Op-Ed: In defense of Tor routers

A recent Ars Technica Op-Ed post by Nicholas Weaver took a harsh view on Tor routers, calling their basic premise flawed. We acknowledge that Tor routers are not a privacy silver bullet; we’ve been vocal about the need for people to use privacy add-ons with their web browsers. But I feel Weaver's article was one-sided and overstated the case against Tor routers; many of the arguments he made against them could be applied to VPNs as well.

Some of Weaver's points of contention were:

• If you want protection from your ISP, you should use a VPN;
• A personal VPN hosted on Amazon EC2 is a reasonable choice;
• VPN providers offer “better performance and equal privacy”;
• Many Tor exit nodes are malicious (implying that some VPN providers aren’t);
• Browser fingerprinting can break the anonymity of Tor without the Tor Browser Bundle; and
• Tor router makers are money-grabbing scumbags.

I'll address each of these in turn; some of them are good points, others not as much. I may be biased because we make a Tor router, and I think we’ve made a pretty good device. But I’ve tried to be as fair as I can here and acknowledge the limits of Tor routers.

VPNs aren't the answer for everyone. VPNs do provide privacy from your ISP if you need privacy from them, but Tor routers provide that privacy as well, without the ongoing cost of a commercial VPN service. And Weaver fails to mention that many countries actively block VPNs, since the Internet Protocol address ranges of commercial VPNs are well-known, and the signature of VPN traffic can be detected by packet inspection. Even Western countries are not immune from this—Australia is considering a law that would ban VPN traffic right now for the sake of copyright protection.

Tor has a number of advantages over VPNs, including both having a pool bridges and pluggable transports to mask your traffic and allow you to connect to bridges—unpublished relays that allow users to connect even under regimes where Tor is blocked. There are also pluggable transports that help Tor traffic evade signature detection. InvizBox offers support for Tor bridging, and has just added pluggable transport configuration via our web UI.

If I log into my Gmail over Tor, Google knows it’s me. People seem to rail on this a lot, but I’d rather Google knew I was using Tor than my ISP and government knew I was using Google (we have data retention laws) .

Rolling your own VPN with Amazon doesn't necessarily guard your privacy. I disagree strongly with the assertion that Amazon is a reasonable choice for privacy. From a cost perspective they’re not too shabby; the micro instances are free for the first year and bandwidth is relatively cheap. I’ve even used them myself—the OpenSSH client can become a SOCKS proxy with a single command-line argument which is very convenient in a pinch.

However, the suggestion that I should hand over the ability to monitor my browsing (and even worse, that of my family) to a company that is actively trying to sell me products, and can easily link the accounts used for AWS and for Amazon, is not a good one. Amazon has a financial imperative to link my browsing with what they advertise to me. And if there’s one thing I have learned about financial imperatives, it’s that they are a powerful motivator for billion dollar corporations.

Lastly, all traffic coming from the Amazon VPN instance you’re paying for is going to be yours and can be tied back to you. At least with a commercial VPN provider it’s slightly harder to identify you.

VPN providers offer “better performance" but not "equal privacy." People have gone to jail for trusting VPNs not to hand over data on them. VPN providers comply with court orders. VPNs have your source address and access to any browsing you do. With Tor, the exit node has no idea what your IP address is, so they can’t hand over anything.Your VPN provider says it logs nothing? Assume for a second they receive a court order telling them to. Now what?

Furthermore, Weaver's implication is that VPN providers are nice people. Just for a minute I’d like you to pretend that you work for the NSA and that you have billions of dollars at your disposal. In that mindset you would be absolutely insane not to set up cheap, high-quality VPN providers and use them to gather lots and lots of tasty data. If you do, you are a true man in the middle for comparatively little cost. Hell, you could even get people to pay you for the privilege of handing over their data. Certainly the overall cost, both financial and in terms of human effort, would be a lot less cost than it takes to correlate data going over Tor. Weaver even says that “running an exit node offers the opportunity to play spy." Running a VPN clearly offers this option too but that point was surprisingly absent.

Exit nodes are malicious, but VPN providers aren’t? I have already dealt with how it’s a bad idea to assume that your VPN provider isn’t malicious. Let’s look at malicious exit nodes. My assumption is that exit nodes are run by an attacker. When you frame yourself in this way it alters your behavior slightly, without preventing use of the Internet. Add HTTPS Everywhere, Privacy Badger, and assume that anything that comes over HTTP is compromised. I assume HTTP is compromised whether it’s going through a Tor exit node or not. If you want to kick it up a notch, HTTPS Everywhere has the option to block HTTP requests. These are not silver bullets, but they do enhance your privacy.

If these things aren’t enough to bring you into a comfort zone or if you’re after true anonymity, Tor routers are not for you. Please do not use an InvizBox to try and keep yourself out of jail.

There have been instances in the past where exit nodes have altered traffic going through them. It’s also fair to say that HTTP traffic can be man-in-the-middle’d anywhere on the Internet. Malicious exit nodes will remain a problem until all traffic on the Internet is encrypted and in other ways (e.g., timing attacks) will remain so after. There is already significant movement in the direction of “encrypting the Internet” with Mozilla putting forward a plan for deprecating insecure HTTP. Fast forward to the point where that has happened, and you have a situation where VPNs have more information on you (source IP and destination IP) than a Tor exit node (destination IP only).
ƒ
Even if you assume that all exit nodes are malicious (and I know for sure that some aren’t), Tor changes your circuit regularly (with the exception of established sessions). Now this doesn’t guarantee a new exit node each time, but in practice it results in frequent change. What this means is that unless the person you are trying to protect yourself from is running all exit nodes, they will only get a subset of your total traffic. Hopefully most of this is HTTPS traffic and therefore of relatively little (close to zero) value if you’re using some basic precautions.

Browser fingerprinting is a problem. If you’re not familiar with the concept of browser fingerprinting, it boils down to this: There’s a good chance that the browser you’re using to read this is unique. That uniqueness comes from things like your timezone, installed plugins, installed fonts, operating system etc. Head over to Panopticlick if you’d like to check right now.

Browser fingerprinting is a problem for all Internet users. Neither Tor routers nor VPNs can protect you from this. The Tor browser bundle (TBB) does offer some decent protection here. If you’re trying to avoid browser fingerprinting, I would urge you to consider TBB. To my mind, there isn’t a good solution available for this problem at the moment.

We’re money grabbing scumbags? I guess Weaver's characterization of Tor routers as being designed "to separate Kickstarters from their money" is mostly leveled at Anonabox, given how disgraceful their product was and is. But they weren’t singled out, so I have to assume the accusation applies to us, too. We worked hard to make a Tor router that people find easy to use and that fits their requirements. We are genuinely concerned with our customers privacy. You need only look at the feedback on our Indiegogo page and all over twitter about our product to know that people are happy with the product.

Tor routers have a place in the world. They have advantages and disadvantages when compared against VPNs. A hardware solution has benefits compared to a software solution, too. Our implementation is good and we continue to improve it for the people we have sold to. We have yet to take a penny out of the business. We have reduced our margins by offering to match donations to the Tor project (Tor Project, if you’re reading this, we have tried to contact you three times by e-mail and once by twitter to discuss a way for people to validate our contribution matching with no reply yet). We are NOT just trying to scam people out of money and strongly resent the accusation that we are. You may not have figured it out yet, but there isn’t huge money in this. We believe in what we’re doing.

Just in case people think I’m hating on VPNs, I’m not. VPNs have their place and for sure not all of them are run by malicious spy agencies. On the other hand, an InvizBox might just suit your needs nicely.

Listing image by Erich Ferdinand