Is it safe to download internet files over TOR

Usually, the reason to be cautious about downloading executables over Tor is that the Tor network creates a man-in-the-middle scenario: the exit node can alter the download, or replace it entirely, so that you receive some sort of malware instead. The way to solve this is to use https, in which case your connection to the website has an additional layer of encryption that will produce a large, obvious warning if someone tries to tamper with the response.

Now, as far as anonymity goes, the warning you get from the tor browser bundle is essentially saying that by opening files outside of the browser, they can't protect you any more - they can't make any guarantees about what those files will do, and it's possible they will send your real IP back to some server somewhere.

Downloading chrome over Tor, for instance, does not mean that chrome will be automatically protected through tor; it will make requests to websites directly (unless you configure it differently), and the install process might even send a note to Google saying "hey, this person installed chrome". Other times, opening a file can break anonymity in less obvious ways; for instance, opening a video file in your media player may trigger a fetch of a remote media file, giving that server your IP. I suspect this doesn't matter to you, since you are installing another browser; it's mostly a matter for people with high anonymity needs. If it does, however, that's the purpose of systems like Whonix.


There are several things to consider when downloading files from the Tor network.

One of them has to be the fact that the entry/exit nodes for your connection to the server (and the other way around), can alter data. There's implied trust in the Tor network at the beginning and endings of connections. This doesn't mean someone isn't looking at what you are requesting, but could potentially happen especially with a "rogue" node.

Now with files, there's two aspects to cover. One is the fact that a "rogue" node could modify it, or swap it out for an entirely different file. The easy way to combat this is to use a secure hashing algorithm, so that both the originator and recipient know that the file hasn't been modified in transport.

The second aspect for files is the fact about metadata. Some file formats such as DRM protected audio files such as WMA and WMV, allow for automatic lookup for a codec without prompting the user first. This connection obviously won't be done though Tor, which could leak your information. Beyond DRM, newer Microsoft Word Documents track author information and other such pieces. This again could expose who is who.

Keeping files on disk can also serve as evidence, which is why many use a live CD/DVD to keep contents in system RAM. In the event of a power off and a few seconds, all information is effectively cleared, and any evidence of files being used/accessed is gone as well.

Tor was in fact developed by people working in the US Navy. A lot of people forget this, so do make the false assumption that Tor or "The Onion Routing Project" is "unbeatable" or "completely secure".