- How often
- Once, and again only when you change machine.
- How long
- About twenty minutes including checking the installer signature.
- What it prevents
- The whole category of compromise that arrives through the browser, plus everything a convenience layer would have read.
- If you skip it
- You are trusting whatever repackaged thing you installed instead, permanently and invisibly.
- How you notice you stopped
- You do not stop doing this. It either happened or it did not, which is what makes it a one time task.
What to install
Tor Browser from the project directly, with the installer signature checked against their published key. Then set the security level to Safest before going anywhere that matters.
| Level | What changes |
|---|---|
| Standard | Everything enabled. The largest attack surface, and the reason the other two exist. |
| Safer | Scripting off on non-secure sites, some media restricted. |
| Safest | Scripting off everywhere, most media and fonts blocked. Pages look plain and behave predictably. |
Some pages break at Safest. That is the trade and it is a good one, because the scripting it disables is what most drive by compromise depends on. A page that stops working is a visible cost, and what it prevents is invisible, which is why people talk themselves out of the setting.
What to avoid
- Clearnet gateways. A site that opens onion addresses for you makes the request itself, which means it reads everything you send including credentials. That is the mechanism rather than a flaw in it, so an honest operator does not fix it.
- Anything promising faster Tor. There is no such product, and the category is where address substitution usually arrives from.
- Repackaged bundles. Software named similarly, distributed anywhere other than the project.
- A VPN as a substitute. Different tool, different problem. Stacking one in front adds a company that knows exactly who you are and that you are using Tor.
Mobile, honestly
Workable and worse, and the reason is not what people assume. Checking a signature on a phone is fiddly enough that people stop, and a tool that makes the load bearing habit annoying quietly removes the habit. A phone also truncates long addresses by default, which hides precisely the part that matters. If you must, work out how you will check before you need to rather than during the first login.