2 Copyright 2016 Soren Stoutner <soren@stoutner.com>.
4 This file is part of Privacy Browser <https://www.stoutner.com/privacy-browser>.
6 Privacy Browser is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, either version 3 of the License, or
9 (at your option) any later version.
11 Privacy Browser is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with Privacy Browser. If not, see <http://www.gnu.org/licenses/>. -->
35 <h3>Tor and Its Limits</h3>
37 <p>There are two general categories of bad actors that want to infringe on the privacy of the web: malicious governments
38 with access to ISPs (Internet Service Providers) and mega corporations that run social and advertising networks.
39 TOR (The Onion Router) is useful in protecting privacy from malicious governments but not from mega corporations.</p>
42 <h3>Malicious Governments</h3>
44 <p>Malicious governments often spy on their citizens to punish dissent or human rights activity. They commonly either
45 operate the local ISPs or they can force them to disclose information showing every IP address that is visited
46 by each user. Tor is designed to defeat this infringement of privacy by encrypting the traffic
47 from a user's device and routing it through three separate servers on the internet before sending it on to the final destination.
48 This means that no individual ISP, server, or website, can know both the <a href="https://ipleak.net">IP address the user's device</a>
49 and the IP address of the final web server. Malicious governments and the ISPs they control cannot tell which
50 web servers a user is accessing, although they can tell that the user is using Tor. In some parts of
51 the world, using Tor could be construed as an evidence of illegal behavior ("if you didn't have anything
52 to hide you wouldn't be hiding your traffic from us") and users could be punished because governments
53 assume they are doing something that is prohibited. Thus, Tor can be helpful, but isn't a panacea.</p>
56 <h3>Mega Corporations</h3>
58 <p>When a user connects to a web server, the web server can see the user's IP address. Although it isn't a perfect science,
59 IP addresses can be turned into physical addresses with a <a href="https://www.whatismyip.com/">fair amount of accuracy</a>.
60 Small web servers typically rely on IP addresses to identify the location of the users visiting their site.
61 Tor is a good solution to mask the user's location from these servers. But large mega corporations
62 that own social media and advertising networks use a whole profile of information that is designed to track users
63 across devices and IP addresses. These profiles employ a variety of techniques to identify users, including JavaScript,
64 cookies, tracking IDs, and <a href="https://panopticlick.eff.org/">browser fingerprinting</a>. Because the vast majority
65 of the websites on the internet either load an ad from one of the major networks or embed social media icons with their
66 associated JavaScript, these corporations have build profiles for almost every user online and can track their internet
67 activity across unrelated sites.</p>
69 <p>They track every site that is visited, everything that is purchased, every credit card that is used to
70 make a purchase, every address that items are shipped to, and the GPS metadata of every picture that is
71 uploaded to the internet. They build a profile of a user's age, gender, marital status, address, political affiliations,
72 religious affiliations, family circumstance, number of pets, and everything else they can get their hands on.
73 They even buy up databases of credit card usage at local stores, so they can track the off-line purchasing patterns of the users
74 in their profiles. Because they already have much more accurate address information about a user than an IP address discloses,
75 Tor provides no real privacy protection against mega corporations.</p>
77 <p>The single best privacy protection against mega corporations is to browse the web with JavaScript disabled, followed
78 by blocking ad networks, disabling cookies and DOM storage, and using a browser that is difficult to fingerprint.</p>
83 <p>Despite the limitations, Tor can be useful in some circumstances. The Tor project has an app for Android called Orbot,
84 which is available on <a href="https://f-droid.org/repository/browse/?fdfilter=orbot&fdid=org.torproject.android">F-Droid</a>
85 and everywhere else that Privacy Browser is distributed. Privacy Browser has a setting to use Orbot as
86 a proxy. When this is turned on, Privacy Browser's app bar will have a light blue background instead of
87 the default light grey. When Privacy Browser's Orbot proxy setting is enabled, internet access
88 will not work unless Orbot is running and connected to Tor. Because traffic is being routed through several Tor nodes,
89 using Tor is often much slower than connecting straight to the internet.</p>
91 <img class="center" src="images/tor.png" height="640" width="360">