I understand that asking directly if they've been approached and asked would get a 'No' since these requests probably come with a gag order. So:

Can the Tor Project (or anyone) prove that they haven't been told or made by any gov't (US or otherwise) or gov't agency (3-letter agencies) to put a backdoor(s) into TOR?


The Tor project provides public git records in their repository. So people can pull up who/when the code is written with a few commands. There's also the mailing list that you can read to learn more about why some feature is added. It's also where code review is happening.

To check if they really use the source code to build Tor. Tor supports deterministic builds. Anyone can build Tor with the same compiler as Tor uses and compare the hash of the output. If the build process is configured correctly yet the generated hash is different from the one Tor publishes. Then it indicated the published Tor binary is not built with the same source code. Which may mean the code have been tempered. Security researchers and Linux distributions routinely check for this. Any tiny differ will trigger alarms everywhere. In fact Tor does more than just hashes. All official Tor releases have a signature signed with a GPG key. Only the Tor project have the ability to make the signature (thanks to cryptography). Anyone else can't make a valid one and any modification to the file will cause the verification process to fail.

Also, security researchers all over the world are trying their best to hack Tor. - This is how security research works. If they found any vulnerability in Tor (including vulnerabilities put into Tor by let's say, governments). They notify the Tor project immediately then they publish their finding after (let's say) a year regardless Tor fixes the vulnerability or not. Tor is responsible to patch the issue or else they'll get hit by the vulnerability.

In conclusion. There's a lot of way to check if Tor is valid. From having no backdoors to making sure their binaries are actually built with the source code to confirming your download is not tempted with. And any security researcher will be the first one to scream when something starts to smell fishy.

  • Fantastic & detailed answer. Thank you Mary! I'd upvote this but I don't have the rep points. – theman Jun 16 '20 at 8:32

They prove it by giving you the complete source code for Tor. If you find a backdoor, then report it immediately to the Tor Project and then responsibly report it to the general public.

  • But when the source code is public, it means they already have it and will use it, right?!? Or do you really believe they wont?? – kjvreader Jan 18 '20 at 1:16
  • JSEvans - thanks for the reply. I'm a skeptic of the "It's open source/the code is there to check" claim. Does the TOR project provide an independent list of who has reviewed the full code base as well as proof such as checksum that the download assemblies & executables are compiled from said code posted on their site? – theman Jun 15 '20 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.