Just to be sure that you've understood the key differences between browsing the surface web, using a traditional
browser, browsing the surface web using Tor and browsing the Dark Web
let's take another look at the key differences.
Let's take the first case when using a traditional browser like Chrome, I access a regular website
like Wikipedia.
org.
In this case, there is no anonymity and privacy, even though the connection is secured by encryption
and no one can see the data we are transmitting,
both my identity and the Wikipedia server are revealed by our public IP addresses.
The fact that I am communicating with Wikipedia is also known by the service provider or anyone
between the source and the destination that sniffs the traffic.
Let's take a closer look at this example!
I want to see the IP address of Wikipedia.org and then find out its location.
The easiest way to find its IP address is to ping it.
So I'm opening cmd.exe and I'm pinging Wikipedia.
And this is its IP address.
I'm copying it to the clipboard.
Let's find out some details about the IP address.
There are lots of online services there to do that and I'll choose a random one like ipfingerprints.
com.
And I'm pasting the IP address of
wikipedia and discover. Perfect!
We see the location of the server, which is in the Netherlands, in Amsterdam and they also put it
on the map.
This is where the Wikipedia's server is located.
Let's try a whois IP lookup to see who's the owner of that IP address. And I'll use an online service
called UltraTools.com.
So using the services provided by it UltraTools.com
I'm pasting the IP address of Wikipedia.
And we see lots of information about the owner,
its address and so on.
Now, let's move to the client.
My location and any other information about me can be collected by the destination server or even by
a third party.
We've discussed how it's done in the Web tracking lecture.
So I'm opening tracemyip.org.
And you see my public IP address, the location and the lots of other information like the operating
system, the browser, the screen resolution and so on.
Now let's take the second case. Using the Tor browser
I'm visiting the same website, that resides on the surface Web.
This is the Tor browser and I'm visiting Wikipedia.org
And we see the same website as before.
The main difference is that I'm not connected directly to Wikipedia Web server using my real
identity,
but through the Tor network, using some extra layers of encryption that hide my real identity and location.
Let's check the or circuit!
I'm connected to Wikipedia Web server through 3 Tor relays located on different parts of the globe.
These are the relays,
the Torah relays, known as onion routers.
What is the information that is being revealed?
My service provider can snif the traffic because it goes through its network and finds out that
I'm using Tor; the Tor and relays are public.
If I don't want it to know that I'm using Tor, then I can configure about Tor browser to use a bridge,
which is in fact the secret Tor relay.
Just go to settings - options
and Tor.
The first relay, which is known as the Guard relay, only knows that I'm communicating with some
other party.
It doesn't know that I'm communicating with Wikipedia or how many other Tor relays are until the destination.
It only knows that it has to forward the packets to the middle
relay
located in France. Then the middle
relay knows
that another tor relay sends it the data that
in turn it must forward to another relay,
in this example the exit relay. It doesn’t know neither my identity nor Wikipedia’s.
And finally the exit relay knows that someone, that anonymously communicates with wikipedia and
forwards the packets to the web server. The exit relay doesn’t know my identity,
it knows
only the identity of its direct neighbors.
If I use the same online service to track my ip address I see another identity:
so tracemyip
.org
This is my identity.
That's what a destination server can see about the client, about me.
Note that each website uses its own unique secret.
So this is another website
and has another circuit.
The exit relay is now located in France, in Paris.
Back to the Wikipedia example note that the identity of Wikipedia is not protected.
Its service provider knows that someone communicates with it and an authority knows the location of
Wikipedia and is able to shut it down.
Wikipedia runs
on the surface web.
Now, let's move on to the last case when I'm connecting to a hidden service, also known as an onion
service or a Tor hidden service.
Let's take any website on the dark Web like this one.
This is a secure e-mail provider.
Or this one.
These are only two websites on the Dark Web.
Now, both the client and the server are located inside the Tor network and are anonymous.
By the way, the part before the .onion,
is a 16 character named derived from the services public key.
No one knows that I am communicating with this website,
the website the location, owner or address.
It's all hidden.
And if you click on the url bar to see the Tor circuit, you will find out that there are 6
Tor relays between me and the hidden service.
The connection is done through some Tor production points and the "rendezvous point" , without knowing
the other's party identity. No authority is able to shut down the hidden service because its existence
is hidden.
There are lots of technical details about how this rendezvous protocol works and I'll attach are a source
to this lecture,
if you want to dive deeper into it.