the Tor Browser reports the IP address of a Tor node.

The browser interface is identical with Firefox, except with some necessary add-ons installed. NoScript, a commonly used Firefox add-on, is preinstalled and can be used to block most non-HTML content on the Web. The green onion button to the left of the address bar is the Torbutton add-on. It lets you see your Tor network settings, but also the circuit you're using: Our circuit started in Germany and passed through two different addresses in the Netherlands before reaching the good old Internet. If that doesn't suit you, you can request a new circuit, either for the current session or for the current site. This was one of our favorite features.

One thing we really like about the Tor Browser is how it makes existing security and privacy tools easier to use. NoScript, for example, can be a harsh mistress, who can be difficult to configure, and can break websites. But a security panel in the Torbutton presents you with a simple security slide. At the lowest, default setting, all browser features are enabled. At the highest setting, all JavaScript and even some image types are blocked, among other settings. This makes it easy to raise or lower the level of protection you need, without having to muck around in multiple settings windows.

Everything you do in the browser is tested for anonymity: When we tried full-screening the browser window, a message told us that that could provide sites a way to track us, and recommended leaving the window at the default size. And the project's site specifically states that using Tor alone doesn't guarantee anonymity, but rather that you have to abide by safe browsing guidelines: don't use BitTorrent, don't install additional browser add-ons, don't open documents or media while online. The recommendation to only visit secure HTTPS sites is optionally enforced by a plug-in called HTTPS Everywhere.

Even if you follow these recommendations, though, someone could detect the simple fact that you're using Tor, unless you set it up to use a Tor bridge relay. Those are not listed in the Tor directory, so hackers (and governments) would have more trouble finding them.

One thing we noticed while browsing the standard Web through Tor was the need to enter a CAPTCHA to access many sites. This is because your cloaked URL looks suspicious to website security services such as CloudFlare, used by millions of sites to protect themselves. It's just one more price you pay for anonymity.

We also had trouble finding the correct version of websites we wished to visit. Directing the Tor Browser to PCMag.com, for example, took us to the Netherlands localization of our website. We could not find any way to direct us back to the main URL, which lets you access the U.S. site.

The Dark Web You can use Tor to anonymize browsing to standard websites, of course, but there's a whole hidden network of sites that don't appear on the standard Web at all, and are only visible if you're using a Tor connection. You can read all about it in our feature, Inside the Dark Web. If you use a standard search engine, even one anonymized by Disconnect.me, you just see standard websites. By the way, you may improve your privacy by switching to an anonymous search provider such as DuckDuckGo or Startpage.com. DuckDuckGo even offers a hidden search version, and Sinbad Search is only available through Tor. Ahmia is another search engine, on the open Web, for finding hidden Tor sites, with the twist of only showing sites that are on the up-and-up.

Tor hidden sites have URLs that end in .onion, preceded by 16 alphanumeric characters. You can find directories of these hidden sites with categories resembling the good old days of Yahoo. There's even a Tor Links Directory page (on the regular Web) that's a directory of these directories. There are many chat and message boards, but you even find directories of things like lossless audio files, video game hacks, and financial services such as anonymous bitcoin, and even a Tor version of Facebook. Many onion sites are very slow or completely downkeep in mind that they're not run by deep-pocketed Web companies. Very often we clicked an onion link only to be greeted with an "Unable to Connect" error. Sinbad helpfully displays a red "Offline on last crawl" bullet to let you know that a site is probably nonfunctional.

Speed and Compatibility Webpage loading time under Tor is typically far slower than browsing with a standard Internet connection. It's really not possible to state definitively by how much your browsing will be slowed down if you use Tor, because it depends on the particular relay servers your traffic is being routed through. And this can change every time for every browsing session. As a very rough rule of thumb, however, PCMag.com took 11.3 seconds to load in Firefox and 28.7 seconds in the Tor Browser, at the same time, over the same FiOS connection on the open Web. Your mileage, of course, will vary.

As for browser benchmarks, the results hew to Firefox's own performance, with near-leading performance on all the major JavaScript tests, JetStream and Octane, for example. On our test laptop, the Tor Browser scored 20,195 on Octane, compared with 22,297 for standard Firefoxnot a huge difference. The Tor network routing is a far more significant factor in browsing performance than browser JavaScript speed. That is, unless you've blocked all JavaScript.

