00:00 Hello, I'm Seth For Privacy, and welcome to Season 2, Episode 6 of Opt Out. Opt Out's a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they've found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. Have you been wanting to get a better grasp of what the Tor network can do for your privacy and what it can't do? This episode, we're going to sit down with Isabela from Tor to chat about the Tor network itself.

Welcome on to Opt Out, Isabela. Thank you, Seth. Thank you for having me. Yeah, I'm very excited to sit down with you to walk through Tor, and I'm just very grateful that you're willing to come on the show. I'm sure that you all get a ton of requests with just kind of how ubiquitous Tor is with the privacy field. But I feel like even with how well-known Tor is as a name, I feel like a lot of people still don't have a solid grasp on really its kind of core strengths and weaknesses.

So I'm excited to walk through the basics, get some listener questions answered, and really just hopefully get a better grasp of Tor and what it can offer people as a tool in their toolkit after this episode. But for listeners who may not be familiar with you, do you mind introducing yourself and then just telling us a little bit about what Tor is? Yes. I'm Isabela Bagueros. I'm Isabela Bagueros. I'm the executive director at Tor. And Tor, it's a couple of things, right?

Like, first of all, Tor is a decentralized network that helps protect your original IP address when you're connected to the Internet. And we also have a browser, which is a fork, a fork from Firefox that helps you make that connection, right? Like, so the browser also carries on some other features that protects you from fingerprinting, third-party cookies, and other tracking, you know, technologies and surveillance technologies out there. So in a very simplistic way, like, this is what Tor is.

It's an open source network that helps protect your privacy online. Perfect. And we'll kind of focus on Tor browsers today just because I think that is the most approachable way to use the Tor network. But I think that is a very good distinction for listeners that the Tor network itself is not necessarily the Tor browser, but the Tor browser leverages the Tor network for privacy in addition to building in a lot of other anti-tracking features and other things on top of that.

So we'll kind of focus on Tor browser today, but the Tor network is obviously the key piece that underlies that and makes the Tor browser such a powerful tool. But before we dive more into Tor itself, I actually wanted to hear a little bit more about just you and kind of your background. I love hearing what each guest kind of has as the story of kind of what woke them up to the need for personal privacy. So I'd love to hear your take on that and just, yeah.

Yes, of course. I think, so I started to get involved with the open source free software community back in the 90s. I'm originally from Brazil and was mostly out of necessity because the proprietarian software was always too expensive. And keeping up with the versions would never run on my old computer. So I moved it to Linux very early on. And in the late 90s and early 2000s, I got very involved with the movement for democratization of information.

And that was when the internet was kicking off and, you know, become stronger, especially in the global south. So during that process, kind of like start to learn as we were building tools to help democratize information through the internet, we start to learn how to host information. You know, we had to run our own servers. We created our own websites. And we just, we had a very clear insight of the data and what controlled the data, how much a service could see and have access about your information.

And in the early 2000s, we were doing digital inclusion web workshops and teaching social movements, how like the benefits of using the internet to organize. And put the information, like be the media, right? And this is before social network and like Twitter or Facebook or anything like that. But at that time, we were, we wanted to bring this awareness to folks about your data. It matters where your data is. It matters what type of service you're using.

It matters if you are hosting your email with a proprietor or for-profit organization or with an activist organization. It matters when you publish your news and who is hosting this news because it can be requested to take down. It can be censored. And who is going to fight for that, like to keep that information online? So very, like it was kind of like part of my, my, my story with the internet and my story with bringing different social movements from Brazil to use the internet as a powerful tool for organizing.

That notion about the information that are on devices, that are online and who is controlling it. It, it, all of that matters and the importance of caring about who is behind it. It was very important. And I try it from the early days to communicate that to people and bring that, you know, and educate people and bring that awareness to people. So I think the notion of online and like privacy was, came together kind of natural because I was behind the servers.

I was building the infrastructure for so many social movements and we fought for that infrastructure to stay online. We fought against the DMCA orders and all the types of orders. So we knew that there was a power that could control the information and how much you could see other people information. So we try to, like, I always try to communicate that very early on in the day. So other people. Yeah. Yeah. It sounds like you were very early on to that, that concept.

And I feel like it's starting to come back around. But it's certainly, we've certainly kind of taken a dark path in the internet as a whole in the past real, really, I guess, decade, 15 years or so. Away from what you're talking about. That idea of democratizing control of data and people very much being in control of where their data is and how it's posted. And preventing censorship and preventing censorship and all these different pieces that are, I think, kind of becoming more like privacy buzzwords now, but have been conversations for decades at this point.

So it's awesome that you were early on in that. And obviously, when you're a part of that and when you understand how the actual technical details of these types of networks work, privacy becomes important. Because you grasp what can happen if you don't have any kind of privacy or if you don't have any control of the data that's being passed around there. Exactly. I feel like two things have happened, right? One, the access to the internet has grown so much, especially right now, most people have a mobile device that can connect them to the internet.

But at the same time, back in the day, the usage of data analysis and harvesting people's data was not as much as it is today. Yeah. Yeah. So those are two things that influence a lot of how much people are affected by what is happening today, especially with capitalism surveillance. Yeah. Yeah, I definitely agree there. And I'd love to kind of shift back into Tor and hear a little bit more about the network itself and kind of how Tor got started.

What kind of prompted the creation of Tor? And I'm assuming you weren't a part of the original creation of Tor, but I'd love to hear some background on kind of where it got kickstarted, if it was out of a similar movement to that, and just a little bit of the story there. Yeah. So, yeah. So Tor has a, I was not, I didn't create Tor, I was not part of that. Yeah. But Tor has an interesting story, right? Like it actually started in the 90s. Around the same time I got exposed to free software and all those service things, et cetera.

But the US Naval Research Lab, NRL. So literally there were researchers there who were wanting to create ways for people to have internet connections that would not reveal who they are and who they were talking with. So they developed the onion rotting paper and like later on, they start to try to implement, right? The design of that paper into production to practice. So, yeah. But right at the beginning of 2000s, that's when Roger and Nick, Roger Degendaya and Nick Mathsen got involved into the project and they brought in the, you know, the clear fact that if you wanted to do the onion rotting, which means like you're connecting to multiple servers until you get to the endpoint.

Right? Like if you want to do something like that, that are truly, will truly anonymize the user connection, nobody really would know who is connecting with the user.

10:00 connecting to what, nobody can control, could control this network. So right at that moment, they move it, the only routing to their own routing with the store, right? Like it stands for, and with the concept that this should be, first of all, free software, open source code. And second of all, the node should be, anyone should be part of this network and become a node, could not be something that was a network controlled by any entity and should be decentralized.

And that would be ways that project, that concept could exist for real in a way that nobody truly would not know who was accessing the network and doing what and communicating with who. So they remove it from inside of NREL and they open source of the code and they created a process where anyone could be running a node and be part of the Tor network. And to support that project, they created the nonprofit, the Tor project nonprofit to back that up.

Right. And at the beginning, this was the nonprofit was created and all these things was formalized at around 2003. And there was a sponsor by the Electronic Frontier Foundation. And then the rest is history, right? Like it started to grow more nodes, more people started running nodes. And then the, it became, we had a little, a little application called Vidalia that you could set up the proxy and bootstrap the network from your, your device at the time would be your computer.

