29

There are a variety of (usually rare) situations where https://check.torproject.org/ will give you a false negative -- that is, it says "you're not using Tor" when you are.

The FAQ does not explain this issue really well, and it really scares users when this happens (see e.g. Trac ticket 8928).

Can somebody explain how the check.tp.o query works, for normal users, so its clear why this happens?

In particular, what are all the cases that can lead to false negatives? I think the two big ones are "the exit relay makes outbound connections from a different IP address than it lists in the directory, and the Tordnsel tester hasn't caught it yet or otherwise has a bug" and "that exit relay only came up recently so check doesn't know about it yet".

When users encounter one of these false negatives, should they use a separate "IP check" website like ipchicken.com to check/verify?

Why did TBB 3.0 switch to using a local homepage instead of using Tor Check? What are the benefits?

  • 7
    Stack Exchange encourages self-answered questions. If you know the issue very well, then you can go ahead and write an answer yourself. I would suggest waiting for others to answer first, and then writing your own answer if needed. – asheeshr Sep 29 '13 at 12:13
  • 3
    It might be a good idea to divide this question into several questions. This makes it easier to give a precise answer to each of them. – Jens Kubieziel Sep 29 '13 at 21:21
  • @AsheeshR Thanks. It sounds like I should use some of the original text for a community-wiki-style answer. – Roger Dingledine Sep 29 '13 at 21:27
7

Can somebody explain how the check.tp.o query works, for normal users, so its clear why this happens?

check.tp.o is composed of two parts, TorDNSEL and TorCheck. TorDNSEL is used to create a list of all the IPs that correspond to exit relays. That is, when you exit from a relay, what IP do you assume. It does this by running an http server listening on a few ports and building various circuits through the relays back to itself. This is done every hour, after a new consensus is reached in the Tor network and currently takes about 20 minutes to complete. The list is then fed to TorCheck, where it's combined with the current consensus and exit policies of the relays, to create a map of all the IPs that can exit to check.tp.o on port 443 from the Tor network. When you launch the TorBrowserBundle (and hit Test Network Settings in the 3.x series), TorCheck compares the remote address of the request it receives to its map and returns True if it finds it there.

In particular, what are all the cases that can lead to false negatives? I think the two big ones are "the exit relay makes outbound connections from a different IP address than it lists in the directory, and the Tordnsel tester hasn't caught it yet or otherwise has a bug" and "that exit relay only came up recently so check doesn't know about it yet".

The cases I know about are:

  • For one, TorDNSEL is not currently listening on port 443 so certain restrictive exit policies won't let it learn the exit address while still permitting requests to check.tp.o

  • A new consensus in the Tor network is reached every hour. The tor client, however, keeps a cache of the consensus around for a while. Over time, relays fluctuate in and out of the consensus as they go offline, reboot or whathaveyou. If a relay that used to be part of the consensus (and is thus in a clients cache) comes back online, a client may exit from it before the hour, when the new consensus is reached, and TorCheck won't know about it yet. In an attempt to mitigate this scenario, TorCheck keeps a map of all the IPs from the past 16 hours. There's a tradeoff here between false positives and negatives.

  • Some relays see a lot of churn in their IPs throughout the day. TorCheck tries to keep track of all the IPs it has seen from a given relay over time. Again, this can result in more false positives and isn't guaranteed to catch a new IP before the hour.

  • There's certainly a lag between the time that the new consensus is reached (on the hour) and when TorCheck is updated. As stated above, TorDNSEL continues to update its exit list until 20 minutes past the hour. There's still a timing issue to be worked out here and it's possible that TorCheck doesn't have the right IP for up to an hour after a new relay enters the consensus.

  • Bugs in both TorDNSEL and TorCheck are always a posibility.

When users encounter one of these false negatives, should they use a separate "IP check" website like ipchicken.com to check/verify?

It may be better to click on TorButton and create a New Identity, and then hit check.tp.o again.

Why did TBB 3.0 switch to using a local homepage instead of using Tor Check? What are the benefits?

For one, it's not a great idea to have the entire userbase hitting a single website to learn "tor or not" every time they launch their browser. Certainly the website has had scalability issues in the past and will only continue to do so as the userbase grows. More importantly, however, is that it probably isn't wise to rely on a hostile network for confidence that you are in fact using tor properly.

10

Attempting to answer this specific question here, which perhaps will shed some light on the other points: Can somebody explain how the check.tp.o query works, for normal users, so its clear why this happens

The Torproject keeps -- and makes available -- an updated list of all of the relay and bridge nodes that are currently running. So the torcheck app checks what your browser's IP address appears to be. This is the IP address it reports that you appear to be coming from. This IP is checked against the current list of exit nodes and if it finds a match, it reports that you are connected to the Tor network.

False negatives most likely have to do with how we define the word updated, as bolded above. Onionoo, for example, collects this data hourly. Which leaves the possibility of connecting via an exit node that began running after the last list update - simply a lag in reporting and no effect on actual status.

Also some exit nodes might be modifying or otherwise configuring their exit ip address inconsistently with how they are reporting to the network.

  • 1
    Would this mean that someone volunteering as an exit node would always report as "using tor"? – JamesTheAwesomeDude Nov 2 '13 at 14:57
  • 2
    @JamesTheAwesomeDude Yes – Envite Dec 3 '13 at 6:25
0

You most probably happen to have been using an exit node that isn't yet updated on that opening page. If you right click on Vidalia and then choose "New Identity", then refresh the page, it should show green. Telling you that you're using Tor.

I too have experienced that issue from time to time.

I don't want to make it seem like you should be complacent, though. The big scary red text is there for a reason.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.