Keep in mind, though, that the Tor Browser is based on the Firefox Extended Support Release versions, which updates less frequently so that large organizations have time to maintain their custom code. That means you don't get quite the latest in Firefox performance and features, but security updates are delivered at the same time as new main versions.

There's a similar story when it comes to standards compatibility: On the HTML5Test.com site, which quantifies the number of new Web standards supported by a browser, the Tor Browser gets a score of 412, compared with 468 for the latest Firefox version. You may run into incompatible sites, though. For example, none of the Internet speed connection test sites performed correctly in the Tor Browser.

Tor, Browser of Thunder With the near complete lack of privacy on today's Web, Tor is becoming more and more necessary. It lets you browse the Web knowing that all those tracking services aren't watching your every move. Most of us have experienced how an ad follows you from site to site, just because you clicked on, or searched for a product or service once. All that goes away.

Of course, you pay a price of extra setup and slower performance with the Tor Browser, but it's less onerous than you may think. And the included support for fine-grain privacy and security protection is excellent. If you take your online privacy seriously, you owe it to yourself to check out the Tor Browser. For standard, full-speed Web browsing, however, check out PCMag Editors' Choice Web browser, Firefox.

PCMag may earn affiliate commissions from the shopping links included on this page. These commissions do not affect how we test, rate or review products. To find out more, read our complete terms of use.

Read this article:
Tor Browser Review & Rating | PCMag.com

Federal prosecutors have dropped child pornography charges against a Washington teacher after the U.S. Justice Department refused to disclose information about a software weakness it exploited during an investigation last year.

Charges against Vancouver, Washington, teacher Jay Michaud in U.S. District Court in Seattle were dismissed Monday.

In 2015, Michaud was arrested and accused of downloading child pornography. During the child porn investigation, the FBI allowed a secret child porn website on the largely anonymous Tor network to run for two weeks while it tried to identify users by hacking into their computers.

The child porn website, called Playpen, operated on Tor, which provides users anonymity by routing their communications through numerous computers around the globe, and it had more than 150,000 members. The Tor browser is based on Firefox. While the network is used for various reasons including circumventing free-speech restrictions in some parts of the world it has also provided sanctuary for child pornography, drug trafficking and other criminality.

After arresting Playpen's operator in Florida in early 2015, the FBI let the website continue running for two weeks while trying to identify users, a move the agency said was necessary to apprehend those posting and downloading images of children being sexually abused. Defense attorneys criticized the tactic as unethical.

A magistrate in Virginia issued a search warrant allowing the agency to deploy what it calls a "network investigative technique": code that prompted the computers that signed into Playpen to communicate back to the government certain information, including IP addresses, despite the anonymity normally afforded by Tor.

The FBI then obtained further warrants to search suspects' homes. At least 137 people were charged. Defendants have challenged the FBI's hacking on numerous grounds.

A federal judge in Washington state threw out the government's evidence against Michaud last year, saying that unless the FBI detailed the vulnerability it exploited, the man couldn't mount an effective defense.

The DOJ said previously the information is not relevant. Defendants have been offered or provided all the evidence they need, including limited source code and data streams showing what the program did, the FBI has argued.

Michaud's lawyer, Colin Fieman, said in an email to The Associated Press that they are relieved and grateful his case is done but that many unanswered questions remain about the FBI's investigation, known as Operation Pacifier.

"Mr. Michaud maintained his innocence from the outset, and the dismissal is a result of the FBI's overreaching and misuse of its computer hacking capabilities, including its operation of the world's largest child pornography web site and attacks on computers in over 120 countries," Fieman said. "It remains to be seen whether the FBI will ever be held fully accountable for those aspects of its investigation that put core privacy rights at risk and violated common standards of decency when it comes to how law enforcement agencies do their job."

A school district spokeswoman says Michaud hasn't returned to work, KGV-TV reported.

Read more here:
Child porn case dropped as US refuses to show software weakness it exploited - Chicago Tribune