WEBVTT - TechStuff Goes Dark 0:00:04.120 --> 0:00:07.160 Get in touch with technology with tech Stuff from how 0:00:07.200 --> 0:00:13.840 stuff works dot com. Hey there, and welcome to tech Stuff. 0:00:13.840 --> 0:00:16.400 I'm your host, Jonathan Strickland. I'm an executive producer with 0:00:16.440 --> 0:00:20.160 how Stuff Works in the Love all Things Tech and 0:00:20.320 --> 0:00:23.520 tech Stuff. Listener Tyler wrote in to ask me if 0:00:23.560 --> 0:00:29.640 I could do an episode about the dark Web. Yay. Now, 0:00:29.680 --> 0:00:33.000 I've done episodes in the past relating to the dark Web. 0:00:33.040 --> 0:00:34.760 I've talked about what the dark web is, but I 0:00:34.800 --> 0:00:37.000 figured revisiting it is a good idea. That's one of 0:00:37.000 --> 0:00:39.600 those topics that tends to be in and now the 0:00:39.600 --> 0:00:42.199 news pretty frequently. In fact, the day that I record this, 0:00:42.880 --> 0:00:47.240 a couple of different news stories came out about relating 0:00:47.320 --> 0:00:51.360 to the dark Web. And when people start bandying about 0:00:51.400 --> 0:00:54.600 that name, uh, a lot of different ideas come to mind. 0:00:55.000 --> 0:00:57.240 So what is it all about? That's what we're going 0:00:57.280 --> 0:00:59.279 to try and answer. The very name conjures up this 0:00:59.320 --> 0:01:02.200 idea of a egal goods and services, kind of a 0:01:02.320 --> 0:01:07.360 black market for the Internet, and that's definitely a part 0:01:07.800 --> 0:01:09.679 of the dark Web. In fact, you might argue it 0:01:09.760 --> 0:01:11.360 is a very large part of the dark Web, but 0:01:11.400 --> 0:01:15.959 it is not the whole picture. So here we go. First, 0:01:16.959 --> 0:01:19.600 it's good to remind ourselves of how the world Wide 0:01:19.600 --> 0:01:23.440 Web tends to work. The web we typically use on 0:01:23.480 --> 0:01:27.839 a day to day basis, So your average Internet user, 0:01:28.000 --> 0:01:32.840 not someone who's a hacker or is trying to evade detection, 0:01:33.080 --> 0:01:37.039 just your average person. When this average person makes a 0:01:37.080 --> 0:01:40.520 regular run of the mill website so that they're creating 0:01:40.560 --> 0:01:43.080 their own website, he or she will build out this 0:01:43.160 --> 0:01:46.600 site and create links between pages on the site so 0:01:46.680 --> 0:01:50.720 you can navigate easily across the different pages. Maybe they 0:01:50.720 --> 0:01:54.320 include some links out to a few other sites that 0:01:54.400 --> 0:01:58.520 are of a related topic or interest. Maybe some of 0:01:58.520 --> 0:02:00.840 those sites are owned by that same person, maybe they're 0:02:00.880 --> 0:02:03.760 owned by different people. Then they might build out some 0:02:03.840 --> 0:02:07.880 meta data on their web pages. This helps tag those 0:02:07.880 --> 0:02:12.799 pages to indicate what the site is actually about. Now, 0:02:12.840 --> 0:02:16.600 assuming there are no incoming links to this website, Let's 0:02:16.600 --> 0:02:21.400 say you're Logic a brand new website and there there's 0:02:21.440 --> 0:02:24.160 no connection with anything else yet, like no one else 0:02:24.160 --> 0:02:27.560 has any incoming links to your site, then you might 0:02:27.600 --> 0:02:31.360 want to use a tool like Google's search console to 0:02:31.720 --> 0:02:34.440 fetch the U r L of your website. You know 0:02:34.480 --> 0:02:37.280 you've established it, you've got it launched on the server 0:02:38.000 --> 0:02:40.400 you fetch the u r L using that tool, and 0:02:40.440 --> 0:02:44.519 that will help index your website and Google's search index, 0:02:45.080 --> 0:02:48.040 and that tells Google where the website is and what's 0:02:48.120 --> 0:02:51.400 on it. Then Google can sent its crawlers to explore 0:02:51.440 --> 0:02:53.280 your site, follow all the links to all the different 0:02:53.320 --> 0:02:55.760 pages and build out a better understanding of what the 0:02:55.760 --> 0:02:59.280 site is about, including those individual pages, and put them 0:02:59.280 --> 0:03:04.200 all