And then you would have to configure the browser to communicate the proxy and all of that. Then people wanted to make it easier for the user. So they actually killed Vidalia and put it, this whole bootstrapping of the network on this pieces inside of the browser. And that's where the top browser came to exist. Right? Like, so from a concept of like a research question, a research mission, right? Like that came actually. And people say, oh, Tor comes from the, uh, us Navy.

It did from the, uh, research lab, but, uh, for the concept to really be, uh, true to itself, it had to get out of it. And then that's where Roger and Amy came and they made it, uh, make it, uh, the code open and they made it the network, the centralizer, so anyone could run it to be truly transparent and truly to centralize and true to its mission of nobody having any control of, uh, the code of any control of the, uh, the network itself. So, uh, it could really anonymize the connections through it.

Yeah. Yeah. And I think a lot of people get spooked by the idea that the U S government obviously created Tor and thought of the, the way that it would function and kind of created the initial concept, but like you mentioned, the, the U S government actually benefits from a decentralized and widespread and anonymous Tor network that's run by anyone. So if anyone's running a node and lots of people are using the network, they can benefit from that without backdooring it or having all of these kind of, um, more, I guess, ideas that people have around the, the way that the U S government is trying to take down Tor or whatever, but, um, they benefit from that.

And, and obviously, hopefully there's that broader aim of other people. People are going to benefit from the privacy that's provided by the Tor network. Um, and I'm glad that you mentioned a little bit about how the Tor network itself works. Um, cause I think it's important that people understand at least like the rough idea, but like you mentioned, it's that, that onion routing, which is where when you enter the Tor network, your, your browser, generally Tor browser will pick an entry node that you'll use to connect to the Tor network.

And then you'll bounce through other nodes that are within the Tor network. But whenever you jump through a node, the next node doesn't know your original, uh, your origin, IP, that kind of thing. And they don't know the destination. And so you can hide that information from each of the nodes in between. Um, and then eventually either exit through a node onto the, the clear net, the regular internet and browse regular websites. Um, and then obviously the exit node knows where you're going, but they don't know your origin IP.

Um, or you can stay within the Tor network and use what are called hidden services, which talked about a good bit on the, on the podcast in the past. Um, but you can use basically services within the Tor network and never leave the network itself and never, uh, use an exit node. But I do just want to clarify that real quick for listeners too. Um, cause we are going to focus on Tor browser, but important that people understand how that works. Um, but it is quite a crazy history.

It's not, not your normal history for a, a free and open source project. Um, not many things were, were started out of a Navy lab and grew over the course of 20 years. Um, so definitely not the norm, but I guess it's similar to how the internet was kicked off as well. So there's some similarities there. Exactly. And yeah, um, just to go a little bit, like, um, the onion, the concept of onion roting, right? Like, uh, each one of these, uh, servers, this relays that you're talking about that you explained very well, they have a layer of encryption.

That's why. They, they only know one piece of the information, right? Like, and the idea of these layers is where the name onion comes from. Um, but, uh, so exactly how you explain it. You have this, uh, when you connecting through Tor, you're going through the first, um, relay. And then that is a layer of encryption there that is protecting that communication between you and that first relay. And then the first relay connects with the middle one, where there's another layer of encryption where, um, you know, uh, it's only between the, the, those two, um, relays communication.

And then, and the middle only knows the first one, they can, they don't know who you are. They just know the communication that coming from the first one to them. And then the, then the third one, the middle pass the information to the exit one. And that is another layer of encryption. So the exit one doesn't even know who is the first one. They just know the middle one and all this protections, um, also helps with, uh, the fact that is decentralized.

So you, people are running relays within the network. They will have a hard time trying to, um, build a way to know the full path of the user. Right. Like, so, and there is a lot of other magic, let's say that happens under the hood. You like to, to pick which ones that build the secret, we call it the secret, right? Like those three relays that you're going to be using. That is some of the magic happening about the first one and some statistics that are out to protect the users from different types of attacks and that, you know, we know that could be possible to happen within the network.

That people that we have developed to make sure that, um, the different types of like calculations and statistics there to make it harder to, for the type of attack to happen. Right. Like, so it's, it's just a very simplistic way of explaining it. Yeah. That is a lot of what the little things and details behind the hood, right. That have helps protect the people's security while they're using the network. Yeah. I'm sure we could do many episodes and I'm sure many podcast episodes have been done in the past on the, the technical details of how the network works.

Um, but we'll, we'll leave that for another day. Um, but you touched on it a little bit earlier and you, you touched on kind of what you're, you're hoping that users get from using Tor. And I want to maybe clarify or simplify it a little bit to just what is it that you would hope that users get from using the Tor browser specifically? Cause what kind of shift focus into that? Cause most people are not actually interacting with the Tor network itself through like the Tor daemon or something like that.

Um, so what's kind of the key thing that you hope users get from using the Tor browser? I think the main thing is the freedom to use the internet, the freedom to access information and share information without having your data, your information about you being harvest by companies and data brokers, or even worse by surveillance. It's being surveilled by the government or law enforcement or corporations without your knowledge who are abusing your right for privacy and, you know, legal protection that you would have, uh, under certain practices, right?

Like a warrant for instance. So I think like the main, uh, hope that I have is that people have the freedom to access information and to share information while using Tor. And I, yeah, that's, that's the main goal that we, uh, um, hoping to achieve and especially focus on, you know, bring to that exercise of accessing information, sharing information to bring, um, you know, uh, the power for people to fight for human rights. It's specifically, uh, we really, um, our mission as our organization, the technology we develop and we create our vision is that this technology, we create our vision is that we create our vision is that we create our vision and that we create our vision and that we create our vision and that we create our vision.

And that's the main goal. And that's the main goal. We, yeah, we are looking for, what, for the uses of our technology. Yeah, I absolutely love that simplification. I mean, ultimately privacy is important because it enables other things and specifically because it enables freedom and Zator is providing that.

20:00 privacy, but it's not just providing privacy to provide privacy. I love that you simplified that down to it's providing privacy so that people can have the freedom to access what they want and share what they want. Just a hugely important and I think hugely clear purpose for using the Tor network. So there are definitely some huge advantages to using the Tor network. And we've talked a little bit about what that can provide to you. But what are some of the key limitations that users should be aware of when they're using the Tor browser?

I think one of the limitations that I feel people need to understand that if you are using the Tor browser, it will protect you in multiple ways. But for instance, if you log into a service, they will still know your identity because you're giving your username and your password. Another limitation is that if you are browsing a website that does not have HTTPS, right? Like it's not, does not have an encryption, encrypted connection, you will still have your data being exposed while you're communicating with that website. I think we always wanted to make clear to users that whoever controls your entry point, like the network that you're connecting that the internet provider, or if you are in a university, right? Like the people who controls that network, they will know that you're using Tor. They will know that you are connecting to the Tor network. So that is like, that's a very important point. And that's another thing that we can talk a little bit more later, which is about how we say that anonymity

loves company, right? Like, it helps to have a lot of people using the tool because you, even if you feel that you don't need, I always tell people, okay, that's fine. If you think like, oh, I will use to do one search here and maybe access a certain website, but not all the time. And I tell people, leave it the browser open on the background then. Because just to have that connection open, you're helping others who need that protection. So I think those are another important limitation that I want to explain to people is that there are certain threats that we cannot protect. If someone has access to your computer or your device, they can do a lot of things, including, you know, know that you are connecting to Tor, they might be logging your keyboard.

