5

When you download Tor or the Browser Bundles directly from Tor Project Download Page you can find a link called (sig) this is the asc file you need for verifying the downloaded packages.


5

If you're using your distro's binaries to install Tor then you have to trust the package maintainer of your distro as you do with every other package of your operating system. If you don't trust maintainers and/or developers of your distro then I guess there is a bigger problem since that means you can't trust the operating system in which you run Tor. Mind ...


4

This message comes from GnuPG. It tells you that you have not related some kind of trusted relationship to the key of Erinn Clark. When you meet her one day and you do a keysigning (compare your keys and your identities), you can sign her key. Now your GnuPG treats the key as known and trusted and the warning disappears. Furthermore maybe you took part in ...


4

The signature is not bundled with the archive; it can be found on the Tor Project website in the same place as the download (just append .asc to the end of the archive's path or look for the sig link under the download link). See here for a full list of TBB 3.5 archives and signatures.


4

Some applications can either leak sensitive information through the Tor channel or they can make communication outside of the Tor channel which could lead to identification of your computer in the Tor network. Correct. Is there a list of applications which are known for such leaks? The most central place is the TorifyHOWTO in The Tor Project's wiki. ...


4

Whilst not as certain as verifying downloads by MD5 hash/checksum, an alternative would be to download the same files multiple times using "New Identity" in Torbutton (or "Use New Identity" in Vidalia). The chances of randomly picking a bad exit that would tamper with your particular download and which hasn't been flagged yet is already fairly low. The ...


4

Facebook allows neither anonymous nor pseudonymous accounts. That means you can't sign into Facebook as a guest, nor can you use a name that isn't your real name. It then follows that when you visit Facebook, either on the clearnet or via Tor, you have to sign in with your own credentials. If you're signing in with your own credentials, then Facebook has to ...


3

Two things: This isn't the correct installation method for you to follow. These instructions are for people who are already familiar with basic usage of OpenPGP You're not following the instructions at all. If you are doing the verification for the first time, download the Tails signing key and import it in your keyring. If you are working from ...


3

The site you download from probably lists MD5 sums for the files they offer. So you can use that to verify the integrity of your downloads. Of course the exit node could have tampered with that too, so to double check, you can google the MD5 sum and see if it comes up with the right file. At this point you should also decide who you (dis)trust more: the ...


2

As you asked for every possible way of tampering, the list is going to be kinda long, but let's start anyway. The package maintainer adds strange patches... ...or uses a weird build system. I would say this kind of tampering happens all the time a package is being built (or prepared in case of a source distribution!) for you by a third party. However this ...


2

The digital signature of the archive is verified, and that it matches the excepted Erinn Clark's public key she used to sign this document. For the question of the trust, you may refer to: http://gnupg.org/gph/en/manual/x334.html For the two space in the fingerprint, this is just a conventional format.


2

You can either move the files to your Desktop and re-run the commands, or change the word "Desktop" to "Download" in the command you executed, like this: gpg --verify ~/Desktop/tor-browser-linux64-4.0.4_en-US.tar.xz{.asc*,}


2

Check out the Tor Project's signing keys page for more info. If you followed that tutorial exactly, then you imported a single developer's signing key, but this is not the key used to sign the browser releases. The output you supplied shows that the actual signing key is EB774491D9FF06E2, which shows up on the Tor PGP keys page. To properly verify, import ...


1

simply use the below command this helped me curl -s https://openpgpkey.torproject.org/.well-known/openpgpkey/torproject.org/hu/kounek7zrdx745qydx6p59t9mqjpuhdf |gpg --import -


1

The error "unknown pubkey algorithm" is a consequence of (a) the fact that on my machine, the gpg command defaults to using gpg1, (b) gpg1 does not support the use of elliptic-curve cryptographic algorithms, and finally, (c) the Tails version I was trying to verify was signed using an elliptic-curve algorithm. For a discussion about the history of gpg, see ...