in search. And these links between pages and between 0:03:04.240 --> 0:03:09.120 sites are really important. The links are the web in 0:03:09.160 --> 0:03:11.920 Worldwide Web right, we call it a web because they 0:03:11.960 --> 0:03:15.119 are all these different links between different pages. So it's 0:03:15.160 --> 0:03:17.840 not just how you can navigate from one page or 0:03:17.960 --> 0:03:21.519 site to another, but it's also how search engines can 0:03:21.760 --> 0:03:25.080 find an index sites to include in search results. They 0:03:25.120 --> 0:03:29.720 send out these automatic crawlers that crawl the web and 0:03:29.800 --> 0:03:33.119 index everything. Ranking high in search is a really good 0:03:33.160 --> 0:03:36.280 way to get traffic to your site generally, not as 0:03:37.120 --> 0:03:39.120 not as good a way as it used to be, actually, 0:03:39.160 --> 0:03:42.440 because the way that people get their links to go 0:03:42.640 --> 0:03:46.440 visit stuff changes over time. But you want to use 0:03:46.520 --> 0:03:50.560 good search engine optimization. Now that's tricky because there are 0:03:50.560 --> 0:03:55.200 different search engines, and different search engines have different priorities 0:03:55.600 --> 0:03:59.600 as to what is important for ranking and search. They 0:03:59.600 --> 0:04:04.200 have different algorithms, and these can change without notice. So 0:04:04.280 --> 0:04:07.480 one day your site might rank really well in a 0:04:07.520 --> 0:04:10.040 particular search engine, and then the next day it suddenly 0:04:10.120 --> 0:04:12.400 is pushed to the third page or lower, and no 0:04:12.440 --> 0:04:16.040 one's seeing it when they search for whatever the terms are. Now, 0:04:16.080 --> 0:04:19.640 all of this assumes that you want people to easily 0:04:19.680 --> 0:04:22.159 find your stuff in the first place, that you want 0:04:22.160 --> 0:04:26.599 to be part of this surface web. You want search 0:04:26.640 --> 0:04:28.760 engines to index your site and make it easier for 0:04:28.800 --> 0:04:32.360 traffic to come to you. Your website is part of 0:04:32.400 --> 0:04:35.240 this surface web, the stuff that's really easy to find 0:04:35.240 --> 0:04:40.200 and navigate to on purpose, it was made intentionally that way. Now, 0:04:40.279 --> 0:04:44.120 in actuality, that represents a very small percentage of all 0:04:44.200 --> 0:04:47.680 the information that is on the web. And if you 0:04:47.720 --> 0:04:50.200 think of it, it's kind of like an iceberg, right. 0:04:50.279 --> 0:04:53.120 The part you see above the water is only a 0:04:53.200 --> 0:04:58.119 tiny fraction of the entire iceberg. Most of the mass 0:04:58.120 --> 0:05:01.720 of the iceberg is out of So it is with 0:05:01.800 --> 0:05:04.599 the Worldwide Web. You've got the surface web, the stuff 0:05:04.600 --> 0:05:08.200 you can see. That's a tiny percentage. What if you 0:05:08.880 --> 0:05:12.200 don't want to be found so easily, Maybe you're creating 0:05:12.320 --> 0:05:16.840 a database and that database has information in it that's important, 0:05:17.000 --> 0:05:18.960 and you want certain people to be able to get 0:05:19.040 --> 0:05:21.360 to it very easily, but you don't want the whole 0:05:21.360 --> 0:05:24.599 world to get there. Right, it's not that there's anything 0:05:24.600 --> 0:05:27.720 wrong in the database. Maybe there's proprietary information. Maybe you 0:05:27.760 --> 0:05:31.040 work for a company and you've built out a database 0:05:31.320 --> 0:05:34.839 that needs to be web accessible because people in your 0:05:34.920 --> 0:05:37.800 company may be trusted partners. They need to have access 0:05:37.800 --> 0:05:40.280 to this information. But you don't want the general public 0:05:40.320 --> 0:05:44.719 to get it. You want to limit people. Well, there 0:05:44.760 --> 0:05:47.080 are a couple of ways you can do this. One 0:05:47.160 --> 0:05:49.880 is you can include some code in your HTML to 0:05:49.920 --> 0:05:53.080 prevent your site from being indexed by search engines. There's 0:05:53.120 --> 0:05:56.919 a meta