There are certain things that we will not be able to protect you. But definitely like, Tor is one of the most, you know, the high standards out there that will be protecting your privacy as you're browsing websites. And we can talk more about the features that we have. But I want to make sure that it's not like, there is no silver bullet here, right? Like, and there are some other things that combining, depending on how you're using the combination of factors, you will be in jeopardy. So I want to make sure that people have that also clear.

Yeah, you can't just start using Tor browser and not worry about any other aspects of privacy or security. It's not that kind of fix it for everything. Just like no other single privacy tool is there's there's not one thing you can start using that just solves all of your problems. But it, it can be a powerful tool in your toolkit that combines with other things like making sure that your computer is not compromised. Like making sure that the sites that you're visiting use HTTPS or whenever possible, you use a hidden service that stays within the Tor network. There's a lot you can do, but it is definitely not a just a, the perfect solution for every single possible privacy or security problem as it shouldn't be.

Obviously that the focus needs to be on one specific thing. And obviously it's, it's on doing web browsing right and really giving privacy and freedom to, to the user themselves. One thing we haven't touched on is just kind of the, the latency concerns when you're using Tor. Cause obviously since you're jumping through these servers that are run by other people all over the globe, you are going to have some, some slower connections and slower downloads, that kind of thing compared to, to normal web browsing. Does that kind of limit the practical use cases that you recommend people use Tor for?

Or do you, do you just kind of recommend them to use it for everything and just kind of get used to the difference in, in speed and latency compared to just a normal non-private network? Yeah. I think like one use case that we don't recommend is Torrent. Yeah. But like, I feel everything else should be all right. As a matter of fact, we know speed is a problem. It had improved it a lot. If you haven't used Tor for the last five years and you use it today, you will see improvement on the speed. And we actually working on a project called congestion control that for the past year.

So we have been experimenting and tuning this code within using simulators of the network and to improve how the load is balanced, you know, and being smarter about that within the network to improve the speed. And we are seeing really good results. This will be out in the Tor release in the next stable release. And we hope that, you know, it takes around three months or so for the volunteers who are running relays, right? Like who don't do who are part of the network to propagate and for all of them to update and so forth.

But we hope that around Q3, somewhere in Q3, that this would be already taking a great part of the network and users will start to see a great increase on the speed, you know, like in the velocity. So we know it is an issue. We have been dedicated a lot of, a lot of like, uh, uh, of, uh, resources on fixing it. And, um, it have improved it already for the past five years, but people probably towards the end of this year, we'll see a big improvement, but nowadays, like, listen, like people can watch YouTube videos.

They can do, um, video, uh, voice calls or video calls, even through Tor. And, uh, you know, if, if, uh, most of the times is a reasonable speed and I can talk a little bit more about little things you can do in case you get, you know, a secret, uh, that is not that great. And you can just request a new secret and, you know, we'll shift it around. We have, uh, uh, bandwidth scanner that helps with this, uh, the selection of, uh, relates to build your secret that are always trying to pick the fast ones.

So people have a better experience. So we have implemented little things in the network to improve that. And a big change will happen towards the end of the year that people will see, uh, improvement. So hopefully, uh, this will help it because it is a slow. I'm like, I'm in Brazil. I know it's this low, you know, and, uh, we'll, we'll be, um, yeah, this change we are testing with, uh, you know, entry points in different countries. And we are seeing difference, uh, between the speed where we, you are in Europe, where most of the network, right?

Like these volunteers and the relays are in the global north, which is another thing that we are trying to, uh, to decentralize in the, from the global north. In other having relays running other areas of the world to have different entry points in the network to make that connection faster for the user. Um, but yes, we hope that, um, these elements of congestion control with the bandwidth scanner, all those little tools that we are implementing will help users have, uh, you know, a better speed when connecting through the network.

Yeah. That's an, that's an exciting upcoming change. I had not heard about that. So I'm going to have to have to dig into that and then kind of see the, the approach that's being taken there. Um, but exciting that there are speed improvements. And like you mentioned, it's something that has been improving absolutely over the past few years. And as more people jump in and run nodes, and especially as you mentioned, as more people jump in and run nodes, not just with the same VPS provider, but run them from home, run them on, um, new locations all around the globe.

It helps to increase that speed because you can, you can spread the bandwidth that's, that's flowing through the network across more nodes and across more locations and get the entry points closer to the people actually using Tor. Um, so it is definitely something that, that has been improving, um, but can be, I think the first shock to people who jump straight from using just regular clear net browsing into using Tor. It's a very different experience because it is a bit slower. Um, but it's also something that is very easy to get used to.

And like you said, is, is rapidly improving. Um, but you mentioned there that, uh, that you can like, you can get a new circuit when you're, you're browsing in the Tor browser. And I've had some issues where like, I'm going to a website and I can't get to load or it gets slow and you're able to request that new circuit, start fresh. And usually that resolves that problem. Are there any other settings or features in Tor browser that you recommend that people kind of jump in and take a look at when they first start using it?

Yes. Yes. Definitely. Um, the new Tor secret, right? Like if people haven't noticed when you are, um, browsing, uh, a domain, uh, any website with Tor browser, if you click on the little lock, uh, close to the URL, you will see the Tor secret there. Uh, all the servers that you're passing through, and then you can request a new SQL.

30:00 The other one that I would say, which is important, is right now, when you launch the browser, that is a button for configuring the connection, if the connection does not happen for whatever reason, it fails, you can go to that configuration page. And I want to highlight this, because sometimes the connection is failing because Tor is being censored, right? Tor is a great tool to bypass. It has censorship, but Tor itself can be also censored. And in that configuration page, you can choose a bridge, which we can talk a little bit more, but bridges are Tor relays, right?

Like servers that are part of a network, but they're not public. And that makes it harder for the sensor to know the IP address and block it. We have default bridges, which are in the dropdown menu that you can select. And for whatever reason, if those doesn't work for you, it can also request a bridge. There is a button that you request a bridge. And you can, this is, we have like a bridge database that will, you're going to have to answer capture.

And then you're going to get a IP address and you will configure it to go through that server instead. And then connect to the Tor network. And this is being, you know, this is very important because sometimes people are trying to, they turn on the browser and the browser is trying to connect to Tor and it's not, it's failing, it's giving them an error and they don't know why. And sometimes people have a hard time to understand that the problem is because Tor is being censored.

We actually also working on improving that usability, right? Like that, that user experience to help the user understand that could be because of censorship and help them take the best bridge for the country. Another feature I would say we actually have the new identity feature, which is a little broom close to the URL bar. That one is very useful. For instance, if you want to make sure that all the information Tor already, you know, we, when you accessing, using the Tor browser to access different websites, we're isolated.

