Tor users tend to get a bad rap: just last week, at least three underground online drug markets were shut down, the subject of FBI seizures and arrests. Those markets were only accessible via the anonymous service.
But it’s easy to forget that lots of other, perfectly legitimate things are too. So when Facebook announced last week that it was now easier for Tor users to access the world’s largest social network, many welcomed the move.
And it’s time that more tech companies follow suit.
Tor, which stands for “the onion router,” is an open-source software project that has been around since 2002. Users can choose to route some or all of their web traffic through Tor’s worldwide network of volunteer servers, where it is bounced between three random locations before emerging–-somewhere, anonymously–-out the other end.
Among other things, Tor can be used to obscure the links between a user’s real name, social media account, and location or IP address. It’s popular in countries such as Iran, where access to online content is limited, and amongst activists or protestors based in Tunisia, Egypt, and elsewhere who would rather not have their whereabouts known. It’s also just as useful for those in the U.S. who, for whatever reason, would rather not have their whereabouts tracked.
But accessing social media sites and services via Tor isn’t perfect–in part, because most aren’t designed with Tor users in mind.
“Tor challenges some assumptions of Facebook’s security mechanisms,” wrote Alec Muffett, a software engineer for Security Infrastructure at Facebook London, in a blog post last week. “For example its design means that from the perspective of our systems a person who appears to be connecting from Australia at one moment may the next appear to be in Sweden or Canada. In other contexts such behaviour might suggest that a hacked account is being accessed through a ‘botnet,’ but for Tor this is normal.”
To help counter this, Facebook launched its own hidden service–basically, a special web address, accessible only via Tor, that connects directly to Facebook’s servers–making it easier to identify legitimate connections coming through Tor. But there’s a bigger implication here. As the first tech company to establish a presence on the so-called dark web, it’s a vote of a confidence for people who want to access the Internet anonymously, and lends legitimacy to a service that, for many, is still known primarily for the underground drug market Silk Road.
“I think this is a great step towards making encrypted traffic–and Tor usage specifically–common and accepted,” wrote Runa A. Sandvik, a privacy and security researcher and advocate on the Tor core team. “I do hope to see companies such as Google, Twitter, Yahoo, and friends follow suit.”
The reality is, not all users want–or can–access Facebook, Twitter, or Google services without Tor. For example, it might be the only way an activist in a repressive country under watch or threat from authorities can operate an outreach page or Twitter account, explained Eleanor Saitta, a security engineer, consultant, and board member of the Freedom of Press Foundation.
“They’re using an account that’s well known, but they want to keep their real name and physical location separate from that information,” wrote Saitta in an email. “Leaving Facebook isn’t an option because that’s where their audience is. In some cases, this might even be an account under their wallet name explicitly that they want to update while in hiding, or it might be an anonymous account that they want to stay detached from their name and which they only use for browsing political groups.”
In other words, some people need locational privacy, but not necessarily anonymity. Eva Galperin, global policy analyst for the Electronic Frontier Foundation, offered another example, whereby a stalker or domestic abuser could obtain IP address records from a user’s Facebook or Twitter or Gmail account—say, from a crooked cop, or legally through court.
Now, when a user points their Tor-enabled browser at the address https://facebookcorewwwi.onion/, they’ll have an encrypted, anonymous connection directly with Facebook’s data centers–one that’s easier for Facebook to identify as legitimate Tor traffic and not a compromised account or malicious attack, as well as more secure.
“When you connect to Facebook over Tor the ‘normal’ way, your traffic goes from your computer through three random servers in the network to the Facebook website,” says Sandvik. For the most part, this is fine. But there are potential risks. If the data being sent isn’t encrypted with HTTPS, whoever controls that final exit server can see which websites a user is visiting over Tor, even if they don’t know who the user is. Or, a maliciously configured server could modify or block traffic as it leaves the Tor network. By serving Facebook—or any site—through a hidden service, “the traffic is encrypted end-to-end, from your browser and right into Facebook’s data center,” Sandvik explained. There’s a helpful assurance that nothing will happen to your connection in between.
And, for Facebook, there’s an assurance that you’re a legitimate user connecting via Tor—and not a source of attack or spam. Reports crop up every few months of Twitter or Google users being locked out of their accounts, if they’re even allowed to connect at all, not because they used Tor, but because others used Tor to launch attacks, or for spam, and all that traffic looks like it’s coming from the same place. Offering Facebook as a hidden service is a handy way to separate the good from the bad. And in a perfect world, Apple, Twitter, Google, Yahoo, and more would have onion addresses and hidden services of their own too.
To many, Tor is still synonymous with illegal or unsavory activity. There are all sorts of nefarious implications to the phrase “dark web.” Yet there are perfectly reasonable uses of Tor for privacy and security reasons too. But while most big technology companies already encrypt their users’ connections using HTTPS–in many cases now by default–only Facebook so far has gone out of its way to acknowledge the desire or need amongst its users for locational anonymity too, and encourage the use of its service via Tor.
Of course, implementing something like this on such a large scale is unprecedented, and Facebook’s Alec Muffett keeps reminding everyone that the social network’s Tor efforts are at a very experimental stage. Saitta added in her email that there’s a lot of work yet to be done on Tor’s hidden service code. And it’s hard to expect other companies to have their own undoubtedly complex Tor solutions ready to go overnight.
But, as tends to be the case in Silicon Valley, when Facebook, Google, Twitter, or Apple do something, it’s not long before the others follow suit.