0

I currently make a HTTPS request to: https://check.torproject.org/

I then check if the output contains this anywhere:

Congratulations. This browser is configured to use Tor.

If it does, I return "true" for my function. Otherwise, I return "false". The name of the function is is_tor_being_used().

While this technically works, it seems very "fragile" and also privacy-invasive. Is there no way I can check this without making clearnet requests? And do they really not have a JSON version of that webpage or something? Checking for random text in English, intended for humans, feels fundamentally wrong.

1 Answer 1

0

While this technically works, it seems very "fragile" and also privacy-invasive. Is there no way I can check this without making clearnet requests? And do they really not have a JSON version of that webpage or something? Checking for random text in English, intended for humans, feels fundamentally wrong.

It is checking your Tor IP against the know list of exit nodes.

If you don't want a clearnet option, then go to http://expyuzz4wqqyqhjn.onion/

If you want to query the database directly, use https://metrics.torproject.org/rs.html

There is also information on that page on how to use APIs with Tor. Finally, if you have more questions, contact the Tor Project www team. They have an IRC chat and a mailing list https://www.torproject.org/contact/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .