Tor Network

When you visit a website, your internet provider sees which site that was. And the site itself sees the address of your connection, which is a clue as to where you currently are. The Tor network is meant to prevent exactly that. It doesn’t send your request directly to the destination, but instead routes it through three unrelated computers, voluntarily operated by people and organizations all over the world. Each of these computers only knows its immediate predecessor and its immediate successor. So no one in the chain simultaneously knows both your connection and the site you’re visiting.

Who relies on anonymity online

For most people, Tor isn’t an everyday tool. For some, it’s vital for survival. Female journalists in authoritarian countries use it to communicate with informants without the connection being traceable. Whistleblowers, meaning people who expose wrongdoing at their company or agency, also rely on it. Major media outlets operate their own anonymous drop boxes within the Tor network.

A second reason is censorship. In some countries, news sites or social networks are blocked. Tor can often bypass such blocks because the provider can’t tell which destination is being accessed. This explains why governments try to block access to the Tor network itself.

However, Tor also has a questionable reputation. The same technology protects marketplaces for drugs and other illegal offerings. That’s why the term frequently appears in the news alongside the word darknet. The two are not the same thing: Tor is the technology, the darknet is a portion of the content that is reachable through it.

The three stations and the onion layers

The original name is The Onion Router. This describes the principle well. Your request is encrypted three times, like an onion with three layers. The first computer removes the outer layer and sees only one address underneath: that of the second computer. The second removes the next layer and sees the third. Only the third computer, the exit node, removes the final layer and sends the request on to the actual destination site.

The result is a shared ignorance. The first computer knows you, but not your destination. The last one knows the destination, but not you. The middle one knows neither. The path is reassembled roughly every ten minutes, so that the same chain doesn’t persist permanently.

These detours cost time. Pages load noticeably slower over Tor than over a normal connection, often delayed by several seconds. Another common misconception is that Tor automatically makes everything secure. Anyone who logs into an account under their real name via Tor exposes themselves. And any data that the destination site doesn’t additionally encrypt can be read by the exit node.

Tor Browser, .onion addresses, and headlines

Most people encounter Tor through the Tor Browser. This is a free program that looks like a normal browser and automatically sets up the detour through the network. Anyone browsing with it can recognize Tor sites by the .onion ending instead of .com or .org. Such addresses are long sequences of letters and numbers and can only be reached from within the network.

Well-known providers are represented there too. The BBC, the New York Times, and the messaging service Brave operate or have operated their own .onion versions of their offerings, so that users in countries with censorship can reach them. The network is maintained by the US nonprofit organization Tor Project and runs, depending on the time, on several thousand volunteer nodes.

In business news, Tor and cryptocurrencies often appear together, for instance in investigations into illegal marketplaces. Interestingly, such cases are usually not solved by breaking the encryption. The operators almost always make mistakes outside the technology itself: a careless email, a reused username, a payment that can be traced back.