I’ve done some past videos explaining how Tor works. What I’d like to focus on today is to explain how to correctly use Tor for your privacy practices as well as understand its limitations. Tor, or the Onion Router, is an anonymizing technology that’s been with us for a while. I would expect that people under surveillance like Edward Snowden would be accessing the internet, primarily using Tor. And Tor itself is connected to some evils as it is being used for buying and selling illicit goods or used for communications by hackers doing ransomware. So this is not the kind of use that we want to discuss here.

But Tor is important for privacy, so you should know how to use this. Tor has some really important features that make it work well for protection of internet traffic. This is especially important in areas where freedoms are often suppressed, but you have to do some tricks to overcome the government blocks, and I’ll tell you how to do that. So I will teach you how to use Tor, but you need to do this right. The basic error is when Tor is not understood, and you may think you’re using Tor, but you’re not.

Or if you don’t understand the different ways you can access Tor, like via Brave Tor Window, Tor Browser, or a Tor Router, like our Brax Router, and the implications of that. Or if you don’t understand its limitations like internet features that will not work on Tor. Or if you don’t know what Tor is versus a VPN, or how to integrate the two. Or you don’t know what SOX 5 is. Or you don’t know that you’re being on Tor is not a secret. Remember that Ross Ulbrich, the founder of the dark website Silk Road, was found by the FBI even when using Tor.

If you want to learn how to utilize this important privacy tool correctly, stay right there. If I had a choice, I would do 100% of my internet browsing on Tor all the time. And this is so easy to do, for example, on Brave, where on the desktop version, you will be able to easily use the New Private Window with Tor as I show here. Now what’s the benefit of this? I’m not going to go into a full explanation of the technology as that hasn’t changed, and you can watch my very old videos on this.

Basically, the anonymizing technique is based on passing you through a random circuit of servers, starting with an entry node, a middle node, and an exit node. This is randomly selected. Because of this, it becomes unfeasible to watch traffic to profile a user, and also the random circuit, which changes at regular intervals, assures a consistent change of IP addresses. So without using extensive resources of a three-letter agency, it would be impractical to trace anyone. I’ll get into how three-letter agencies trace you on Tor later though. For most of us, this could be a substitute for a VPN as it offers the same protection of IP addresses and encryption.

However, because of the way Tor works, there is no knowledge sufficient from any party to identify you on the internet. That’s all you really have to know, so it is superior to a VPN in that sense. However, Tor cannot be used all the time. Why? Number one, it is very slow. By design, Tor servers will limit traffic of each user, so you don’t take a disproportionate use of limited resources. There are roughly only a thousand servers, and there are servers located around the world, and that also adds to the slowness because you could be switching continents to create a circuit of three servers.

The non-obvious consequences of Tor slowness is latency. Due to the three-server circuit and the distance of some servers, some sites may look at latency as an error and assume you have no internet and not wait. Number two, Tor is not a secret. When you use Tor, your IP address will be one of the Tor exit nodes, and unfortunately this is not a secret. Tor exit nodes on purpose are published, and you can see here that if I use a Tor browser and check the IP address on my checker site, it will know it is Tor.

And the effect of this is that many sites will block Tor, and sometimes VPNs too, to force you to use an identifiable IP address. So expect many sites to not work with Tor. My Braxby platform works with Tor, so if you try it now, there will be no difficulty using it. Number three, some things don’t work with Tor. Many of you may not know this, but some internet protocols do not work with Tor. Specifically one that is very common is WebRTC, which is used for video communications like with Zoom. So the best you can do with two-way video is a VPN.

You have to skip Tor. Also services that rely on the UDP protocol, which is the default in voice-over IP services, cannot work over Tor. Another common protocol is Ping. This also uses the UDP protocol. Aside from the limitations I just stated, you can use Tor for internet access to do all other things, assuming you understand the different ways you access Tor. Again, the main advantage of Tor is just like a VPN. The traffic is encrypted from your ISP and your network. All you have to really do is to install a Tor browser from torproject.org.

Or even easier, just use Brave and open a Tor private window that’s already built in. And you can see here what the actual speed is of using Tor to access the Braxby website. It’s not fast, but usable. Here’s an example of me accessing the Braxby site using the Tor browser. The Tor browser is a dedicated browser built from Firefox, so it is directly tied to all the features of Firefox. This may be considered a good thing or a bad thing, depending on your opinion of Firefox lately, but let’s consider the differences between these browsing methods.

First, when you access the internet using Brave browser with the Tor private window, you are basically just using a standard Brave session, albeit with a Tor internet connection. In other words, Brave doesn’t do anything special to your browsing session to anonymize the browser itself from digital fingerprinting, which I discussed in a recent video. However, Brave does do some things to minimize browser fingerprinting. So there’s a higher chance of someone discovering that you’re the same party by virtue of your browser fingerprint, even though your IP address may be different. Now don’t panic here as this is just a short-term identifier.

