Is this the most current way of setting up TOR on Android?

Question

I am in the process of getting TOR browser installed & setup on an LG Android phone. Here is what I've done so far...

I was first using Orbot & Inbrowser, but for various reasons I have decided to go with the full fledged TOR setup.

After reading ~6 articles and ~3 videos, to see what my options are currently, I have come to the following conclusions. Please correct me if I'm wrong...

A video titled 'How to use TOR browser Part1 (by the HatedOne / 11:45) seems to be the current way to setup & install TOR on an Android. I say this because the video content agrees so far with what little I have seen & done. The notes that I have taken on the video are below:

When opening & setting up the TOR browser for the first time, select as many default settings as possible (~everything except maybe Javascript).

To remain reasonably anonymous, javascript MUST be disabled. Do this by changing the security level to 'safer' or 'safest' mode. It's HIGHLY recommended not to change any other settings (~3:10-~3:20). The 'No script' extension allows you to manually configure which scripts can run, and which are blocked (~4:00).

The 'brush' icon (top-right screen) saves Js settings VS closing the browser entirely, which does not save previous settings.

(~5:30+) Set HTTPS EVERYWHERE to 'block all unencrypted connections. Then later, trusted connections can be unblocked manually.

(~6:15+) The TOR circuit button. Click on the 'lock' icon in the URL bar, to display the relays in your circuit. Sometimes your circuit may be too slow, or you may want to change your exit node. This can sometimes solve the problem of your page being in a foreign language of the exit node that you're using.

TOR is just a tool. It can be very secure, but if good OpSec rules are not heeded, your anonymity can become very easily conspicuous.  Here're some things to keep in mind (~7:15)...

0. Do NOT use personal accounts that are associated with your real identity. The more general rule is not to use accounts on TOR at all, because accounts are data points that can create links over a long enough period of time. However, you can have anonymous accounts that do NOT link to anything in your real life. Overall, this means no real: phone numbers, names or initials, or links to your real IP address.  And if you use a pseudonym on TOR, and then mention it outside of the TOR network, you ARE compromised (7:45).

1. Do NOT change TOR settings. No addons or plugins (They can track you). No full screen resolution (this can ID your device).Any customizations are sketchy (They make you stand out from the crowd & ID you). Only advanced security settings can be changed, IF you know your shit.  (8:00).

2. Do NOT dicuss personal info. Hobbies, location, profession, pet names, photos, screenshots, opinions & activities, career, qualifications, background, aquaintances, configuration logs, hardware, software, devices (ie- routers, IoT) (8:35)...

3. Use end to end encryption. TOR is good, but not magic. TOR only encrypts data between relays. Exit nodes can collect unencrypted data, just like anyone else. If the URL lock (address bar) is green, you're good. If it's red, you're screwed. Also make sure you can trust or verify that the encryption on the server itself has not been compromised (9:20).

4. Know your shit about surveillance capabilities. IE- a script on your phone can continuously emit inaudible sounds that can be picked up by a computer's mic. If a website runs a script like that, it can link your browser session to your phone's ID. If you run 2 such scripts, 1 over TOR & the other over clear net, then your anonymous session can be linked to your real identity.

If you watch an iPhone review video on TOR via the youtube app, and then turnaround & use  Google (via clearnet) to search that specific product, those 2 activities can almost certainly be linked to your identity. Google-like trackers can do all sorts of nasty tricks to find your true identity. So, comparmentalize what you do, & whos services you use. If you make 2 connections (1 anon & 1 non-anon) to a server at the same time, you're screwed. To avoid these pitfalls, it's best not to do anything else when using TOR.

5. Mitigate system vulnerabilities. TOR is only as strong as its weakest link. TOR cannot protect you on a compromised hardware or OS (10:45). If there is malware with root privilages on your phone or laptop, then no tool can save you (11:00).

There are my notes from the video. As of now, I have downloaded TOR from the Google Play Store. But I have not used it yet, because I want to find a more definitive answer before I take the plunge. There are still ~ 6-12 videos that I want to watch, but I halted any more research & decided to start asking after my findings started becoming inconsistent & a bit confusing. See, I started watching videos first. That's when I seen the one mentioned above (TheHatedOne). But after reading the last several articles about setting up TOR, I started to wonder if I might be heading in the wrong direction. I was of the impression that I just need to install the browser from the Play Store & then run & configure it a little. But some writings say that I should get an Orbot & Orfox combo & install TOR that way. It wasn't until after about the 3rd artical mentioned the Orbot & Orfox combo that I started to notice that those articles seemed dated & maybe obsolete. Another article even mentioned Orwall. So, I am just wanting to narrow down my choices before I continue. Which method should I opt for?

Answer 1

Currently, there is only two official methods of using Tor on Android:

• If you only need the Tor Browser, you can download the release version of it (F-Droid) or the alpha version of it (F-Droid) for Android.
• If you need to use tor outside of Tor Browser, you can use Orbot (F-Droid) VPN mode (promiscuous mode for root users have been discontinued a long time ago and for a good reason). If you want, you can pass all of your apps through the vpn or only the specific ones.

As for what you said in your question:

So, comparmentalize what you do, & whos services you use. If you make 2 connections (1 anon & 1 non-anon) to a server at the same time, you're screwed. To avoid these pitfalls, it's best not to do anything else when using TOR.

True, but sadly, there isn't anything like Tails for Android smartphones. But, if you have enough free time, you can setup an application like AFWall that can deny internet access to certain apps over certain connections.

It wasn't until after about the 3rd artical mentioned the Orbot & Orfox combo that I started to notice that those articles seemed dated & maybe obsolete. Another article even mentioned Orwall. So, I am just wanting to narrow down my choices before I continue.

Orfox is the old name of Tor Browser on Android. Also Orwall's last source code change was at Jul 30, 2016, so it's safe to say it was deprecated and shouldn't be used. Currently Orbot can do everything Orwall can do and much more, so there isn't a reason not to use it.

Which method should I opt for?

Using Tor Browser is the way to go if you only need to browse the web. If you need to proxy other applications on your Android, you need to use Orbot. If you have some exotic application that can't be interfaced with Orbot easily, you can still use Orbot's SOCKS5 proxy (usually available at 127.0.0.1:9050, just like the regular tor for pc).
Any other application is probably deprecated by now and if not, should be used under extreme caution (as you said, "Tor is only as strong as its weakest link", so if you install some malware on your device, nothing can save you).

P.S. the links to F-Droid apps lead to a 404 page on regular browsers, make sure to open those links on mobile with f-droid installed and Guardian Project repositories enabled.