If you're connected, it's not easy. connections we don't allow third-party cookies tracking cross cross tabs in across websites information sharing we also put blocking finger printing we don't store anything but if you want to kill that session you initiate a whole new session that's completely clean out of like any cookies or browse history for from that session you are and kill all the tor secrets all the connections that are happening you can just click that row and we'll swipe everything and that is useful uh we we are always in touch with for users we are traveling to many countries where you know people are using the the tor and most and sometimes we have encountered people where the tor browser is installed in a shared computer so people are using tor browser and they want to just like swipe everything and make sure that everything has been swiped for the next user so and also sometimes you even have the cool cases of tor being installed on library so if you are a tor user and you are in a library you can use the new intent identity feature as as soon as you are done

using tor and just swipe everything for the next user so just in case you know that's a great one and uh finally um and we have the um another icon near the url bar which is a shield and that shield is where you can pick the different uh security levels that you can set your browser as you're using tor um and we can talk more about the different levels the standard one already protects you very well but depends on the use case you might want to change that and you can pick uh two other levels the safer and the safest level to get a little bit more protections that comes with the trade of some features from certain websites will not be working because we will be blocking things like javascript so if you are trying to open something like twitter for instance with the safest level probably will not work because there's a lot of shavascript on twitter so uh so be aware of that right like but uh that's another little feature and finally um if you are browsing different websites i would like ask you to pay attention if a little purple button in the URL bar will show up that says like

dot onion available if that exists I would recommend clicking there because that means that website has an onion site available and then connecting to onion sites you're not getting out of the Tor network like if I go for instance to top project org right now I will get out of exit relay and go to the clear web right like the normal internet and access top browser and the exit relays will also whoever right like that has a lot of the exit connection and in this case I'm just talking about top project org but it could be a website that you know it doesn't have HTTPS enabled and then you are passing information maybe your username your password and in clear tags and people are seeing that information so far but if you do click on the onion available button and you will connect through the onion site version of that website the only address right and that means that the same way that I go to three Tor nodes to get to a site when I connect into our website the onion provider also have three other nodes and I'm meeting in the middle inside of the Tor network so when you click on the secret display

of accessing an only address, you're not gonna only see one, two, three nodes, you're gonna see six. And that means that your connection is going to three servers and the website until you meet them, they're also going to three servers. And you meet inside of the Tor network, you're not even leaving the Tor network. So you have end to end encryption right there. You also obfuscating your metadata right there. So there's a lot of benefits by making that connection happening.

Even if the website does not have HTTP enabled, you will be way more protected by selecting the only available option, if that makes sense. - Yeah, no, that was a great explanation. Those are like all of the key features I was kind of thinking about. So you kind of nailed them all. And the last one that you mentioned about the data pop up in your URL bar, I think was one of the best features that's been added to Tor Browser in a while. And something that I jumped on with my websites to add that header into the config so that people who came on would see that pop up.

And I also, like I prefer when I'm using Tor Browser to enable the option to always use those .onion addresses whenever it's available from the website. And then when you enable that option, you don't even have to click the .onion available. Tor Browser will automatically see, okay, there's a .onion hidden service address here. I can just jump straight to that and not even bother with the HTTP or HTTPS site, which is absolutely awesome. It makes it a lot easier for people who are browsing to see that there's an .onion address and not have to go searching through the website and trying to track it down and hoping they find the right one.

All that fun stuff. So that's a very important feature for me and one that I love that they all came up with and pushed out. I'm glad you like it. Yeah, it's hugely important, I think. Let's take a quick break from this episode to chat about the sponsors of Opt Out, Cake Wallet, and LocalMonero. Cake Wallet is a key tool that I use daily as it allows me to easily and quickly use Monero for private by default payments. It's available in both iOS and Android and is a fantastic way to get started buying and using Monero with a simple and easy to understand user experience.

I regularly onboard new users to Cake Wallet and hope that it will help simplify and ease your journey into cryptocurrency. If you're interested in purchasing Monero for the first time or helping to bring others into a parallel economy, I'd recommend you look at using LocalMonero, like I do, to buy and sell Monero while maintaining your privacy and avoiding invasive exchange surveillance. LocalMonero is entirely peer-to-peer and is an important part of opting out of the surveillance state and into a parallel economy.

Thank you to both sponsors for their incredible support and partnership. And I hope you'll take a moment after the episode to learn more in the show notes or at optoutpod.com slash sponsors. And we, so we've talked a lot about Tor nodes, just kind of in the periphery. We chatted about the role that they play in the Tor network. But like you mentioned, that's not something that there's like a central entity that hosts them all. It's not like a VPN where you're jumping through a company's servers that they own in a data center that hopefully they own or that they're renting space in that kind of thing.

You're participating in the network when you use it, you're jumping through nodes that other people are just choosing to run.

40:00 as volunteers, as you mentioned. So that's something that listeners can jump in and self-host Tor nodes as well. But I'd love to hear a little bit more about kind of how people can self-host Tor nodes or host them with another provider, but actually run the Tor node itself. And then maybe just some of the simple concerns that they should have, especially when running a Tor node from home, because I think that can be a lot trickier depending on the type of node you're running.

But yeah, just kind of walk through that, the node landscape of people who want to run their own Tor node itself. Awesome. Yes, I love that question. So first of all, for the listeners who wants to learn more about this, I would recommend going to community.torproject.org forward slash relay. That is our community page for relay operators. It has a lot of detailed information there, even like legal resources for folks if they needed, you know, or FAQ for them to, you know, have an idea about what is needed, regrind, being careful on that front.

But let me start it by talking about guard relays, which is the first relay in the chain of the three relays, right? Like that creates a secret, we call it then guard. And the meter relay, those are the easy ones for you to run if you would like. Normally, you're not going to have issues with it. You know, the only thing that we do recommend is that they need to be stable and they need to have fast bandwidth. So in case you want, you do have fast bandwidth at home and you want to run those from home, we also mentioned that because if you are, your setup is that you have a static IP address and you are running your Tor server and it's also the static IP address is what your normal computer connection comes out.

Because of the list of all Tor relays are public, including the guard and the middle and the exit ones, some ISPs or some service may start blocking you because of it. So that could be an issue, you know, and you might have a bad experience. For instance, you might not be able to access your bank account as easy because of it. So we recommend that you have a dedicated IP address to the Tor relay and another one for your normal connections from home.

That might not be as big of an issue if you are, you know, if you have dynamic IP addresses, right? Like a much post static ones, like I just said. But we also, in case you are running from home, right? Like going back to running from home relays, another one that we recommend is a bridge relay because they are not public. Like I said, bridges are the ones that we keep it in our database. They're not part of, they're not listed publicly because they're used for users to bypass censorship.

So we don't want the sensor to know those IP addresses as easy. Otherwise, they would be blocking them and then, you know, the whole purpose of SQL Server would be killing very fast. So this would be a Tor relay that probably would give you less trouble with your high speed or the service phone, knowing, you know, that connecting that IP address to a Tor service, right? Like and be scary about it. In a way, I think bridges are something that is super useful and they're super, they're not going to receive a lot of abuse complaints.

They will, you know, not give you too much trouble, like I said. And they're super, super impactful for our users. We are just now coming out of a campaign for people to run bridges. We ran this campaign for like a month and we, our goal was 200 bridges and we are with over 1,000 bridges. Awesome. Which I'm very thankful, yeah, for all the volunteers out there who jump on this campaign. But I think if you want to collaborate with the Tor network, think about a bridge, you know, people sometimes think, oh, the bridge I never use it.

