And this lecture, I'm going to show you how to properly verify and install the Tor browser on Linux
computers.
Skip this lecture if you already have the Tor browser installed or if you want to install it for Windows
or Mac OS.
I cover install it for Windows and Mac os in the previous lectures.
So if you want to learn how to do that for these operating systems, please revise the previous two
lectures.
Now I'm going to be installing it on a Linux distribution in this lecture, but the installation process
is the same on pretty much most Linux operating systems like Debian fedora and so on.
So first of all, you want to go to the official download page of the Tor browser.
I will include it in the resources of this lecture.
You want to scroll down and select the language that you want.
So I want to download the English version and I want to download it for new Linux.
As you can see, you have two options.
You can download a 32 bit and a 64 bit version.
I have a 64 bit computer and therefore I'm going to click on the 64 bit.
Once you do that, it will download it into your downloads directory and as you can see, I already
have it downloaded in here.
Now usually once you have the browser or the application that you want to download downloaded, all
you have to do is simply run it and if it's compressed and compress it and run it.
But because we are trying to protect our privacy and anonymity, it would be a good idea to verify that
this file did not get modified as we downloaded it from the Internet, because if it got modified,
it could contain backdoors or it could contain code that would render the privacy and anonymity features
of this browser useless.
Because when you download something from the internet, it passes through a number of nodes in which
it can be modified.
So it can be modified by your Internet service provider, it can be modified by your network administrator,
and it can even be modified by hackers who managed to intercept the connection.
So in order to verify the integrity of this file, we're going to use a signature file.
Now, as you can see here in the download page, for every single download you have a sig.
This sig is short for signature, and if you click on it, it will download the file similar to this
one right here.
Now you want to make sure that you download the signature for the file that you downloaded.
So I downloaded the 64 bit version of the Linux installer and therefore you want to download this signature
file.
The reason for this is because each signature is unique to the file.
That's why each file has its own signature, and the signature is created by the Tor developers when
they created this file on their own system.
Therefore, if this file gets modified in any way, shape or form, then the verification process using
this signature will fail and therefore we will know that this file got modified.
If we can verify this file using the same signature that the creators created, then that means that
this file did not get modified since they created the file and created the signature.
Now we're going to have a full section in this course about encryption and verification.
So we're going to learn exactly how this works in details.
But for now, we just want to make sure that this installer did not get modified as we downloaded it.
Therefore, we're simply going to follow the instructions in the official to our website.
To do this, you're going to need to run a number of commands on the terminal.
But don't worry, the commands are actually simple, even though it might seem like it's a little bit
difficult.
And I'm going to walk you through it step by step.
So the first command that we need to run is a command to fetch or download the developer's key.
This is the command right here.
I'm going to copy it.
I'm going to go to a new desktop and I'm going to run the terminal.
So I'm going to click on all applications and type terminal to run it.
And we have it right here.
So I'm going to click it and I'm simply going to paste the command that I copied.
Now, the command is actually very, very simple.
It's using a program called GPG.
This is a program that you can use to create and verify and encrypt data.
We're saying that we want to download to locate a key, and the key that we want to download or locate
belongs to a user that has the email of Tor browser at Tor project dot org.
We're going to hit Enter.
And perfect.
As you can see, it's still us.
The public key for Tor browser developers has been located and you can see the email in here and it's
telling us that this key is imported.
And also you can see the key fingerprint right here.
We'll get back to that in a second.
So now the key is imported into GPG, the program.
What we want to do next is actually store it in a file and we're going to go back to the instructions
to see how to do that.
And we have the command right here.
So again, we're going to copy it and we're going to paste it in here.
Again, we're using the same program GPG To do that.
We're saying that we want to output a file.
Like I said, we want to store it and we want to store it in a file called Tor Dot KeyRing so you can
name this file whatever you want.
And we're saying that we want to export a key that has the following fingerprint.
So note this fingerprint right here is the same as the fingerprint of the key that we just imported,
the third developer's key.
So what we're saying this key is already imported.
We're saying that we want to export it, we're selecting it using the fingerprint, and we're saying
we want to output it or store it in a file called Tor Dot KeyRing.
We're going to hit enter and the command will get executed without showing any errors, meaning it got
executed successfully.
But just to double check, we can use the RLS command, the list command to double check that we have
a file that is called Tor Dot KeyRing.
If I hit enter you can see that we have the file in here, meaning that we manage to store the imported
key in here into this file.
So the last step is to actually use this key along with the signature in here to verify that this package
did not get modified.
And to do that we're actually going to use the same program.
GPG We're going to say that we want to verify, we're going to specify the keyring file that we just
downloaded or stored in here.
So it's called Talking Ring and then we're going to give it the location where we have the signature
file in here.
So as you can see, it's in my downloads and it's called Tor browser Linux, whatever, dot ISC.
So the path is going to be.
Downloads Tor browser.
I'm going to type T and hit tab to autocomplete.
And as you can see, because it is the only file that starts with a T, it ought to be completed to
the name of the package.
So I'm just going to add that a C to specify the signature file because if you go back in here, you
can see the signature file has the same name as the package file.
And the only difference is this one ends with a dot ask.
So now we're giving it the signature file.
We're giving it the key ring.
Next, we need to give it the actual package file that we want to verify.
So again, it's in downloads and I'm going to type T and tap to autocomplete and that's it.
So we're using GPG, the same program we're telling it, we want to verify, we're giving it the key
ring file using the key ring argument.
This is the file that contains the key from the previous step.
And then we're giving it, first of all, the signature file and then followed by the actual package
that we want to verify we're going to hit, enter and perfect.
As you can see, we're getting a message telling us that this is a good signature from the Tor browser
developers.
This means that this package did not get modified since the Tor browser developers created this signature
using their key.
So now we can interact with this package, use it, and use the Tor browser with confidence, knowing
that it's going to work exactly the same way that the developers intended to work and that it did not
get modified as it was downloaded.
So from now on, the installation is actually pretty simple.
We're going to, first of all, need to uncompressed this archive.
So I'm going to right click it and extract it here and then we're going to open up the new directory
that was created and we're simply going to be able to run the Tor browser by executing this file.
So we're going to go to the terminal.
I'm going to clear it.
I'm going to navigate to the location where this file is stored.
So it's in my downloads in the Tor browser directory, in another directory called Tor Browser E and
us.
So we're going to use the CD command to do that.
We're going to go into downloads, I'm going to type T and tab to Autocomplete and another T and a tab
to autocomplete.
I'm going to do LS to list the files and directories and notice that this file is in green, meaning
that it is an executable so I can start it by typing dot forward slash followed by the file name.
So again, I'm going to type s and a tab to autocomplete and I'm going to hit Enter.
And as you can see, we get the default window for the Tor browser.
I'm going to check this box to always automatically connect to the Tor network and I'm going to click
and connect to connect to it and start the browser.
Now, don't worry about how this browser works and about its features.
We're going to cover all of that in the next lectures.
But for now we have a clean, unmodified version of the Tor browser installed on our Linux computer.
And like I said, you can follow these installation steps on pretty much any Linux distro and it should
work exactly the same.