2

Does it matter when you connect to TOR Network ? 2 cases: 1. You connect to TOR after 10 minutes after you connect to your real facebook/bank/email account. Is it harmfull to connect to TOR as like that ? 2. Second case is it dangerous to connect to TOR at 2:00AM-5:00AM when most of people in your state does still sleep and are not online ?

1

Somehow it matters, but not fatal. Here are your two cases for a start:

  1. You have connected to Tor after using an authorized page. If your actions you do perform through Tor can be linked with your profile - it's a guess-hint, that it can be you, but not a proof: tor's traffic is 3-times encrypted, at least. If you're using something like Facebook that does have a Tor entrance and making all the precautions like acting through Tor from a separate VM with another login not explicitly linked to the login you've used without Tor - there's no risk at all, except a very vague guess.

  2. It was a concern 10+ years ago, but not now: the global village of Internet is having party 24-7-365 around the globe, so there will be not a significant drop of network activities so they can be inspected deeper. However, a VM and not-linked profiles inside Tor and outside are "the must" and still in power.

However, if you are 100% accurate in using separate temporary VM's and profiles for in-tor activities and want to be completely free of any corellation-related analysis techniques by time - just buy an OrangePI or any Allwinner H3 based SBC and run your Tor node 24-7-365, so as you'll switch to Tor inside your LAN no one will be able to even guess.

0
  1. It shouldn't matter if you connect to your Facebook/email/bank in another browser (e.g. Chrome, Firefox) after using Tor, or vice versa. You may be de-anonymized if you connect to your Facebook account while using Tor.

  2. That depends, but I don't think so. Using the internet isn't very uncommon at that time, so I don't see why using Tor would be any any more suspicious.

0

What is dangerous can be case by case specific or even country by country specific. I am gonna write some thoughts.

  1. If you separate the life between real world browser operation (bank, Facebook etc) and Tor browser, I don't see any danger, just by using Tor browser few minutes before/after using normal browser. But if you mix them, then don't expect anonymity. For example download some images using Tor browser (e.g. by using hidden services) and paying for them and then publish them on Facebook can clearly connect you (as real person from Facebook) with someone buying stuff (you as Tor user). Separate the life is essential, and of course don't do anything outrageous.

  2. For example user is living in suppressive country and living in small town like 10000 people and using Tor to upload some video of corrupted mayor to some web site. Because of using Tor it is not possible to say what has actually been uploaded, because Tor traffic is encrypted. But ISP can know who did connect to Tor network (by monitoring entry nodes) and how many data was transfered (how many bytes). In small town lets say at night at 4 AM five users where connected to Tor network. Four of them were just reading some news web sites, so very few bytes where transfered, but one user (you) has uploaded a lot of data (video file). You can become suspect because ISP knows you are the only one using Tor and uploading huge amount of data. In suppressive regime police may arrest you and torture you to admit you have uploaded the video. So just by using basic statistics and you may get out of the crowd. Police may have also other info about you, like you are the one being on a lot of protests etc. They may link police data with simple data usage statistics.

  3. Another real time sample was few years back. Some student didn't learn and on the day of exam by using Tor and anonymous mail he sent a (false) bomb alert to school administrators in hope whole exams would be canceled and he would have enough time to prepare to next time exams will gonna happen. Exams were canceled, success by the student. But police made an investigation. They made some assumptions, like it is hight probability the alert was sent by student, because it was an exams day. They searched public university computer rooms to find out who was using computers at the time when mail was send. They got list of users using computers and by police work interrogation got to few potential suspects. Now eliminate all the students that are not well computer literate, students with good grades not having an interest of an incident, students who professors say it is a reliable person etc and the list shrinks pretty tight. With few police tricks, clever questioning etc they found out which student sent the mail. You see Tor and anonymous mail is not always enough. By using only police work, student was caught.

  4. Using public places like public pub, library etc and using Tor may seem save. But using the same places, day after day, and some employee may remember there was one girl with fanny cap using her own laptop many days in a role. Nobody knows what she was doing (like using Tor), but they remembered her and asking around the visitors of pub/library and someone may know her. By using routines, you may get out of the crowd.

  5. Lets say some thief in a shop steals Rolex (expensive watch). What is he going to do? Walking around in shop for half an hour or just get out of the shop without a panic but as soon as possible. There is a link crime has happened and thief escaped. Now imagine one hundred users are using Tor on some area and some action is performed like posting some post on forum that reveals corruption and after posting user disconnects from the Tor network. Similar logic like with Rolex, end-user accomplished the task and just see no point of being in the same place (shop or Tor), so disconnects. Now police just has to know when post was posted on forum, get confirmation from forum's web site administrator the user was using Tor exit node and needs to get data from ISP which users of Tor network (using Tor entry nodes) where disconnected from the Tor network at the time of publishing of forum post. Some basic psychological profiling and list of potential candidates shrinks dramatically. Not only the specific time, but specific psychological profiling can reveal some crucial lead.

To recap:

  1. Mixing data from Tor usage and real time usage of normal browser can de-anonymize you.
  2. Basic statistical analysis, can reveal some data, when, who and how much data were transfered and may make user unique and so de-anonymized.
  3. Doing something really unique in real world can by mere police work de-anonymize you.
  4. Doing something repetitive in real world and people can remember you and so de-anonymize you.
  5. Basic human behavior can profile user enough to be de-anonymized.

There can be plenty of other samples, so that is why reading Tor documentation strongly suggests to change your HABITS as essential part of anonymity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.