People say that in contrast, the Tor browser builds in some modifications on Firefox itself, which is intended to hide digital fingerprint information like changing time zones and so on. I’m going to test this right now to show it to you. I’m going to use my fingerprint test site Braxmegeo and will show the fingerprint after multiple visits using Brave. And then multiple visits using the Tor browser. I didn’t but again this depends on what attributes are used for fingerprinting. But in real life testing, depending on your fingerprinting approach, I found that even a Tor browser can be fingerprinted in the short term.

Unfortunately, and this is not understood by beginners, is that using Tor on the browser only protects some browser traffic. Just to give you the caveats, it doesn’t protect your email from your email client. It doesn’t protect you from any apps operating outside the browser. So let’s use a specific example. You’re using an email client like Thunderbird and you’re accessing your email service. But if you don’t realize that unless you’re on an email service like Braxmail, that your IP address is being revealed on the header of your email message. Using a Tor browser of some sort doesn’t help here because a Tor browser only protects browsing.

In order to protect your entire internet connection, you need to encapsulate the entire internet traffic into a single tunnel. This is what VPNs do. So if you have a VPN, you can turn that on and it will do that. But if you protect your entire internet traffic by routing everything through Tor, the best way is to use a Tor router. We have such a device, by the way, that it’s called Brax router. Brax router can run in VPN mode, which requires a VPN subscription, or it can run in Tor mode, which does not require a subscription.

Then if you arrange your network, so you go through the Brax router, then you will go through the Tor network. This is the most secure installation, by the way, because there is nothing between you and the Tor network, but the router that is on your site. There are other ways to do this, but this is flawless. One thing to understand, connecting via Tor is useless if you’re logged in with a Google ID. The same threat for fingerprinting and tracking with a Google ID apply with or without Tor. The alternate way to get full SOX 5 internet traffic protection is to use Tor with a Linux distro like Tails, Honex, or Cubes.

By default, these distros use the internet only through Tor. The neat thing about having a distro with Tor is that you can attain Tor use simply by installing these in a virtual machine. For example, you can use VirtualBox in Windows and then run Honex as a virtual machine. When you’re using Honex, your internet traffic will be tunneled through Tor. Of these options, I find that Honex is the most usable because at least it has data persistence. A distro like Tails is made to erase your data every time you start it. So that is a specific high security use case.

On mobile, there are no specific Tor browsers supported by torproject.org. However, on Android, you can use the app called Orbot, which is officially endorsed by Tor project and is open source. There is no reliable equivalent that I’ve found for iOS, so I’d better just use a Tor router for an iPhone. So which is better, VPN or Tor? Tor is better, but Tor is impractical for everyday use. We can’t waste time with slow internet access, so unless you’re Snowden, you don’t need to use Tor all the time. Why is Tor better? Because there are three servers in an encryption circuit, which means none of the three servers know the complete picture of IP addresses, so it is based on a trustless system.

In contrast, a VPN requires trust in the VPN provider, since if the VPN provider logs the users, there could be a log of both incoming and outgoing traffic. So if there’s some crooked VPN provider, then you may think you’re being protected, but someone could just be harvesting your information for some surveillance operation. You can’t do that on Tor, so that makes it immune from such an attack. The main issue with everyday use of Tor is that many sites block Tor, so it makes it really just a specially used feature. In contrast, I’m on bytes VPN 24 seven, and it is rare that I experienced any blocks from the VPN.

Have you ever seen the list of Tor servers? I told you it’s public. So here’s the current list. We need to address what happens when you combine a VPN and Tor. The idea is that you hide your identity from the entry node by using the VPN. This way, if the entry node is owned by a three letter agency, then you have some additional layer of obfuscation. You can do this if you want, but you add even more slowness. The question though is what you actually exit on. Do you exit on a VPN server? And thus you can cancel Tor or do you exit on a Tor exit node? Just to be sure I’ve tested on a locally installed open VPN, a Brax router, and then on Hunix.

And regardless of the VPN tunnel, it looks like all of them exit through Tor. So that’s good to know. Since Tor servers are publicly listed, then it is pretty easy for governments, companies, ISPs and data centers to block access to Tor. If you can’t access the first leg to the Tor entry node, then you can’t use Tor. I’m sure in any country without freedoms of communication, that Tor would be blocked. The solution that the Tor project came up with long ago is the idea of a bridge server. Bridges are volunteer servers that relay to the Tor circuits instead of a direct connection.