tag called no index all one word no 0:05:57.040 --> 0:06:00.320 index that tells search butts you don't want that site 0:06:00.320 --> 0:06:03.680 to be included on search results page. But that's kind 0:06:03.680 --> 0:06:06.560 of a minor form of protection. It does not stop 0:06:06.640 --> 0:06:11.200 other sites from linking straight to yours. Right, So I 0:06:11.279 --> 0:06:15.080 might not show up on anyone's search engine. But let's 0:06:15.120 --> 0:06:18.360 say I've created this database and I don't have any 0:06:18.360 --> 0:06:20.479 other protection on it other than the fact that I've 0:06:20.520 --> 0:06:23.080 told it not to get indexed in any search engines. 0:06:23.720 --> 0:06:26.520 There's nothing stopping someone else from creating a link to 0:06:26.600 --> 0:06:29.440 my database that would still send people straight there. Right. 0:06:30.160 --> 0:06:32.200 This section of the web that is blocked off from 0:06:32.279 --> 0:06:35.839 search engines in general is what we would call the 0:06:35.960 --> 0:06:39.840 deep web. So this is underneath the water in that 0:06:39.880 --> 0:06:43.159 iceberg metaphor. The deep web has tons of stuff in it, 0:06:43.880 --> 0:06:47.520 including stuff that's important but probably not very interesting for 0:06:47.600 --> 0:06:50.640 the general public, like those databases I was talking about 0:06:50.800 --> 0:06:53.839 that would be really important for some people and probably 0:06:53.920 --> 0:06:57.440 of no interest at all to of the of the 0:06:57.480 --> 0:07:00.240 population out there. The only way to navigate the air 0:07:00.920 --> 0:07:03.280 is to type in the specific U r L in 0:07:03.320 --> 0:07:07.360 a web browser, and it may likely have other forms 0:07:07.360 --> 0:07:10.360 of security, such as a password login page where you 0:07:10.400 --> 0:07:13.320 have to have an account in order to gain access 0:07:13.360 --> 0:07:16.800 to whatever is behind that, but you can't get there 0:07:16.920 --> 0:07:20.200 unless you already know the address. Uh. It would be 0:07:20.240 --> 0:07:23.880 like navigating to a secret location on a map, and 0:07:23.920 --> 0:07:26.360 the only way you can get to the secret location 0:07:26.760 --> 0:07:31.440 is if you already know where it is. Then beyond 0:07:31.520 --> 0:07:34.360 the deep web is the dark web. This is a 0:07:34.440 --> 0:07:39.960 subsection of the deep web. Unlike the deep web, you 0:07:40.080 --> 0:07:42.800 cannot navigate to sites on the dark Web through normal 0:07:42.880 --> 0:07:47.600 web browsers. Typically you would need special dark web browsers, 0:07:48.120 --> 0:07:50.920 the most well known of which is Tour, the tour 0:07:51.160 --> 0:07:55.040 browser bundle. Tour stands for a couple of different things. Actually, 0:07:55.040 --> 0:07:57.440 we'll get into that. A lot of shady stuff can 0:07:57.440 --> 0:08:01.960 happen on the dark web. It's not all illegal activity, 0:08:02.120 --> 0:08:07.040 but a lot of it definitely is illegal activity. And 0:08:07.040 --> 0:08:10.400 there are tons of bad actors out there on the 0:08:10.440 --> 0:08:13.200 dark Web. I'm not talking about people who do really 0:08:13.320 --> 0:08:17.120 crappy performances and movies and film and television and plays 0:08:17.120 --> 0:08:20.720 and stuff. I mean people who are out to exploit 0:08:20.840 --> 0:08:24.320 other people and companies, people who are out to steal 0:08:24.400 --> 0:08:28.200 information for profit or cause mischief. There are a lot 0:08:28.240 --> 0:08:30.840 of them on the dark web. These are people or 0:08:30.920 --> 0:08:34.360 groups who deal in data. They look for careless folks 0:08:34.360 --> 0:08:37.839 who do not protect their information very well. Even something 0:08:37.880 --> 0:08:41.079 is seemingly boring as an IP address can be dangerous 0:08:41.200 --> 0:08:44.360 in their hands. And because a ton of stuff on 0:08:44.400 --> 0:08:48.760 the dark web is at least of questionable legality, you 0:08:48.840 --> 0:08:52.120 probably don't want to leave a trail of where you've been. 0:08:52.440 --> 0:08:55.320 If you visit the dark web. Your Internet service provider 0:08:55.480 --> 0:08:58.400 would have a record of this, and then perhaps someday 0:08:58.520 --> 0:09:01.360 law enforcement officials serve that I s P with an 0:09:01.440 --> 0:09:05.000 order to hand over data. Maybe you did nothing wrong. 0:09:05.200 --> 0:09:08.040 Maybe all you were doing was just being curious and 0:09:08.080 --> 0:09:10.120 seeing what happens to be out there on the deep 0:09:10.160 --> 0:09:13.400 web or the dark web. And then you're just looking around. 0:09:13.720 --> 0:09:16.520 But now you've got a trail. The I s P 0:09:17.360 --> 0:09:20.360 knows that you went there, and now the fuzzes on 0:09:20.400 --> 0:09:24.000 your tail because you didn't cover it tracks. So there's 0:09:24.040 --> 0:09:26.760 another element to visiting the dark web that you'll here 0:09:26.840 --> 0:09:29.560 mentioned all the time, and that would be VPNs or 0:09:29.679 --> 0:09:33.240 virtual private networks. Those act as sort of a stopper 0:09:33.480 --> 0:09:37.000 between you and the dark web. There's actually a couple 0:09:37.040 --> 0:09:40.400 of different stoppers, because tour itself acts as a stopper. 0:09:40.880 --> 0:09:44.520 But the VbN is there to help provide a little 0:09:44.520 --> 0:09:47.480 protection between you and your Internet service provider. You lug 0:09:47.640 --> 0:09:51.079 into the VPN and that assigns you an I P 0:09:51.360 --> 0:09:55.840 address that is not the one that your machine actually has. Uh. 0:09:56.000 --> 0:09:58.480 This is the VPN is acting on your behalf. It's 0:09:58.520 --> 0:10:02.040 acting as your proxy. So you're signed into the VPN, 0:10:02.400 --> 0:10:05.440 it assigns you an IP address, perhaps one that belongs 0:10:05.480 --> 0:10:07.959 to a machine that would be in a totally different country. 0:10:08.040 --> 0:10:11.040 So the IP address would indicate that you are perhaps 0:10:11.040 --> 0:10:13.000 in a completely different part of the world. It might 0:10:13.040 --> 0:10:15.880 be that you're in Topeka, Kansas, but you log into 0:10:15.920 --> 0:10:18.439 a VPN and it assigns you an IP address that 0:10:18.480 --> 0:10:21.960 makes it look like you are in Singapore. So then 0:10:22.600 --> 0:10:27.200 you are able to visit sites through this VPN and 0:10:27.559 --> 0:10:30.679 from the perspective of the people on the other end 0:10:30.720 --> 0:10:33.400 of this, on the site end, Let's say that you're 0:10:33.440 --> 0:10:37.200 going to navigate to let's just pick an innocent website. 0:10:37.280 --> 0:10:38.960 Let's say you're going to how Stuff Works, and you're 0:10:39.040 --> 0:10:42.080 using a VPN in order to do it. Then when 0:10:42.120 --> 0:10:45.040 you contact How stuff Works as server through the VPN, 0:10:46.200 --> 0:10:48.840 how stuff works is server is getting the IP address 0:10:48.920 --> 0:10:53.440 the VPN has provided, not your personal IP address, not 0:10:53.480 --> 0:10:57.439 your machines IP address, but rather the one from the VPN. 0:10:57.800 --> 0:11:00.800 So How Stuff Works is sending information back to the 0:11:00.920 --> 0:11:04.600 VPN via that i P address, and the VPN then 0:11:04.640 --> 0:11:08.880 relays that to you. That's a level of protection so 0:11:09.160 --> 0:11:12.440 that the I s P all all they can see 0:11:12.520 --> 0:11:15.079 is that you're connecting to this virtual private network. They 0:11:15.080 --> 0:11:17.960 can't see, you know, what else is going on there 0:11:17.960 --> 0:11:21.360 because everything else is going through there. Uh, but tour 0:11:21.440 --> 0:11:23.680 adds another layer of protection. I'll talk more about that 0:11:23.720 --> 0:11:26.800 in a second. But visiting the dark web is risky. 0:11:27.040 --> 0:11:30.400 Maybe you're trying to do something that isn't really legal, 0:11:30.720 --> 0:11:33.679 Maybe you're encountering the scum and villainy of the Internet. 0:11:33.760 --> 0:11:36.560 Maybe you're doing something totally on the up and up. 0:11:36.600 --> 0:11:39.160 But just because it's the dark web, it cast suspicion 0:11:39.240 --> 0:11:42.040 on you. You've got to be careful. And there are 0:11:42.040 --> 0:11:44.240 plenty of people who suggest you use a vp N 0:11:44.520 --> 0:11:47.000 all the time, by the way, not just when you 0:11:47.040 --> 0:11:49.760 go visit the dark web, but rather go ahead and 0:11:49.840 --> 0:11:53.000 use a VPN whenever you browse the Internet, which is 0:11:53.000 --> 0:11:56.439 not necessarily a bad idea if you value your privacy. 0:11:56.679 --> 0:11:59.160 It can help keep your browsing activity private from your 0:11:59.200 --> 0:12:02.880 Internet search provider our service provider rather, and thus you 0:12:02.920 --> 0:12:05.480 don't have to worry about them seeing what kind of 0:12:05.480 --> 0:12:08.800 stuff you're looking at. Let's say that you're looking at 0:12:08.840 --> 0:12:11.720 a different Internet service provider and you don't want your 0:12:11.800 --> 0:12:14.280 current one to know. It could be something as simple 0:12:14.280 --> 0:12:17.679 as that. However, using a VPN does tend to slow 0:12:17.720 --> 0:12:20.880 things down a bit, so pages load load more slowly. 0:12:21.120 --> 0:12:24.000 You'll get your content more slowly than you would if 0:12:24.000 --> 0:12:28.000 you directly directly connected, So you balance privacy with how 0:12:28.080 --> 0:12:31.800 quickly pages load and how quickly you get the content. Also, 0:12:32.080 --> 0:12:36.200 a good VPN tends to be subscription service. You you 0:12:36.240 --> 0:12:39.760 pay a monthly fee in order to use the VPN, 0:12:40.000 --> 0:12:42.640 and you get what you pay for. A good VPN 0:12:43.120 --> 0:12:46.719 will not keep log files. For example, because of a 0:12:46.880 --> 0:12:50.920 VPNs keeping log files, then your activity is still being logged, 0:12:51.040 --> 0:12:52.840 and it's just being logged at the VPN level, not 0:12:52.880 --> 0:12:56.439 the I s B level. So dark web enthusiasts tend 0:12:56.520 --> 0:13:02.240 to go towards VPNs that are reputable, that don't keep 0:13:02.280 --> 0:13:06.840 log files and they are subscription based because they they 0:13:06.880 --> 0:13:11.640 provide these services. Also, dark webe enthusiast tend to gravitate 0:13:11.679 --> 0:13:15.760 toward cryptocurrencies like bitcoin to pay those fees because of 0:13:15.800 --> 0:13:19.200 that decentralized nature of cryptocurrency and also the fact that 0:13:20.160 --> 0:13:22.679 if you're using it properly and you're not using it 0:13:22.720 --> 0:13:31.160 too frequently, your transactions are largely untraceable. They don't link 0:13:31.200 --> 0:13:35.160 back to your identity personally, so you have some safety 0:13:35.200 --> 0:13:40.120 there by, making purchases through Bitcoin really secure. Vp ns 0:13:40.280 --> 0:13:43.679 will frequently purge all their records so again, you want 0:13:43.679 --> 0:13:46.040 to look into that if you are interested in using 0:13:46.040 --> 0:13:48.319 a vp N. So some of you may be intrigued 0:13:48.320 --> 0:13:51.240 by what I'm talking about so far and you want 0:13:51.280 --> 0:13:53.480 to know more. We're gonna go further down the rabbit 0:13:53.520 --> 0:13:58.679 hole and really talk about onions in just a moment. 0:13:58.720 --> 0:14:01.880 But first, let's sick quick break to thank our sponsor 0:14:09.520 --> 0:14:13.720 I mentioned earlier, the Tour bundle, the tor browser or 0:14:13.760 --> 0:14:17.400 Tour client. Tour grew out of the concept of onion routing. 0:14:17.440 --> 0:14:20.400 In fact, that's you know, the onion routers what Tour 0:14:20.680 --> 0:14:25.320 technically kind of stands for. And onion routing in itself 0:14:25.480 --> 0:14:29.640 was a concept that emerged out of the early mid nineties. 0:14:30.360 --> 0:14:33.360 Uh and it was funded in part by organizations like 0:14:33.400 --> 0:14:37.120 the Office of Naval Research and DARPA, so there's military 0:14:37.160 --> 0:14:41.080 money behind it. So what the heck is onion routing? Well, 0:14:41.080 --> 0:14:45.200 it involves sending data wrapped inside a series of encrypted 0:14:45.280 --> 0:14:49.560 layers and passing through a series of relays before getting 0:14:49.600 --> 0:14:54.160 to its intended destination. And those layers of encryption are 0:14:54.200 --> 0:14:56.320 like the peel of an onion. You peel down one 0:14:56.360 --> 0:15:00.000 layer of encryption and you have another layer of encryption. 