The onion routing of Tor routes each request through three relays (guard, middle, exit), each only knowing the previous and next node. This architecture prevents an isolated relay from correlating the source IP address with the final destination. All security relies on this separation: compromising it is akin to browsing in clear text.
Tor Circuit and Exit Node: the Real Attack Surface
The most exposed link in the circuit is the exit node. When the destination is a standard site (HTTP), the traffic exits in clear text at this relay. A malicious operator can then intercept credentials, cookies, or unencrypted content.
On a .onion service, the circuit never leaves the Tor network: there is no exit node. Encryption remains active end-to-end. This is why .onion addresses offer a higher level of privacy than .com sites accessed via Tor.
A guide detailing this mechanism is available on the Construire la Bretagne website, which also covers the legal aspects related to the use of the network.
Another often overlooked point is the guard node. It sees the user’s real IP address. If an attacker simultaneously controls the guard and the exit of the same circuit, traffic correlation becomes theoretically possible. Tor mitigates this risk by keeping the same guard node for several weeks, limiting exposure to a single trusted relay rather than a random rotation.
Tor Browser: Stable Version, Updates, and Network Configuration
Tor Browser is based on Firefox ESR. Each security patch released upstream by Mozilla is integrated into the Tor browser updates. Delaying an update, even by a few days, exposes users to already publicly documented vulnerabilities.
Stable or Alpha Version
The Tor Project publishes two branches: stable and Alpha. The Alpha branch is not intended for regular or risky use. It is used to test experimental features and may contain regressions. To access the dark web, we exclusively recommend the stable version downloaded from the official Tor Project website.
Network Settings to Check After Installation
- The security level of the browser (accessible via the shield in the address bar) should be set to “Safest” to disable JavaScript on all sites. This setting breaks some content but drastically reduces the client-side attack surface.
- obfs4 or Snowflake bridges allow bypassing Tor blocking by an ISP or a national firewall. Without a bridge, the connection to the first relay fails in censored environments.
- DNS resolution goes entirely through the Tor circuit. Manually modifying the browser’s network settings or forcing an external DNS proxy nullifies this protection and causes DNS leaks.
A technical detail: never resize the browser window. Tor Browser opens in a standardized size to reduce fingerprinting. Changing the window dimensions creates a unique fingerprint that facilitates tracking between sessions.
Tor Anonymity and Identity: What the Network Does Not Protect
Tor encrypts transport, not behavior. Connecting to a personal account (email, social network, banking service) from Tor immediately links the activity to a real identity, regardless of the number of relays traversed.
The same issue arises with file metadata. A document downloaded and then opened outside the Tor browser can contact a remote server, revealing the real IP address of the machine. Any file downloaded via Tor must be opened in a disconnected environment or on an isolated virtual machine.
VPN and Tor: Which Combination Makes Sense
The question of using a VPN alongside Tor is divisive. Two configurations exist:
- VPN before Tor (Tor over VPN): the ISP sees a VPN connection, not a Tor connection. The VPN provider, however, knows that Tor traffic is being generated. This configuration protects against the detection of Tor usage by the ISP but shifts trust to the VPN.
- Tor before VPN (VPN over Tor): the exit node sends traffic to the VPN. A more complex configuration, rarely necessary, which prevents the destination site from knowing that Tor is being used, but exposes the traffic to the VPN in clear text.
- Without VPN: Tor alone is sufficient if the priority is anonymity and not bypassing detection. Adding a VPN introduces an additional trusted third party, which is not always desirable.
The choice depends on the threat model. Against a curious ISP, the upstream VPN is justified. Against an adversary capable of judicial requisitions from the VPN provider, Tor alone remains the most coherent configuration.
.onion Sites and Search Engines on the Dark Web
.onion addresses are long alphanumeric strings that are impossible to guess. There is no centralized directory equivalent to Google. Specialized search engines (DuckDuckGo in .onion version, Ahmia) index a limited fraction of the available services.
The reliability of a .onion site is not verified by its appearance. Phishing sites replicate known interfaces by changing a single character in the address. Checking the full address from an independent source (trusted directory, PGP signature published by the service) remains the only effective precaution.
Legitimate .onion services include mirror versions of news media, encrypted communication tools, and reporting platforms that protect their sources. Accessing the dark web is not illegal in itself in France, but the activities conducted there remain subject to common law.
The protection offered by Tor relies as much on user discipline as on the network’s cryptography. An up-to-date browser, compartmentalized behavior, and a clearly defined threat model constitute the three pillars of truly anonymous browsing.