They, it's so important that they exist because when they're needed, we need to have them and they will be used it a lot. Right now, we're having a lot of cases of censorship against the network and this is making a huge difference for users from Russia and other areas where Tor is being censored right now. Yeah, bridges are one of those things you hope you don't need, but when you need it, it needs to already be there. So it's definitely something that it may never be used and hopefully there's no need just because there's no censorship, but you need those bridge nodes ready and available so that when people are censored, they have something to jump through.

So, sorry, I just wanted to make sure how, make sure people know how important it is that those exist, even if you run a bridge node and you don't see much usage. No, go for it. I support your page 100%. It is super, super important, yeah, to have those available and so we can switch them, you know, and distribute to users as quick as possible. And the other one, of course, right, like we had the exit relays and those are the ones that have the greatest legal exposure because all the traffic of the Tor, right, multiple users are coming out of that IP address.

We do not recommend that you run those from your home at all because of that exposure. However, most of the complaints can be handled pretty easy. People who have run exit relays, you know, normally they receive DMCA notice and we have in our portal community.torproject.org we have letters like template letters that you can easily send to your ISP, you know, or whatever entity that are reporting those complaints to you. And most of the time, it's very easy to handle.

it's not like we have folks who have run exit relays for a long period of time and they haven't had like a lot of like big, they haven't had big issues whatsoever, just like small letters of complaints, DMCA or other like ICP complaints that are easily handled by the template letters that we support the community with. However, if there are legal issues, we also have recommendations, you know, of legal support that people can go for different organizations, EFF, others have helped from different countries.

So we try to build this community, right? Like to give support to other volunteers who are running exit relays or any type of relay from the Tor network. We also have, I want to do two other pictures. Yeah, go for it. One is that there are nonprofits out there that exist to bootstrap Tor relays in different places around the world. So if you want to collaborate with the network but you don't want to go through setting up a server and taking care of it, you can make a donation to those organizations.

They are listed on your community portal as well. And finally, I think, you know, if you're short on money, that's fair and you want to collaborate, that is another way that people can help. It's just super easy. Anyone, like you don't need to have any knowledge about running a server, which is with the Snowflake Plugable Transport. Snowflake, the way you collaborate, it's a web extension that you can install on your Firefox or Chrome and you just leave it there running.

And what is going to happen is that it's going to donate your bandwidth for users who are choosing Snowflake when connecting to Tor, right? Like as a bridge or plugable transport to bypass censorship. Your IP address is not going to be exposed. The sensor will now know that you're collaborating with this bandwidth. Snowflake has a broker, right? Where it collects all this bandwidth from all the volunteers who are running this web extension and is setting up the connection for the sensor users to use it as a proxy to get into the Tor network.

And the cool thing is that, like I said before, one of the ways that Tor is censored is because the IP addresses from the relay networks are part of the network. They're public. They need to be public. We need to know who is out there. So we created at least like a snapshot of who is out there that, you know, every hour and public that leads to the clients so they know who is out there to build those secrets, et cetera. So one way the sensor can block us is by blocking those IP addresses.

And there's a more sophisticated way, which it is by deep package inspection, which is analyzing the protocol, right? Like, and being really smart about it. So Snowflake, what Snowflake does, it obfuscates, right? Like it covers up the Tor protocol and pretends to be a different type of connection. So with Snowflake, it pretends to be a WebRTC connection, which is the type of connection you have when you're doing Google chat, you know, like video chat.

It's the type of connection or Jitsi for the privacy supporters who are listening to the show, right? It's that type of connection. So it pretends that you're having a WebRTC

50:00 RTC connection a video chat and that the game here is to make it super expensive for the census so if they are to block every web RTC connection out there and it will affect a lot of communication within the country or the region or whatever that they are trying to control the communication right like so it would be very expensive for them to do so more expensive than just blocking the tor protocol so the top packages so we pretend to be a web RTC and as soon as we bypass the sensor we go through the tor network through that proxy you connected to the secret and you are in the normal tor network so if you want to collaborate with the snowflake you can go and install a web extension on your Firefox browser and you're going to be collaborating you're going to have a little it's no fake icon on your browser you can click there and you will you know you can turn on and enable and disable and will also tell you how many users you have helped circumvent censorship with your like the bandwidth that you're sharing which is pretty cool and I have seen a lot of

people sharing a screenshot of that being very proud of collaborating to have to help someone have free access to the internet yeah I love that it does give you that just simple statistic on how many people you've helped out because I think that I would love to see that more in privacy tools where you can actually contribute like technically to the the way that the privacy works in the project because it's just really it's a it's a great incentive for people to to get a tangible number on how many people they've helped gain access to the internet to gain freedom and how they access the internet it's a huge piece of that and if you listen to this and you do nothing else I hope that you just go to the the extension store for whatever browser you're using if that's Chrome if it's Brave if it's Firefox and you just install install the snowflake extension it takes two seconds and you don't do anything after that but it is an awesome tool yeah I can share mine right now mine says number of users current connected one number of

users your snowflake has helped circumvent censorship in the last 24 hours 34 so it's pretty cool it's painless you know like you install the web extension you're helping a lot of people out there yeah absolutely I love that that effort it's a very fascinating way to to work around censorship and um just a quick note on running a node I've been running a middle and guard relay or a guard relay for about a year now um and the only issue that I've run into I used to run one from home and I don't need more but I used to run one from home and oddly enough the only issue I ran into was that Netflix and Hulu just started baiting me and not allowing me to watch anything so the wife wasn't very happy about that one so the the home tour relay went away quickly when I couldn't get that cleared up but I've been running one on a Hetzner dedicated server for a year now and it's been awesome to see the amount of traffic that's gone through that I mean I think I average about 70 terabytes of data a day

going through my my tour relay there which is just an awesome way that I can I mean I don't even think about it anymore that it's running it's been painless it stays up I haven't had to do any maintenance there just gets updated with the rest of my system packages and it's a great way that that I can contribute there but um definitely who whoever can run them from home or from other countries that are less saturated I know Hetzner is not a great uh provider to run tour nodes through because so many people run tour nodes through there you kind of lose the the some of the benefit because everyone's running through the same service um but that has been a fun project for me to be able to run that that node and and play around with it and definitely would recommend people do that the the resources for running them have improved drastically since I started running a tour node um so I love the the new portal that you mentioned on community.tourproject.org it's it's gotten a lot better and um is improving rapidly but it's a it's a great way to to jump in and help to support tour

and help to support the people that are using tour to gain privacy and to gain freedom of access to the internet um just massively important and um thank you for mentioning so many different ways Isabela that that people can step in and and help in a um technical and non-technical sense because running snowflake takes zero technical ability if you can install any browser extension you can install snowflake and and help people out that way and thank you for running a node thank you so much I appreciate that especially yes um having a stable one like a guard one is really cool thank you yeah no it's been great it was one of the first things that I I spun up and kind of started running as a a public service and it's been a it's been a fun experiment and a fun project to to run and definitely hoping to keep it up as long as possible and hoping to expand and add some more nodes soon um hopefully in in new geographical locations uh to start kind of spreading that out a little bit um so we've talked a ton about

the tour network itself and I do want to touch just very briefly on if there are any tools out there that could be considered alternatives to tor um I hesitate to say that like vpn is an alternative but maybe you can touch on quickly the differences between using tor the tour network and tor browser versus using vpn but if there are any other alternatives out there to tor as well I'd love it if you could just touch on those yeah I feel like um there is I2p that is name and vpn like just mention um people you know um it's more common that people jump on a vpn right like when they're looking to hide the ip address but I think that is the the difference here I would say is one is the number of users right like how many people are using the tool because like I said anonymity loves company right like if it it's a new tool that is just good strapping you still kind of like a little bit exposing right like there's not that many users um another thing I would say definitely like the open source aspect of the tool right you should look it up

