~/anywhere $ torsocks curl ifconfig.me // not your address. that's the point.
TOR
the onion router · the envelope inside the envelope inside the envelope
[01] THE ONION
Every packet you send has a return address. Tor is the network that taught packets to lie about where they came from, politely, with math.
Here's the trick. Your client picks three volunteer relays (a guard, a middle, an exit) and wraps your traffic in three layers of encryption, one per relay, like nested envelopes. The guard peels the outer layer and learns only who you are and who's next. The middle peels its layer and learns nothing but "a relay talked to me, I talk to a relay." The exit peels the last layer and sees the destination, but has no idea who asked. Who you are and what you do are never known by the same machine.
That's the whole secret: not one heroic cipher but a supply chain of ignorance, distributed across thousands of volunteers in different countries under different laws who'd all have to conspire at once to unmask you. The dragnet works by standing in the middle of the wire. Tor makes the middle of the wire useless.
// network file
| born | 1995, US naval research lab. onion routing, for spies who needed a crowd |
| released | 2002, code open-sourced. a spy network only works if everyone can join it |
| steward | the tor project, 501(c)(3) nonprofit, since 2006 |
| relays | ~8000, run by volunteers, no company to subpoena |
| daily users | millions: journalists, dissidents, cops, and people who just closed the door |
| the irony | funded in part by the US government, fought in court by the US government |
// the navy built it, then needed strangers in it. anonymity loves company.
$ tor --narrate [+] wrapping request in 3 layers of encryption [✓] guard (germany) peels layer 1: knows you, not your destination [✓] middle (iceland) peels layer 2: knows two relays, nothing else [✓] exit (netherlands) peels layer 3: knows your destination, not you // no single relay, ISP, or agency sees both ends. // to follow the packet, they'd need all three countries to cooperate // in real time. the paperwork alone is your friend.
[02] THE USERS
Every serious newsroom runs SecureDrop, and SecureDrop runs on Tor. The source who proved the dragnet was real needed exactly this: a way to reach a reporter without the metadata writing the indictment first.
In countries where the wrong search is a sentence, Tor is the difference between reading the news and being the news. Bridges and pluggable transports exist because some governments firewall the truth at the border.
Law enforcement uses Tor to watch criminals without tipping them off. Militaries use it for operational security. The original use case was intelligence officers phoning home. The "Tor is for criminals" crowd should tell the FBI.
The abuse victim hiding from a stalker. The patient googling a diagnosis. The employee reading a union page. Privacy isn't suspicious. It's the sealed envelope, and Tor is the post office that doesn't keep a ledger of who wrote whom.
Criminals have better options. They steal grandma's wifi and buy botnets. Studies put illicit traffic at a fraction of the network; meanwhile the BBC, the NYT, and Facebook all run official onion services. Roads carry getaway cars; we keep the roads.
Backwards. Anonymity is a crowd, and every ordinary person in the crowd makes it safer for the person whose life depends on it. Running Tor for your lunch break browsing is privacy philanthropy: cover traffic donated to someone braver than you.
[03] THE WAR
The strongest endorsement Tor ever got was written by the NSA, classified top secret, and never meant for you.
Among the 2013 disclosures was an internal NSA presentation titled, in actual government typeface, "Tor Stinks." Its conclusion: "We will never be able to de-anonymize all Tor users all the time." With manual analysis they could unmask "a very small fraction," and never reliably a user they actually wanted. A sister document called Tor "the king of high-secure, low-latency internet anonymity" with "no contenders for the throne in waiting." The agency with the biggest budget in surveillance history audited the free software run by volunteers and filed a complaint.
So the attacks moved to the edges, which is the lesson worth keeping: they exploit the browser, not the protocol: old Firefox bugs, malware on seized onion services, correlation attacks needing both ends of the wire, and the eternal classic, a user logging into their personal email over Tor. The math holds. The manifesto said code would hold; the NSA's own slides agreed, under classification.
// when the adversary's internal review is your testimonial, frame it.
[04] RUN IT
One download, no configuration, looks like Firefox because it is. torproject.org ⇗. Verify the signature, click through, you're in the crowd. Don't resize the window, don't log into your real accounts, don't install extensions.
Use it for anything that isn't tied to your name anyway: reading, research, news. Slower? A little. Three continents per click costs something. You're not buying speed, you're buying the absence of a ledger.
Relays are run by volunteers; bandwidth is the donation. A middle relay is safe to run from almost anywhere, and dollars work too ⇗. The crowd needs you. This is the literal version.
Not magic. It hides the path, not your typing. Log into Facebook over Tor and you've anonymously announced yourself. Pair it with the rest of the toolkit: encrypted messaging, a clean OS, habits. Layers, like the onion.
Anonymity loves company. The crowd is the protection, and the crowd is built one boring user at a time.
The navy needed strangers, the dissident needs accountants, the source needs you reading recipes through three countries for no reason anyone can prove. Install it tonight along with the rest of tonight's list, then go deeper: why privacy comes first, the man who used Tails and Tor to tell you, and the stack for the money and speech layers.
// the envelope is sealed. the postmark is from nowhere. send.