0:15:00.320 --> 0:15:02.360 You do that again you get another layer of encryption, 0:15:03.000 --> 0:15:05.800 and finally, after you peel back that third layer, you 0:15:05.840 --> 0:15:08.480 get to whatever the data is, which, by the way, 0:15:08.600 --> 0:15:11.280 could still be in an encrypted format, it would just 0:15:11.440 --> 0:15:15.560 no longer be related specifically to onion routing. So an 0:15:15.640 --> 0:15:19.840 onion rolling network consists of thousands of computers run by volunteers. 0:15:19.880 --> 0:15:23.880 By the way, you can actually volunteer to UH to 0:15:24.240 --> 0:15:29.000 act as a tour relay UH. You are volunteering up 0:15:29.040 --> 0:15:33.400 some of your bandwidth each month to that purpose UM, 0:15:33.440 --> 0:15:35.960 and there are a lot of folks who advocate for 0:15:36.000 --> 0:15:39.440 that sort of thing. When you're doing that, those those 0:15:39.480 --> 0:15:42.560 computers that are part of this relay system, they're running 0:15:42.600 --> 0:15:46.880 special software to act as relays. Traffic passing through an 0:15:46.880 --> 0:15:51.720 onion network will go through three relays before reaching the 0:15:51.760 --> 0:15:56.760 intended destination. So your computer is the client that you're 0:15:56.840 --> 0:16:00.920 running a tour client technically, and when you ever you 0:16:00.960 --> 0:16:03.520 send a request out, it's going to pass through three 0:16:03.680 --> 0:16:07.040 relays on the tour network before it gets to the 0:16:07.160 --> 0:16:11.200 destination on the other side to retrieve whatever it is 0:16:11.240 --> 0:16:14.040 you're looking for. You're hopping around. If you think about 0:16:14.040 --> 0:16:18.760 spy movies, whenever people are tracing a call and they're like, oh, 0:16:18.880 --> 0:16:23.920 we've got it. It's coming from you know, Los Angeles, California. Wait, no, no, 0:16:24.080 --> 0:16:27.200 we're tracing it back. It's actually over in Tokyo. No wait, 0:16:27.280 --> 0:16:29.760 we're tracing it back. The whole thing where that you're 0:16:29.800 --> 0:16:33.120 seeing that the call is hopping through satellites over and 0:16:33.160 --> 0:16:34.720 over and again, you're trying to trace it back to 0:16:34.760 --> 0:16:37.440 original source. That's kind of what Tour is doing. It 0:16:37.520 --> 0:16:40.760 does it in threes. So let's say I'm using the 0:16:40.800 --> 0:16:45.040 Tour browser and I want to visit super secret site X. 0:16:45.800 --> 0:16:49.840 Here's what happens from a high level perspective. First, my 0:16:50.000 --> 0:16:54.840 Tour browser, also known as the client, will encrypt my request, 0:16:55.480 --> 0:16:58.840 and those three layers, the entity that holds the key 0:16:58.880 --> 0:17:03.480 to my request exists on the relays of the Tour network. 0:17:04.080 --> 0:17:09.159 The ultimate one, the closest layer of encryption to my data, 0:17:09.640 --> 0:17:12.960 is held by what is called the exit relay. That's 0:17:13.000 --> 0:17:17.000 the point where my request leaves the Tour network and 0:17:17.119 --> 0:17:22.240 hits the destination. Uh. More on that in a second. So, 0:17:22.480 --> 0:17:25.439 now my request will have layers of encryption around it. 0:17:25.760 --> 0:17:29.560 Uh the first layer being the one from the exit relay. 0:17:29.600 --> 0:17:33.040 The second layer will be a layer of encryption around 0:17:33.040 --> 0:17:35.720 the first That one can only be decoded by a 0:17:35.880 --> 0:17:39.040 key that's one step back from the exit relay. That's 0:17:39.040 --> 0:17:42.440 the middle relay. And then my client wraps one more 0:17:42.520 --> 0:17:46.600 layer of encryption around that, and the holder of the 0:17:46.680 --> 0:17:50.800 key to that outermost layer of encryption is the guard 0:17:51.040 --> 0:17:55.480 relay or entrigue relay, the first relay my request will encounter. 