Is there a less privacy-invasive way to automate checking whether Tor is being used on the machine than this?

Question

I currently make a HTTPS request to: https://check.torproject.org/

I then check if the output contains this anywhere:

Congratulations. This browser is configured to use Tor.

If it does, I return "true" for my function. Otherwise, I return "false". The name of the function is is_tor_being_used().

While this technically works, it seems very "fragile" and also privacy-invasive. Is there no way I can check this without making clearnet requests? And do they really not have a JSON version of that webpage or something? Checking for random text in English, intended for humans, feels fundamentally wrong.

Answer 1

While this technically works, it seems very "fragile" and also privacy-invasive. Is there no way I can check this without making clearnet requests? And do they really not have a JSON version of that webpage or something? Checking for random text in English, intended for humans, feels fundamentally wrong.

It is checking your Tor IP against the know list of exit nodes.

If you don't want a clearnet option, then go to http://expyuzz4wqqyqhjn.onion/

If you want to query the database directly, use https://metrics.torproject.org/rs.html

There is also information on that page on how to use APIs with Tor. Finally, if you have more questions, contact the Tor Project www team. They have an IRC chat and a mailing list https://www.torproject.org/contact/