downloading movie on tor browser traced Tor Browser. The Tor Browser is a modified version of the Firefox ESR. Iceweasel, the browser included with the Tails distribution, is also based on the Mozilla browser project. Both Tor browsers are functionally identical (or nearly so), and should be familiar to anyone who has used Firefox (or related browsers). Users should be extremely cautious about changing Tor browser settings, as the defaults have been chosen carefully by Tor Project developers for maximum safety and usefulness. Changing some settings may cause obvious problems for maintaining anonymity, such as allowing the browser to remember browser history or disabling warnings when sites try to install add-ons. Other changes may cause problems that are not so obvious, so in general, it is probably best to leave the browser settings alone. The Tor Browser. Brett Shavers , John Bair , in Hiding Behind the Keyboard , 2016. From a Tor User’s Perspective. As mentioned, the Tor browser is simply a modified Firefox browser. Besides downloading the Tor browser, the only user technical skill required is that of entering URLs in the browser or entering terms in a search engine. Even the skill of installing a Tor is less than installing most programs. The Tor browser bundle is a portable application and only needs to be extracted, not installed, to run. The Tor browser file is self-executable to make the process even simpler for anyone to use. As the Tor browser is a portable application, it can be installed (extracted) to any location on a computer or external media device without any default paths. From downloading to using the most anonymous browser in the world only requires about 10 mouse clicks and 10 minutes to download, extract, and configure. When accepting default settings, which fits the needs of most users, the Tor browser configuration step is completed in one click as seen in Figs. 2.5–2.7 . Figure 2.6 . Step 2 of Tor setup, just have to wait. Figure 2.7 . Tor setup is complete. Most users do not need to configure Tor to use with a bridge or local proxy settings. However, if this is necessary, it only adds a few minutes of setup time and is not terribly difficult for most computer users. Generally, Tor is just as effective with or without bridges, except in countries where Internet censoring will require bridges for Tor to work with the Tor network. At this point, Tor is ready to use similar to any web browser. As you can see, the simplicity of Tor coupled with the strong anonymity makes it a great choice for legitimate purposes as well as a prime choice for illicit use. It’s free, fast to set up, easy to use, portable, and provides near breakable anonymity. Protecting your reputation. John Sammons , Michael Cross , in The Basics of Cyber Safety , 2017. As we discussed in Chapter 7 , Finding a job online, using the Tor browser ( www.torproject.org ), you can browse, chat, and send instant messages anonymously. Because communication between your browser and the site you’re visiting are bounced across different servers, the site can’t see where your request to view a page originated. Any chat or instant messaging application that uses Tor is likewise made anonymous. Unfortunately, some activities with the Tor network can reveal your identity. For example, let’s say you were downloading a movie using a torrent file-sharing application. If you setup the application to use Tor, it would still send out your IP address as it makes a direct connection to get the file. If you downloaded a document and opened it, the PDF or Microsoft Word file could contain resources that are downloaded outside of Tor, which would reveal your IP address. Another aspect of using Tor that you should be prepared for is a decrease in performance browsing the Web. Because any requests you make go through a network of servers before reaching its destination, you’ll notice that it’s slower than other browsers you may have used. Unfortunately, that’s the tradeoff for anonymity. Antiforensics. Brett Shavers , John Bair , in Hiding Behind the Keyboard , 2016. When All Else Fails or Is Likely to Fail. In cases where monitoring communications is impossible due to anonymous Internet access methods such as the Tor browser or virtual private networks, other means have to be considered. Undercover operations in which an investigator or informant infiltrates a criminal network (online or in real life) may be able to obtain access to encrypted channels of communication and be part of the evidence in e-mails, chats, and forums located on hidden services on the Dark Web. Where an undercover or informant operation is impractical or impossible, measures to directly infiltrate the computer system may be possible. This could range from injecting spyware on the suspect’s computer remotely or by physically placing physical key loggers and video cameras in the suspect’s residence or business under authority of covert search warrants that do not alert the suspect. Either of these methods can capture passwords and view computer activity. Foreword. Larry G. Johnson , in Hiding Behind the Keyboard , 2016. A broad landscape of technical topics is thoroughly presented here, including encryption schemes and methods; steganography; the Tor browser ; the TAILs operating system; password cracking; decoy storage devices; time stamp modification; file signature manipulation; bootable operating systems; using media address control (MAC) to identify source; portable apps; hidden and decoy operating systems; virtual machines; key loggers; antiforensic methods; electronic intercepts; trap and trace/pen registers; determining digital identity; navigating the Dark Web; and much more— Phew! Equally impressive are the numerous practical tips and examples in the book that come from Brett Shavers’ many years spent in law enforcement and cutting-edge computer forensics. Digital Identity. Brett Shavers , John Bair , in Hiding Behind the Keyboard , 2016. Dark Web. The dark web, that is, the Internet that is not indexed by search engines, contains communications between criminals which is very difficult not only to track but even to find. Mere access to the dark web requires the use of the Tor browser which by default hides the true IP address of the user. But as seen in the Ross Ulbricht case, information from either the dark web or open Internet can be tied together when errors are made by suspects. Using the Ulbricht case for another example, Ulbricht’s co-conspirator was unidentified until Ulbricht’s laptop was examined. Once examined, not only was his co-conspirator identified by an image of his passport on the laptop, but Ulbricht had also maintained an extensive record of chat logs that were thousands of pages long between himself and co-conspirator Roger Clark. Although the chats were most likely impossible to intercept through the dark web, analysis after the fact recovered enough covert communications to help in placing Ulbricht in prison for life ( United States of America v. Roger Thomas Clark, 2015 ). Online Anonymity. Sudhanshu Chauhan , Nutan Kumar Panda , in Hacking Web Intelligence , 2015. The Onion Router. Tor stands for “The Onion Router.” It is one of most popular and widely used methods to stay anonymous online. It is basically a software and an open network which allows its users to access the web anonymously. It started as a US navy research project and now is run by a nonprofit organization. The user simply needs to download and install the Tor application and start it. The application starts a local SOCKS proxy which then connects to the Tor network. Tor uses layered encryption over bidirectional tunnels. What this means is that once the user is connected to the Tor network, he/she sends out the data packet with three layers of encryption (default configuration) to the entry node of the Tor network. Now this node removes the uppermost layer of the encryption as it has the key for that only but the data packet is still encrypted, so this node knows the sender but not the data. Now the data packet moves to second node which similarly removes the current uppermost encryption layer as it has the key for that only, but this node does not know the data as well as the original sender. The packet further moves to the next node of the Tor network, which removes the last encryption layer using the key which works for that layer only. Now this last node, also called the exit node has the data packet in its raw form (no encryption) so it knows what the data is, but it is not aware who the actual sender of the data is. This raw data packet is then further sent to public internet to the desired receiver, without revealing the original sender. As already stated this is bidirectional so the sender can also receive the response in similar fashion. One thing that needs to be mentioned here is that the nodes of the Tor network between which the data packet hops are choosen randomly, once the user wants to access another site, the Tor client will choose another random path between the nodes in the Tor network. This complete process is termed as onion routing. So Tor is pretty good at what it does and we just learned how it works. But as we need to use different nodes (relay points) and there is also cryptographic functions involved, which makes it pretty slow. Apart from this we are also trusting the exit nodes with the data (they can see the raw packet). Tor is available in many different forms, as a browser bundle, as a complete OS package etc.