1

This is due to an outdated key. This solution fixed the issue for me: gpg --homedir "$HOME/.local/share/torbrowser/gnupg_homedir/" --refresh-keys --keyserver pgp.mit.edu


1

You can also get the "No public key" error if you have imported an old version of the Tails signing key. gpg --check-sigs A490D0F4D311A4153E2BB7CADBB802B258ACD84F pub 4096R/58ACD84F 2015-01-18 [expired: 2017-01-11] uid [ expired] Tails developers (offline long-term identity key) <tails@boum.org> sig!3 58ACD84F 2015-01-18 Tails ...


1

The description behind the link you provided is a bit unclear. The command needs to look like this (all on the same line): "D:\Installed Applications\Gnu\GnuPg\gpg.exe" --verify C:\Users\MyUsername\Desktop\torbrowser-install-6.5.1_en-US.exe.asc C:\Users\MyUsername\Desktop\torbrowser-install-6.5.1_en-US.exe


1

You better avoid this kind of running: when I helped people I saw a fake Tor Browser distributions: tor.exe binary was replaced with some malicious program that even tried to mimic original program's behaviour and even log output! So - do yourself a favour - check the signature. it is simple. Need help with signature checking?


1

#19494 (Invalid SHA256 on version 6.0.1 et 6.0.2) The sha256sums-unsigned-build.txt file contains the hashes of the bundles before they are signed. For the Windows bundles, you can use osslsigncode to remove the signature. It is available in this git repository: http://git.code.sf.net/p/osslsigncode/osslsigncode/ Then you can do: $ sha256sum ...


1

Tor is just a transport layer. It helps you to avoid illegal censorship attempts. It's defenately not an anonymizer - and even more, phone activation is good for privacy protection


1

You're not doing anything wrong. But here is an explanation of your output and a way to get some level of further verification by showing that the old key has actually signed the key you downloaded. The command you typed in gpg --check-sigs A490D0F4D311A4153E2BB7CADBB802B258ACD84F checks the tails signing key's signatures and it prints the signatures that ...


1

This link to the Tor Browser design document contains the following description of how the Tor developers have ensured the updates from the updater cannot be tampered with. 5.4. Update Safety We make use of the Firefox updater in order to provide automatic updates to users. We make use of certificate pinning to ensure that update checks cannot be tampered ...


1

It means that you never signed the key that was used to sign the Tor Browser Bundle. You should only sign keys of people that you have verified the identity of (usually by looking at the person's government issued ID when meeting the person in "real life", though people have their own criteria for identification). The message is warning you that you should ...


1

It turns out I had failed to trust/certify that signing key. Once I did that, I received a "green" result. This Reddit post highlights the solution quite thoroughly: https://www.reddit.com/r/tails/comments/30d24r/problem_verifying_tails_131/


1

As it has been some time since I have had any experience with this sort of thing, it is unclear what exactly you mean by "certificate spoofing". However, from my understanding of MITM attacks, the implementation of the more secure HSTS protocol used by Google et al. mitigates against many of the attacks using methods such as sslstrip. I'm not sure if banks ...


1

Go to the Tor Browser Bundle download page. Select the correct download, and download! Below the nice, purple button should be a link that says sig. Don't left click but instead right click it. Then select Save Link As in the context menu. (In Firefox, I don't know in the rest, sorry. In Safari I believe you Alt click the link.) Once downloaded verify as ...


1

You have to download the .asc file yourself. Click the "(sig)" part under the purple download button, left of the language selector: https://www.torproject.org/download/download-easy.html.en EDIT: I had problems with using the full path to GnuPG as well, go to the folder first: cd C:\Program Files (x86)\Gnu\GnuPg (This is for 64 bit windows, for 32 bit ...


1

You're probably missing the keys for verifying the signature. Check this page on how to do the verification process.


Only top voted, non community-wiki answers of a minimum length are eligible