4

I am a complete newbie, just started using Tor. I was reading an article on the internet about how to maintain as much anonymity as possible while using Tor, and it said: "Don’t use Tor Browser Bundle"! Moreover, the article stated that some guy who was running some popular hidden server was arrested because physical location of his server was found because he used the Tor browser bundle.

Is there any other Tor as opposed to Tor Browser Bundle? I downloaded Tor from the only choice I had on the official web site and it seems to be the so called browser bundle. So where do I get the Tor that is not the browser bundle, or did the article refer to stand alone version?

5

I would be skeptical of the article you read. The TOR browser bundle is safe in most instances. The admonishment to not use Windows if possible is a good one, but unless you are doing some really bad stuff, it probably is "safe enough" (Linux is always preferable though).

In years past, the TOR browser bundle lacked certain security patches in Firefox that could have been exploited to uncover the identities of people using it, but A) it was likely only three-letter-agencies (e.g. the NSA) were doing that on any meaningful scale and B) current versions of the software purposefully try to keep up with security patches to minimize the amount of time a certain browser version might be vulnerable. That said, I never read anything to make me believe the Freedom Hosting takedown was due to the TBB. That was almost certainly other stuff.

Regarding a "standalone" version of TOR, they were likely referring to the Windows Expert Bundle. (As an update, since the article says they don't like Windows, they apparently mean "Use some version of TOR, just not the prepackaged TBB which includes Firefox.")

It is possible to setup TOR manually to work with a browser of your choice but it is a decidedly technical pursuit for many average users. And unless you genuinely know what you are doing, it is likely easier to misconfigure the "standalone" version which may leak details about you and your session. What the TOR browser bundle does is package a version of TOR with a pre-configured version of Firefox, both of which install easily for most users and are generally secure.

But...

The only genuine caveat concerning the TOR browser bundle is that current versions have a few features left on by default which should really be turned off for anonymity. The reason these features are left on is because certain "regular" websites will "break" (not work correctly) without them.

However, it is entirely possible to "switch off" these features (which generally aren't needed for sites on the TOR network, which exclude the need for these features purposefully to help anonymity). But unless you are looking for them, it is possible to leave them on and expose yourself.

  • Click the TOR Green Onion Icon on the toolbar and under "Privacy and Security Settings" select Medium-High to High on the slider (the higher the better).

  • Make sure the "NoScript" icon next to TOR Green Onion Icon is set to disallow scripts. NoScript has a lot of extra options, and you may wish to investigate them further but generally turning off scripts is pretty safe.

  • Right-click the upper portion of the browser and enable the "Menu". Under Tools -> Options -> Privacy, select "History" and set it to "Use custom settings for history". Make sure "Always use private browsing mode" is enabled, and uncheck "Accept cookies from sites".

  • As a matter of course, I would also uncheck all three options for the "Location Bar" in the same Privacy as menu above (History, Bookmarks and Open Tabs). You likely don't want to keep a history of what you type in the address bar if you really care about privacy.

After adjusting these settings, I would check JonDoNym's IP Check and EFF's Panopticlic. And remember to recheck these settings periodically, especially after upgrading.

If you are really privacy minded, you should consider The Amnesiac Incognito Live System (TAILS), which is a Linux Live CD which offers excellent security for TOR browsing. I would not recommend it in a virtual machine, however. (The best use of the Live CD is on a PC without a hard disc at all in my opinion.)

Reference Article Originally Cited: http://www.hongkiat.com/blog/do-donts-tor-network/

  • Thank you Anaksunaman. I appreciate your post, it is very in-depth. I get it, but I was mind boggled because the article stated that we should use Tor but not Tor Browser Bundle. – sivistojko Oct 28 '15 at 9:26
  • Your welcome. Stay safe. =) – Anaksunaman Oct 28 '15 at 9:33
  • 1
    @sivistojko Just to make it very clear, Tor Browser Bundle is more secure than running Firefox through Tor, as TBB has patches to "harden" Firefox. – Cammy_the_block Oct 30 '15 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.