because I feel one of the good things the benefits that we um have at tor is the fact that we have a very uh active research community researching tor all the time and writing papers about tor and thankfully because our tool is open source they can see the code they can do experiments right like we have this network simulator that is used by researchers as well and all of this benefit us because all the papers all the information that gets out and help us improve our tool so it's not only a validation right now that that the users have about our technology but it's also if we were to actually um put it in dollar value the amount of like knowledge we receive from the papers we would never be able to pay the people who are doing the research to give us this knowledge and we receive this from other researchers out there so a big shout out for the research community and all the support that they you know they help us improve our tools so much so we really appreciate that and this is a huge factor right like it's not only like

oh it is open source is one thing but like who is looking at the code you know it's actually like auditing this code who's actually writing about it and telling okay i found an issue you know like or like okay it's good you know it has protections about this attack or we we having uh moments where building defenses of attacks that are just in paper that haven't been executed yet because of the benefit of having access to those uh research results right like and so forth so that's another big thing and finally the nature right like of the decentralized decentralized nature of the network i think this is one of the biggest things regarding vpns because um at the end of the day uh the vpn it is controlled by one entity and they control all the servers that you are using to connect so you are literally trusting them you know here you're trusting them when they say oh we're not looking at the traffic we're not using your traffic you're not analyzing your traffic you need to give all that to one entity the trust one entity at all

or beyond the fact that our code is open there are people auditing your code we don't control the network is decentralized it so there is no way that like the the trust is by design is not by wish you know oh you can you can't you can't you can't trust me we even have a joke in brazil about it but like i don't know how to translate to english but anyways but it's my wish i would say right like oh you i wish that this this service is just worth it and i will just like uh you know get the benefit of the up and and you know like uh go with with my with my hopes that it is what they're telling me that it is you know and uh with us that is not the case like it is by design and like i'm not asking you to trust me on the top project organization it is by design the code is out there it can be out it and the decentralization of the network is also a huge benefit so that is one of the main um i think counterpoint uh i think counterpoint is the fact that you are just um hoping that what they're promoting and what

they're saying it is true you know and uh there is no most of the time it's almost impossible to validate that that is

1:00:00 There's no auditing. There is nothing that you can see from a third party that validates what they're promoting, the benefits that they have, you know, that they're promoting to you. Yeah. Yeah. I mean, it's a very important point that people understand that VPN services, they are by design trusted. You have to trust that they are properly handling your data, that they're not logging all of those things. I mean, there are definitely ways that VPN providers can go above and beyond and can do third party audits and have every piece of the client and server code open source.

There are definitely ways that they can help to give some more transparency into that process. But it's always going to be something where you're having to trust them implicitly. And it really is a different focus for me between VPNs and Tor because VPNs just really help you shift the trust model from the network that you're on at that moment to the VPN provider themselves, whereas Tor helps you to shift the trust basically out of anyone's hands because they're using a set of nodes that are run by different people that change every time you make a new circuit.

And none of those nodes have total control over visibility into your traffic and can't log every piece of that transaction. So it definitely is a different focus, but it is very important that people understand that like a VPN is a service you have to trust. Tor is not a service you have to trust, but there are some downsides to being decentralized in anyone running a node, which is that speed can be an issue. Specific circuits can have problems.

You can have malicious nodes on the network that can cause problems. There are some downsides there, but overall it's a more trustless by design model, which is very, very important there. Yes. Yes. You're right. You know, thank you for bringing up the point about malicious nodes. Does that affect and exist, you know, and we have, I would say like three years ago, we would be in a terrible spot dealing with the situation than we are, you know, today.

We created a team inside outdoor, called the network health team, just to because of the need to have a dedicated team, just taking care of the network. Right. Like watching for patterns that could demonstrate that the relay is a malicious relay. That's another thing I want to say, right? Like one of the things that could happen, for instance, if you are connecting to a website that is not HTTPS and, you know, you get a malicious exit relay, they can be scanning your connection and being collecting all the information.

So it's extremely important that also the service that you're accessing through the network has encryption enabled as well. But that said, it's not just on you, right, like it's on us as well. And we are creating tools and mechanisms to identify patterns of bad behavior to quickly not only identify, but kicking out this relay from the network. Another thing that we are investing a lot, and this year is going to be another year that we will continue this work, is the relationship with the volunteers.

I think when Tor started, right, like in the early 2000s, kind of like bootstrap it by, and there was this, how do you say, degree of knowledge. Like, I know you who knows that person, we all running Tor relays. You know, but nowadays we have 6,000 people running Tor relays, you know, like, so it's kind of hard to actually know everybody who is out there doing this. And so we are in depth of, with the community, right? Like, we are in depth of building a good governance of the community.

And governance are in a way of like, you know, like, oh, I'm going to control you. But also, of a good coexistence of trust relationship being built, and also building, how can I say, kind of like small communities that know each other, right? Like, in by regions, we are organizing. I mean, with the pandemic, that kind of like slow down, but we were organizing meetups, like face-to-face meetups, as much as we could on events or every opportunity, actually, that we could.

We recently had relay operators meetup at CCC, as just happened through the, you know, New Year's holidays. And we are building more support on communication on the Tor relays, email list, on IRC. And we are investing a lot on regaining that relationship with the community, so we can have, you know, like a health community, right? Like of operators. And through that process also be one of the ways that we can eliminate, right? Like bad relays or people that are not demonstrating goodwill, you know?

So there are certain different checks that we are identifying that like, okay, if this person is not checking all these boxes, they're not demonstrating goodwill, goodbye, kicking out of the network. So I think this investment, it is, it has been proven, you know, often on the past three years, how important it is. And we have been able to react faster and identify and react faster to these cases. So the network stay healthy, right? Like that's the name of the team, network health.

So the goal here is that we have a healthy network and that our users have a high level of trust with the network that they're using. Yeah, I'm glad you touched on the risk of malicious nodes there because that was, I think, a very important listener question that someone brought forward, which was kind of like what risks are associated if there's an exit node that's malicious or something like that? And are there any other node types that could be dangerous if that node that's a part of the circuit that you get is malicious or compromised?

Is it a problem for like your entry node or your guard or middle relay nodes? Or is it really only the exit node that's problematic? Well, so there is different types of attacks, right? So it depends on recently we have had one where they were overpopulating the network with relays, right? Like so the more you have nodes on the network that you control, the higher is the probability of a CBO attack, right? Like which it is means that you're analyzing the traffic and trying to do correlation and guess that this is the one that this user did and the anonymize the user, right?

So that's one issue. So for instance, we are taking actions. We are trying to, you know, be kicker when we see a lot of nodes coming into the network and identifying them as coming from the same, how can I say, provider or operator, right? And doing that relationship and kicking them out because sometimes it's not clear, you know, they don't make it that easy to, for you to connect at different types of relays And then we're trying to make it that easy to connect with the network and to make it that easy to connect with the network.

