How should one explain Tor to a non-technical audience?

Question

How should I explain the operation of Tor to a reasonably-intelligent but non-technical audience? I'm looking for a way to introduce folks to Tor in a way that helps them to understand its basic operation without overwhelming them.

Answer 1

Tor works by using a technique called onion routing.

Your client sets up a secure tunnel to a relay (its first node). It then uses that tunnel to mask its connection to a second relay (the middle node). It then uses the second tunnel (and thus the first) to create a secure connection to a third relay (a relay that has volunteered to be an exit node).

When you browse a webpage, your request is sent through the three-layer tunnel to the final exit node, who then sends the request out to whatever server you were talking to. The response from the server is similarly routed back through the three nodes to your computer.

In this way, no-one in the connection knows both your IP (the address of your computer) and what you're browsing for (the site you were talking with). Various parties know one or the other, but barring the various attack models, they cannot correlate the information.

Answer 2

For non-technical audiences I like to use the oft-quoted (but still reasonably good) safe analogy.

Imagine you want to send a message to somone via a (randomly selected) courier, but you don't want the person on the other end to know the message came from you, and you don't want the courier to read the letter. You can put the letter in a locked briefcase and have the courier take that (assuming the person on the other end has the key already), but they can still tell the person that the letter came from you. But what if you put that briefcase in another locked briefcase, and that briefcase in another locked briefcase, and pass it between three couriers. The first courier will have the key to the outermost briefcase, the second to the secon briefcase, and the final one to the innermost briefcase. Each one gets their briefcase, unlocks it, passes the next briefcase onto the next courier, until the letter gets passed to the recepient. Now only the last courier can read the letter, and only the first courier sees your face. Of course, the first courier might still try to tell the second one who you are, but it probably won't trickle all the way to your recepient (it's much less likely that someone will be able to find and pay off all three of your randomly selected couriers than it is just one).

People seem to get this okay, even if they know nothing about encryption, routing, computers, etc.