Anyone can make a bridge server. So this means that that itself is never published. So the bridge remains anonymous. I did something indirectly similar to a bridge. I set up one of my VPN servers as a VPN service that connected directly to Tor. This would then make you appear to be using a VPN, but the actual exit is Tor. I call this byte store. But unfortunately, AWS and Akamai Linode appear to be blocking Tor entry node servers, so they don’t want Tor servers on their data centers. So until I find a willing data center, I cannot do this anymore.

In the meantime, I will teach you how to use a bridge. It’s simple actually, and I will show you this on a Brave browser. First on your desktop Brave browser, go to settings under privacy and security and scroll down to Tor windows. Click on the box that says use bridges. You can request a bridge from Tor project, which I will try here. And after the caption, it’ll wait will give you the bridges. You could also in theory set up your own bridge elsewhere, or a community could make a bridge. And then this would be a private link to Tor that no one else would know about.

And that is entered in this provide a bridge prompt. Now here’s a danger that most people don’t know about. If you’re using two way video communication, similar to zoom or FaceTime, you cannot use Tor for that. In fact, you may think that you’re on Tor, but you’re not Tor browsers handle traffic on port 443 and port 80, meaning HTTPS or HTTP traffic. WebRTC uses completely different ports with the RTP protocol. WebRTC is a peer to peer communication system. It means the IP address of both parties must be known to both sides, or communications cannot occur.

Where there’s a block in the middle, due to network limitations like NAT or VPN, a middle server called a stun server is placed in between and the two servers can connect to the stun server. And then that can handle the traffic between them. So the IP addresses are leaked to the stun server. Since you can use Tor for WebRTC or video chats, you have to use a VPN. Some apps like Signal will encapsulate the WebRTC in an encrypted channel like a VPN, but most will not do that. So beware. As I mentioned earlier, Ross Ulbrich, the founder of Silk Road was found and proved to be the owner of that dark website.

And he was found even though he was using Tor. So this became a major point in showing to people that Tor was flawed, because someone could be caught even when using Tor and many others have been arrested or run dark websites on Tor. A dark website or a site with a dot onion extension can be found only on Tor. And because Tor doesn’t reveal any identifiers, it is difficult to prove where the actual dark web server is located. The only way they could connect Ulbrich to the dark website was to observe what he posted to the site, and then isolating the internet traffic by region until a specific traffic signal was seen at the same time.

Of course, such a project is pretty hard to do unless you can see the entire internet, and only the governments can do that. And it helps when there are already suspects so the government doesn’t have to scour the world. Thus, after multiple verifications, it was discovered that a matching internet traffic signal would emanate from Ulbrich’s location at the matching time when a public post appeared by him and this then led to the location of the server and Ulbrich himself. So using this resource intensive method, they were able to do this attack which is called the timing attack.

While this approach has been effective, it should be understood that this is an out of channel solution, meaning nothing here broke encryption on Tor or the privacy of IP addresses. In fact, in theory, someone could get around this timing attack by putting delays on the server displaying any new information publicly. The FBI already had insiders work on various aspects of Silk Road itself, so they only needed the timing attack to prove his identity in court because apparently the timed post was linked to his email address with a real name. So all in all, Tor’s integrity remains intact, but be aware that many Tor servers are themselves servers of three-letter agencies.

The interesting fact is that I’m certain that intelligence operatives around the world likely use Tor to communicate secretly since it is still the most secret means of communication through the internet. There are other anonymizing overlays on the internet that use onion routing similar to Tor. One is LokiNet, which is used in the Session Messenger app. Another one that is not as popular as Tor is the P2P network. It was intended for communication inside P2P itself and not intended to access the open internet. Now with the addition of the Tor Private Window on Brave, Tor is very accessible to all without much effort.

Brave happens to be my favorite browser, so this is really convenient to have. You can mix Tor and VPN sessions together in one browser. Folks, as many of you know, we rely on your community support to financially fund this channel. We do not take sponsors. And thank you to those who support us on Patreon, Locals, and YouTube memberships. Mostly we rely on your use of our services and products for support. Our newest product is the Brax III fund, which is a community project involving several other OS makers. This fund could be released by the time this video is available.

It is available on indiegogo.com and on the BraxTech.net site. We also have BitesVPN, which will hide your IP addresses but through a trusted provider. Instead of some unknown large corporation, I can personally offer you a trusted product. We have the Brax Virtual Phone, which gives you KYC-free phone numbers. We have BraxMail that allows unlimited aliases and privacy modifications to eliminate metadata. All these and other products are on our store on Brax May. Join us there and interact with the over 100,000 users who talk about privacy issues daily. Thank you for watching and see you next time.

See more of Rob Braxman Tech on their Public Channel and the MPN Rob Braxman Tech channel.