So, we are creating different scripts out there that are like, I think this is always like, it's a, it's a type of work where every little bit that you learn, you apply and you get better for the next time, you know, because it never going to be a clear game and they will be changing all the time. So, yes, that, that, like if someone has a big, big number of nodes in the network and they're malicious, they could be trying to do this correlation analysis.

So, yes, it's not easy, I would say, because one of the things that we do, for instance, is that not every relay can easily become a guard relay. So, yes, that's a good relay and we, another protection that we apply to the user is that a guard relay that is flagged as a good relay. And the user has that, you know, as a, the first entry point to build secret. So, yes, they get, they get stuck with it for a long time. So, that's another thing that was like a kind of like something that we had to teach our users because it would request a new secret and the middle node and the exit node would change IP address, but the guard would stay the same.

And they were like, oh, there's a problem here. So, I was like, no, this is, this is intentional because statistically speaking, if the last you change, the last changes you have of getting a guard relay that is malicious, you know? So, and for you to become a guard relay, you need to receive a bunch of like, you need, you just, you cannot just put a relay on the network and will automatically be flagged as a guard relay. So, there's a lot of little things that we created over the time of the course of the years that to, to, to salvage, right?

Like the, what we're offering and what, what we give it to the user and protect the users against different possible attacks. And just to highlight again, right, like those exist thankfully to researchers and the papers where they propose the solutions and we adapted them into the network as well. So, yes, that can be just to solve the problem.

1:10:00 summarize the point that can be different types of attacks. We are always in the game of trying to protect the users from them. Now we have a dedicated team that is proactively analyzing the relays that come to the network and kicking off, expelling the ones that we identified as possible malicious one. And I recommend that the users, especially when not accessing the Onion site, accessing clear website, website on the clear web to look for HTTPS websites, because there is another layer of protection on the top of using Tor.

- Yeah, absolutely. And thank you for walking through all the details there. It's a very tricky one. And like you said, it's not something where you just kind of, oh, we've solved all of the problems. Tor is perfect now. No privacy tool and really no project that's based in code is ever to this point where everything is perfect. We don't need to touch it anymore. It's a constant arms race, especially in the privacy space. So you're constantly having to analyze what's going on, figure out what you need to change or improve, make those changes and start analyzing again, and just constantly have that process.

So it is such a valuable thing that the Tor network is so well known, and it's so well researched because so many people want to better understand how Tor works, how it can be attacked, how it can be used. And so many people are putting forth that effort on research. So definitely very grateful for the people who have chosen to spend their time focusing on Tor and helping to make it get better over time. And the kind of the other way that people have helped to drive Tor forward is obviously funding.

Funding is a tricky thing in the free and open source space. And obviously the Tor project is a nonprofit. So could you give us a little bit more insight into how Tor is funded or made sustainable? Yes, of course. It is something that is always, right? Like as a nonprofit, we depend on grants, we depend on donations. I just also want to take the opportunity to thank everybody who made donations last year, during your campaign. We brought records and we're going to be publishing a blog post about it.

We also publish on our blog every year about our financials, right? Like we kind of like the sack of our tax report and we talk about the money that we receive. And we are like, we do have grants from governments, especially the U.S. government, right? Like this is a part of our organization. We want to be transparent. We don't hide any of that information is on our website. We not only you can have access to our tax documents that you can see that information, but we make sure that we write about it to make it easier for people to understand each bit of that.

And we talk about, right? Like we have our sponsors page where you can see who is giving money to Tor. So right now we are around 50% of our revenue comes from grants from different areas of finance. From the U.S. government. One is the GRL, which is the human rights department of the state department. The other one is the NSF, National Science Fund. We also got funds from the Sweden government, not only the U.S. government. In the past we have got from the German government as well.

We receive funds from private foundations. We have grants with Ford. We have grants with Sloan Foundation. We had got a grant from the Zika's mega fund, Zong, recently. We also are super thankful for all the people who donate to Tor, right? Like they are individuals who make donations either by fiat currencies, right? Like U.S. dollars or whatever, but also through cryptocurrencies as well. We receive a lot of donations through cryptocurrencies and it keeps growing.

And we are very thankful for folks who do make a donation because one of the thing is that as a nonprofit, we do depend on grants. But the grants are, I think, like are complicated because we are developing technology. So imagine like you need to think you have an idea today. You cannot execute that idea today. You need to put that on a paper, send the proposal, wait six to eight months for that to get approved until you can start working on that idea.

That kills any developing team, you know? No feeling. And yeah, so we want to have a buffer to be on our roadmap, right? Like that we can be agile. Also, we can respond to security issues, you know, or we can just focus on projects that are not part of a grant and just put that on the roadmap and have capacity or some time of our bandwidth, right? Like as people to work on those and the way we can do this is through the money that comes from individual donations.

So that money allows us to have that spot on our roadmap, you know, where we can do whatever we want because it's not tied to a grant proposal. And that allows us sometimes to start ideas quicker, you know, and not have to wait six months. Maybe we will have a proposal about the idea, but already in a more mature phase of the idea, we can bootstrap the idea with this individual donation money, you know? So the dream, I would say, would be that Tor would have more of this unrestricted money as part of a revenue, right?

So we can be like any other tech organization out there, completely agile and just execute ideas as soon as we have them. The reality is far from it. Unfortunately, we still depend on grants. We are thankful for the grants that we get. Otherwise we would not be here, but we still depend on them and it slows down the execution sometimes. And we are hoping and we have invested a lot. I have been part of Tor as an employee since 2015. I became executive director in 2018.

And I can tell you from the moment I arrived at Tor, this has been one of the goals of Tor. And we have increased the piece of the budget that comes from individual contributions significantly. And it is making a difference, allowing us to sponsor a project, a bootstrap ideas before we have the funding for it. One example I can give you that is recent is the RT project. Like RT was a kickoff by Nick Matheson during a period of time. We didn't have any money allocated to RT.

And then Nick came with like, okay, I did this small client. RT is an implementation of Tor in Rust. So we are rewriting the code that runs on the Relays run, like on the Tor, Demon code and the clients as well. But like we're writing that in Rust. Right now it's on C and it's terrible. It's like spaghetti, you know, it's super difficult to make things better. It's not optional for mobile either. And with RT, we will be having better API. So applications that are running Tor, right?

Like we have a whole ecosystem out there that use Tor as a layer for the solution that they are giving to the users, right? Like of protections. So that will be much easier for them to do so. And RT started with individual contributions. And now we have a Zcash Foundation grant for it. And we are just releasing the 0.03. Oh, I'm going to get the release. Well, let me just double check. But anyways, it is becoming a more mature project. We have, yeah, 0.03.

We have with this grant, right? Like we hired people and, you know, Rust developers and we are getting the project to move forward. But it was, we didn't have to wait for a grant to get it started. And that's what contributions like that help us, you know? Yeah. And so glad to hear that you have seen that percentage of the budget that you have grow and grow over time. And it's so, so important. And I hadn't even honestly thought about the agility piece about how it lets you focus on what seems best for the TOR network rather than what the specific grants are focused on.

But the other piece to me is just that if that grant funding dries up for whatever reason, even if that's just that governments decide that we really don't like privacy and TOR provides privacy and we don't want to fund it anymore. And maybe academia follows suit and those things dry up. It's really important that the individual donors step up and have that base so that the TOR can continue operating and not just operating, but growing and improving over time.

