11

When I go to https://www.torproject.org/download/download.html to download the Tor Browser for Windows, how can I be sure that the package I'm downloading is genuine, and hasn't been tampered with?

What are all the things that I'll need to download to safely verify Tor? Once I've downloaded those things, what are the steps that I need to take to verify everything, and what will let me know that I've done the verification right? Are there any other steps that I can take to make extra certain that nothing has been tampered with? Finally: once I've downloaded everything and verified it once, will things be any easier or have fewer steps when I go to update my Tor Browser?

7

All the downloads are "signed". This means that someone (in this case Erinn, a Tor Project Developer) vouches that the software is good and hasn't been tampered with.

You can verify the download by also downloading the signature file, and using GPG to check that the signature is valid for the downloaded file, and that they were signed by Erinn.

More detailed instructions can be found https://www.torproject.org/docs/verifying-signatures.html.en

The question of how you can trust the signature is in two parts. Firstly Erinn's key has been signed by many people who claim to know Erinn. You could also go to a real-world event where Tor Developers are present, and ask them to verify that your copy of Erinn's key is legitimate. Many of the Tor Developers have signed Erinn's key with theirs, so having them confirm their own keys for you will help you build a web of trust. Secondly the Tor Website serves downloads over HTTPS, preventing modification in transit, unless you are being actively attacked by someone with the power to get illegitimate SSL Certificates issued.

Once you have the Tor Browser Bundle, updating should use the same process of verifying signatures. Whether you download the update over Tor or not is up to you, but verify everything.

In addition, there are things called "Reproducible Builds" that are being worked on, and eventually you'll be able to create your own version of the Tor Browser Bundle from scratch, and be able to verify that it matches the version that everyone else has obtained. Further details on that can be found in this blog post https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.