Tor / GPG

Hello all, how've you been?

I've just gotten into encryption and anonymization programs for my computer. To start with, there's Tor (wiki). Tor stands for "The Onion Router." It works on the idea of nodes. When you send a packet into the Tor network, it's encrypted on your system. Then it goes from your computer to an entry node, which only knows where you are, not where the packet's going. In fact, the entry node doesn't even know if it's originally from you, or if you're just routing it for someone else. The entry node tosses it to a middle node, which knows absolutely nothing about the packet. Finally, it's given to an exit node, which decrypts it and forwards it on to the destination. The exit nodes knows where the packet is going, but not where it came from.

This entire pathway changes every 10 minutes. When used correctly (with a proxy to clean up your requests, something like NoScript to prevent client side scripts, and some dicipline with cookies), it becomes impossible (or rather, computationally infeasible) to determine who you really are, what you're saying, or even that any two sessions are by the same person! Nifty, huh?

Another feature of Tor is called the hidden service. It applies this principle in reverse, so that servers can be hidden geographically (IP address) from censors. If you go on the Tor network, you can reach them. I have a hidden server (with a simple test page) set up here. Of course, clicking on that while you're not routing your packets through Tor will give you 404 or worse.

Besides Tor, I've also installed GPG, which allows me to digitally sign my emails, proving I am who I say I am. It also allows me to encrypt them (assuming I have your public key), protecting them from prying eyes. You can download GPG for Windows here. All that remains is to integrate it with your favorite mail client. If you use Thunderbird, you can download the excellent Enigmail extension. If you use Microsoft Outlook (shame on you!), do a search for GPGol. I've never tried it, but I assume it's a pretty good program. If you use gmail in Firefox, get Firegpg here. Once again, I've never used this, but the screenshots look pretty nice.

If you insist on using an IE-based browser (Asif!), I'm afraid you're out of luck. I'm sure SOMETHING exists, but I'm not gonna look for it.

My GPG public key can be found here. With it, you can send me encrypted email, and verify that email I've signed is actually from me.

Cheers.