But you did leave out the best part about donating to TOR is you can get some pretty awesome swag.

1:20:00 Some of my favorite shirts are my tour network shirts. So definitely a huge bonus there. But I did have one more listener question for you that I almost skipped over. So I did want to touch on that. And then we'll close this one out because I know it's been a little bit long. But the last listener question I had for you was just what should listeners understand about pairing Tor with a VPN? So I know we touched on the differences between Tor and a VPN.

But I think there's a lot of confusion around those people who like to use VPNs but also want to use Tor. Are there any kind of gotchas or key things to know about using Tor while also using a VPN? Yes, I feel like one of the cases that people do that a lot is because they don't want the internet providers to know they're connecting through Tor. So they connect first to the VPN and then they connect to Tor. But the VPN provider will know they're connecting to Tor.

For sure. Right? Yeah. So that is that. Right? Like I think we don't recommend, you know, because it is for once like you adding one more hoop there. Right? Like, and probably going to have like more issues. So another one is that I don't know what is worse. Right? Like you trusting the VPN or your ISP about you connecting to Tor. I think the issue again goes back to the point that VPNs are centralized services. And most of the time you don't have guarantee that who's controlling the VPN is, you know, actually respecting your privacy.

And I feel that definitely going to choose that. Yeah. To choose that adding one more watcher to your connection. I'm not sure if it's the best solution for people. So I definitely like, we definitely say normally recommends people to just, you know, bootstrap Tor directly from your Tor browser. Another thing that, yeah, the main case that I see people doing this is because they don't want the ISP to know they're connecting to Tor and they're trusting the VPN to be the watcher that knows that.

So the downside here to simplify is that you're adding one more person to watch what you're doing. So you're connecting to the VPN and then, so you have your ISP knowing you're connected to the VPN and then you have the VPN knowing that you're connecting to Tor. So I don't know if that is good or bad, but like, in my opinion, definitely it's not a good idea to be adding more people watching what you're doing into the pipeline, you know? Yeah. And I think the other piece too, is that as the censorship resistant tools within the Tor ecosystem improve, you shouldn't need a VPN for the purpose of getting around censorship of Tor either.

Because I think that's another use case I hear people talk about is if Tor is blocked, they can connect to a VPN and then use Tor. But the censorship resistant tools in the Tor ecosystem are definitely more laser focused on using Tor without or with censorship going on around you. So that's definitely, I don't think that that's like kind of the ideal use case. But it is interesting that people use it to avoid their ISP seeing them use Tor, which like you said, that can be good if you trust your VPN more than you trust your ISP.

But it's very much like a not necessarily a great thing like you shouldn't, I would never like widely recommend that for sure. I think the other key reason that people like may use Tor with a VPN is because they use an always on VPN anyways, and then they want to use the Tor browser anyways. And it just happens to be going through VPN, which I think is probably one of the more common things. But going out of your way to use Tor with a VPN is usually not something where you're going to gain anything unless you have a very specific reason for why you want to do it.

And you understand the implications of doing that. I know in the censorship case also, right, like you write about the fact that, you know, with the tools that we have created to circumvent censorship against Tor, right, like they become more and more sophisticated. We are, we have been working a lot on improving that experience. So much better. Yeah, exactly. So, every year. Another thing that I'm very proud at Tor is the fact that for the last, you know, five years at least, every year, there is a major release of Tor browser with some big use user experience improvement.

You know, last year we kill it, the Tor launcher. And now you don't have that like window that pops out anymore. It just like, it feels part, it's part of the browser experience, right? So much better. Much better. Yes, exactly. And we will have one this year where we are improving that piece about identifying that Tor is being censored and picking the Ciclvation tool. The Ciclvation tool, it's way more sophisticated and also will protect you much more than just going through a VPN to connect to Tor.

So definitely try those Ciclvation tools if that's the case for you. Yeah, absolutely. And usually if you're in the case where Tor is being censored, a VPN is going to be censored as well. So that's definitely not a normal use case that is ideal there. But yeah, thanks for jumping into that a little bit. I think that's a common one I get is, oh, I use VPNs, but I also want to use Tor. How do those things interact? So great to get some clarification.

But last question I have for you is really just how can listeners jump in and help support what you're doing with Tor? And I know we've covered a lot of this with running a node, with running the Snowflake extension, with donating. Are there any other key ways that people can jump in and help out? Tor is about community. Like everything, right? Like from being a volunteer that helps with translation or someone who contributes with the code or someone who reports a bug, you know, like jump to our forum.

We have now last year we launched a forum, forum.talkproject.org. You can help reporting issues there. You can also support all the users there, right? Like answer users questions. We always need help, right? Like especially giving support in different language. Community.totproject.org also has a way for you. If you are someone who works with human rights defenders or other communities at risk, that needs to learn how to protect themselves while browsing the internet.

And you want to, you know, get the skills to become a trainer and learn how to teach people how to use Tor. We have materials for trainers. We have a lot of resources that can help you, you know, obtain those skills and a community that can support you on that process. We also have, we don't at all collect data about our users. So we depend on help to get, to do usability tasks with people. Normally the trainers, we combine the training with usability tasks.

And that's how all this improvement on Tor browser that I spoke of comes from that. Comes from like talking with real users, real people, and just listening to their feedback and testing new UIs with it. Seeing what works, what does not work and improving the browser as it goes, you know, through that feedback. So if you want to collaborate with it, it's not like, it's not a rock science. It's much easier than you think. And we have a lot of tutorials to give you to that helps you do their work.

You can, what I can, what else? Oh, we also have information if you want to collaborate by just letting people know about onion sites and about onion service. And that tech, this piece of technology that, you know, it's a plug and play kind of like feature for your website or service that will give you all the benefits of the security and protections privacy protection that are offers for free on your website. So if you want to be someone who advocates for that, it's another way to help Tor.

So research, right? Like we spoke about it. So there's 20,000 ways on how to help Tor. Please go to the community portal, go to the forum and plug in, you know, please. Like we would not exist if it was not for our community. So we will outcome a lot and we try to do our best to support the volunteers that are collaborating with the project. So glad that you stress community there too, because that's something that I try to kind of hammer home is that community is so, so vital to this process.

It's, it's vital to privacy. It's, it's vital to freedom. And like you mentioned, it's vital to a project like Tor. So definitely a, a huge part, huge, huge part of that. But I just wanted to say thank you again, Isabela, for coming on and just taking this hour and a half out of your busy schedule and sitting down and chatting with me about Tor.

1:30:00 I think it's going to help a lot of people better understand what Tor can do and can't do. And just give us a much better picture of how the tool fits into our toolkit. So thank you again so much for coming on and chatting with me today. Thank you for having me, Seth. It was a great conversation. I really like it. And yeah, thank you for your work, for having such a great show covering privacy. It's a very educative show. So thank you for your work as well.

Thank you so much for the kind words. Definitely a privilege to be able to have these conversations and help other people on the journey that I'm on. But it's been a blast. So have a great night, Isabela. You too. Have a good one. Thanks for listening. And I hope you enjoyed this episode of Opt Out. If you did, please take a moment and subscribe to the podcast. Or if you're already subscribed, share it with one friend or family member this week. As always, you can check out the link to the guest content and contact info, as well as links to all of the tools we discussed in today's episode.

Now get out there and opt out this week.