[tor-talk] What is tor used for?

[Roger Dingledine]

On Thu, Nov 03, 2011 at 04:23:48AM -0000, toruser at tormail.net wrote:
> i believe there is a real need for secure communications but as a new user
> to tor it seems the common entry points to the network are rife with
> criminal activity.
> 
> the torproject website lists users as friends and family, military,
> business owners etc - use cases that make sense to me, but i've yet to
> find any stories or ancedontal evidence to suggest this is really the
> case.  instead i find core.onion linking to "adult" content that has
> little to do with adults and "market sites" that deal with illegal trade
> in weapons and drugs.
> 
> so far it has me wondering if tor is really used for the humanitarian
> purposes the technology has the potential of aiding.  i would really
> appreciate hearing real stories and highlights of how has helped in the
> use cases torproject lists.

You might like
https://torproject.org/about/torusers.html.en
https://blog.torproject.org/blog/we-need-your-good-tor-stories

Really, getting good stories of Tor successes is tricky, because if Tor
is doing its job, nobody notices. I know a lot of people who have really
interesting Tor success stories and have no interest in telling the world
who they are and how they managed (until that moment when everybody is
reading about them, that is) to stay safe.

Still, there are a bunch of other stories out there that haven't been
documented as well. For example, I really like Nasser's story about his
experiences in Mauritania:
http://www.technologyreview.com/computing/22427/page4/

I think I understand one of your confusions though, when you say "the
common entry points to the network". You're thinking about hidden
services, which are not Tor's main use case (Tor's main use case is
accessing the rest of the Internet safely).

Hidden services have gotten less broad attention from the Tor user base,
since most people who install Tor have a website in mind like twitter
or indymedia that they want to visit safely. Some good use cases that
we've seen for hidden services in particular include:

- I know people (for example, in countries that have been undergoing
revolutions lately) who run popular blogs but their blogs kept getting
knocked offline by, well, criminals. The common blogging software
they used (like Wordpress) couldn't stand up to the ddos attacks and
breakins. The solution was to split the blog into a public side, which is
static html and has no logins, and a private side for posting, which is
only reachable over a Tor hidden service. Now their blog works again and
they're reaching their audiences. And as a bonus, the nice fellow hosting
the private side for him doesn't need to let people know where it is,
and even if they figure it out, the nice fellow hosting it doesn't have
any IP addresses to hand over or lose.

- Whistleblowing websites want to provide documents from a platform that
is hard for upset corporations or governments to censor. See e.g.
http://globaleaks.org/

- Google for 'indymedia fbi seize'. When Indymedia offers a hidden service
version of their website, censoring organizations don't know which data
centers to bully into handing over the hardware.

- Data retention laws in Europe (and soon in the US too at this rate)
threaten to make centralized chat networks vulnerable to social network
analysis (step one, collect all the data; step two, get broken into by
corporations, criminals, external governments, you name it; step three
comes identity theft, stalking, targeted scam jobs, etc etc). What if
you had a chat network where all the users were on hidden services by
default? Now there's no easy central point to learn who's talking to
who and when. Building one and making it usable turns out to be hard.
But good thing we have this versatile tool here as a building block.

How's that for a start? It is certainly the case that we (Tor) spend
most of our time making the technology better, and not so much of our
time figuring out how to market it and change the world's perception on
whether being safe online is worthwhile. Please help. :)

--Roger