One of my friends keeps telling me that it's useless to use Tor on Windows, as Windows is full of key-loggers, Trojans and other malware, and if they want to identify me it will be easy because of Windows, unlike Linux .
Is this true? If so why?
"...Windows is full of key-loggers, Trojans and..."
is a bit overblown.
In general, the chances of a Windows box being infected with malware are higher than a Linux box. Mainly because Windows is a very popular target.
Since Windows is closed source, as opposed to Linux which is open source, you (the user/consumer) can not tell what key-logging, screen-snooping, home-calling stuff is in there 'by design', even if you keep it clean from (3d party) malware.
Windows code is scrutinized by Microsoft, (whose main concern is shareholder value?). Linux code is scrutinized by many internet strangers (whose main concern is running a stable / secure OS?).
Would you run Tor if it were closed source?
Having said that.. ..using Tor on Windows is still less dangerous than using IE6 on Windows. ;-)
The recent shellshock vulnerability shows that no operating system is truly safe. Out of the box, they can all be infected or exploited. With a well thought out and implemented security policy, they can all be made reasonably safe. Currently available tools can make any operating system very resistant to malware, if the user has the skill to configure them and the discipline to stay within their security policy.
One the biggest issue with Windows is the extensive usage records it stores of your activities. The newer the version of Windows is, the more user data it stores, and the harder it is to disable and eliminate those usage tracks. I won''t go so far as to call Windows a trojan. That said, applications that behave like current versions of Windows are labelled as spyware.
Aside from the concerns expressed by Jobiwan and Herbalist, there is generally an association between the Windows product key and the user's identity. We know that activation and Windows Genuine Advantage testing require valid product keys. And so it's arguable that an adversary could identify users with cooperation from Microsoft, OEMs and retailers.
Let us start with that Linux has tcp/ip while Windows uses XNS with NETBIOS - Microsoft has just made Windows to work with the Internet they way they want to interface. There is none of the tcp/ip security.
It is not related to open vs closed source code, it is related to the Internet security that is in tcp/ip and never has been on Windows. Stop this "they have done it their way": MS has never tried to implement any security. Your connections stays open, are not taken down. Your connections are not point-to-point, they are shared between "applications". You can write, (well in C/C++) code that can intercept everything on your system, and leave nothing private. Be my guest, shower in public, others do it all the time. Just understand, it is in public display. "I will try to shelter my Internet activity with a TOR browser" - be my guest, shower with niqab!