Subgraph provides a third party implementation of Tor called 'Orchid'. Since this is not part of the official Tor Project, how do we know that it can be trusted ?

  • You could always de-compile the libraries yourself to check and see if they are safe or better yet email the project Orchid people and ask for a source if isn't already available on the site. – Nathan Easton Jul 5 '14 at 0:25
  • What makes you think the official Tor Project can be trusted? What makes Subgraph seem less trustworthy? – ruief Jul 22 '14 at 3:52
  • The i2p implementation works as an add-on to i2p on some systems. I haven't check it against the Subgraph download to see the difference. Have IPTraf open and see what is going on. – Not Available Jun 6 '17 at 4:04

The reasons for trusting (or not trusting) Orchid are the same as with Tor proper: Orchid is open source, so you (or anybody else) can audit/examine/analyze the source code.

One concern I would have with Orchid at the moment is that it doesn't seem to be a very active project. There are a bunch of bug reports/pull requests on the github site which haven't received responses, and there generally doesn't seem to be much development activity. It also has far fewer users than the main Tor implementation.


I would comment on Nathan's post, but I don't have enough rep. He's completely right. They offer the link to their Source Code in their download's section, along with a link to their Git Repo - https://github.com/subgraph/Orchid

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.