How much can I trust Tor?

Tor is better for you than it is for people in countries whose intelligence services run lots of Tor exit nodes and sniff the traffic. However, all you should assume when using Tor is that, if someone's not doing heavy statistical traffic analysis, they can't directly correlate your IP with the IP requesting resources at the server.

That leaves many, many methods of compromising your identity still open. For instance, if you check your normal email while using Tor, the bad guys can know that that address is correlated with other Tor activity. If, as @Geek said, your computer is infected with malware, that malware can broadcast your identity outside the Tor tunnel. If you even hit a webpage with an XSS or CSRF flaw, any other web services you're logged into could have their credentials stolen.

Bottom line, Tor is better than nothing; but if your life is on the line, use a well-secured computer for accessing Twitter and WordPress using it, and don't use that computer for anything else.


2013 calling

I think this question deserves a new answer after what we know now. Given the financial sources of the Tor project and what we learned about the NSA inserting backdoors (e.g. see here) casts a shadow on the trustworthiness of the project.

From the annual report for last year (linked above):

excerpt from the fiscal report of the Tor project for 2012

However, keep in mind that the US government claims they want to enable all kinds of people around the globe to communicate unencumbered by local national censorship. You yourself probably fall into that category. It does of course not preclude eavesdropping on them, but it would give a motivation for financing the project other than the potential darker intentions one could think of in light of the recent leaks concerning global surveillance.

Also, this recent publication ("Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries") about how identifiable users puts a big question mark on the usefulness of Tor w.r.t. anonymity. Apparently that's a big concern of yours.

I don't know what resources the Indian government (assuming that's your "adversary") has available, but it's certainly a factor to be considered.

All that said, I think that in combination with other measures such as re-mailers, encryption, VPN and so on, you can probably evade successfully for some, possibly even a very long time. So Tor will be useful as one thread in a safety net. But be aware that this thread may turn out inefficient, so don't let it be the only type of thread in your safety net.


You would also need to be careful of the fact that your ISP is in a position to see that 'your IP address' is using Tor, even though it can't tell what you're using Tor for. If conditions are so hostile that you could be brought under suspicion simply for appearing to be clandestine, then you should take care to use Tor everwhere except on an Internet connection which can be strongly associated with you.

Tags:

Anonymity

Tor