0:17:56.080 --> 0:17:59.639 So if you think of it as data in the center, 0:18:00.600 --> 0:18:04.760 you have layer three around that, layer two around that, 0:18:04.880 --> 0:18:08.600 and layer one on the outermost layer. I send my 0:18:08.680 --> 0:18:11.440 request out, I say I want to see super secret 0:18:11.520 --> 0:18:14.680 site X, and I'm I'm using my tour network browser. 0:18:15.440 --> 0:18:19.240 The request then goes to that entry or guard relay, 0:18:19.280 --> 0:18:22.400 which has that first key to decrypt just the outer 0:18:22.560 --> 0:18:25.439 layer of encryption. That's all it can do. So it 0:18:25.520 --> 0:18:31.200 sees that it's got an incoming request from me. Uh, 0:18:31.359 --> 0:18:33.639 it knows that I'm the one requesting it, but it 0:18:33.640 --> 0:18:37.000 doesn't know what I'm requesting. All it knows is here's 0:18:37.000 --> 0:18:40.240 a here's a big encrypted data package. It uses the 0:18:40.320 --> 0:18:43.480 key to decrypt that outermost layer of protection around my request. 0:18:43.920 --> 0:18:47.000 The only thing it sees is where it needs to 0:18:47.119 --> 0:18:50.760 send that data packet two. Next, it doesn't know what's 0:18:50.880 --> 0:18:54.280 inside the other layers of encryption. It just knows, oh, 0:18:54.320 --> 0:18:57.760 I need to send this to this specific middle relay, 0:18:57.840 --> 0:19:01.360 and so it does. The middle relay, all it knows 0:19:01.880 --> 0:19:06.040 is that just received an encrypted package from relay number one, 0:19:06.200 --> 0:19:11.080 the entry relay, and it uses it's key to decode 0:19:11.240 --> 0:19:16.080 that particular layer mid layer two, and all it sees 0:19:16.440 --> 0:19:18.280 is where it needs to send it to next, the 0:19:18.359 --> 0:19:22.840 exit relay. So the middle relay doesn't know that that 0:19:23.080 --> 0:19:26.960 initial request came from you at all. It just knows 0:19:27.040 --> 0:19:29.399 that the entry relay was the one that sent it 0:19:29.440 --> 0:19:31.399 to it, and the exit relay is the one that 0:19:31.480 --> 0:19:37.720 sends it to. So then the middle relay unwraps that 0:19:38.359 --> 0:19:42.639 and then sends it on to the exit relay, which 0:19:42.840 --> 0:19:46.679 uses its key to finally unwrap the data. So the 0:19:46.720 --> 0:19:49.200 exit relay actually gets to see the data you sent. 0:19:49.800 --> 0:19:52.640 In fact, that's a very important thing to to stress. 0:19:53.480 --> 0:19:57.440 The exit relay, the last relay in the Tor network 0:19:57.640 --> 0:20:01.840 to send something out to the Destiny nation. It's sending 0:20:01.880 --> 0:20:05.320 that information out as if it is your machine, so 0:20:05.400 --> 0:20:09.040 it can see exactly what you are sending out, and 0:20:09.080 --> 0:20:12.560 if you're sending out unencrypted information, it can see all 0:20:12.560 --> 0:20:16.280 of that. If it's in clear text, it can see 0:20:16.320 --> 0:20:19.800 all that, including things like user names and passwords. So 0:20:20.320 --> 0:20:23.560 with that in mind, you have to make sure that 0:20:24.119 --> 0:20:27.240 you are pretty comfortable with the fact that there is 0:20:27.240 --> 0:20:31.720 a machine out there that is getting access to all 0:20:31.720 --> 0:20:36.480 of that stuff. If you're sending out unencrypted communications, if 0:20:36.480 --> 0:20:38.560 you've got another level of encryption on there, if you're 0:20:38.600 --> 0:20:43.119 using something like HTTPS, then that's not as big a 0:20:43.119 --> 0:20:46.400 concern because that information is still encrypted as it passes 0:20:46.520 --> 0:20:51.359 through that exit relay. But if you're using clear text, 0:20:52.600 --> 0:20:56.440 boy howdy, that could be a dangerous thing. If the 0:20:56.760 --> 0:21:02.040 person who owns that exit relay is not ethical, they 0:21:02.160 --> 0:21:08.880 might take advantage of that information. Uh So, guard relays, 0:21:08.920 --> 0:21:12.800 those entry points to the Tour network are particularly vulnerable 0:21:12.840 --> 0:21:15.560 if an oppressive government wants to cut off access to Tour. 0:21:16.200 --> 0:21:19.159 To connect to a guard relay, your client has to 0:21:19.240 --> 0:21:22.560 know which machines it can communicate with, or which one 0:21:22.720 --> 0:21:26.960 specific specifically it needs to communicate with, which means somewhere 0:21:27.720 --> 0:21:30.360 there has to be a list of all the different 0:21:30.480 --> 0:21:34.439 relays on the Tour network, because otherwise there's no way 0:21:34.520 --> 0:21:38.320 to build these circuits of relays where it goes from 0:21:38.400 --> 0:21:42.080 client to guard relay to middle relay to exit relay. 0:21:42.359 --> 0:21:44.480 So you have to have a list somewhere. But lists 0:21:44.520 --> 0:21:47.360 are dangerous, right, What if an oppressive government gets hold 0:21:47.359 --> 0:21:50.080 of that list, then they just aim to shut down 0:21:50.080 --> 0:21:53.720 those machines and no more Tour network, or they aim 0:21:53.800 --> 0:21:57.480 to try and spy on those machines and try to 0:21:57.600 --> 0:22:01.919 decrypt the information through some means or another. So you 0:22:02.920 --> 0:22:07.400 to protect the guard relays from getting blacklisted. Tour actually 0:22:07.440 --> 0:22:11.840 maintains a secret internal list of guard relays. They are 0:22:11.880 --> 0:22:16.000 called bridges. These are a subset of entry relays, a 0:22:16.040 --> 0:22:21.280 subset of those entry slash guard relays. Bridges are uh 0:22:21.400 --> 0:22:24.720 The overall list is secret. So when you download and 0:22:24.800 --> 0:22:28.879 launch a Tour client. When you do that, your client 0:22:29.000 --> 0:22:35.879 requests from the Tour network a uh uh an entry 0:22:35.920 --> 0:22:38.960 point where do I start? So I can start making 0:22:39.000 --> 0:22:44.119 these encryption keys. And if it needs to be a bridge, 0:22:44.119 --> 0:22:47.200 then the bridge one will send you a small selection 0:22:47.880 --> 0:22:51.080 of potential bridges, but not the whole list. That way, 0:22:51.920 --> 0:22:56.960 if that request is compromised in any way, the whole 0:22:57.000 --> 0:23:00.879 list as it remains safe, right, or most of the 0:23:00.960 --> 0:23:03.520 less remains safe, only the ones that were shared are 0:23:03.600 --> 0:23:10.480 compromised the rest remain secret. There remains safe, so you 0:23:10.520 --> 0:23:16.240 can always recruit more volunteers to run tour software. So 0:23:16.280 --> 0:23:19.480 if you lose some, if if the government shut some down, 0:23:19.800 --> 0:23:22.760 or if a government shuts some down because they're not 0:23:22.840 --> 0:23:26.720 all located in the United States, then you can attempt 0:23:26.760 --> 0:23:31.439 to replace them with new volunteers. The middle relay and 0:23:32.080 --> 0:23:36.440 exit relay are are different. The exit relays are also 0:23:36.600 --> 0:23:40.120 kind of a big target because if you shut down 0:23:40.119 --> 0:23:43.800 the exit relays then information can't pass from the tour 0:23:43.920 --> 0:23:48.400 network to their destinations. But that's also pretty tricky. They 0:23:48.400 --> 0:23:56.320 tend to be restricted to very trustworthy volunteers. Entry and 0:23:56.440 --> 0:24:00.880 middle points tend to be a little less of problem 0:24:00.920 --> 0:24:04.440 from that perspective, mostly because you've got so many levels 0:24:04.480 --> 0:24:09.320 of encryption wrapping around that data. But exit relays, because 0:24:09.480 --> 0:24:12.880 of the sensitivity to data and because they are tempting targets, 0:24:13.119 --> 0:24:18.440 tend to be more trustworthy in general, and they're they're 0:24:18.440 --> 0:24:21.199 frequent reviews to make sure that those exit points are 0:24:21.240 --> 0:24:26.479 trustworthy and no one's being a jerk face, I guess. 0:24:27.359 --> 0:24:30.240 So the important thing to remember is that the entry 0:24:30.280 --> 0:24:33.280 and middle relays have no way of knowing what is 0:24:33.320 --> 0:24:37.440 in that data. Request you're sending UM and the only 0:24:37.480 --> 0:24:39.320