Speaker 1: Get in touch with technology with tech Stuff from how
Speaker 1: stuff works dot com. Hey there, and welcome to tech Stuff.
Speaker 1: I'm your host, Jonathan Strickland. I'm an executive producer with
Speaker 1: how Stuff Works in the Love all Things Tech and
Speaker 1: tech Stuff. Listener Tyler wrote in to ask me if
Speaker 1: I could do an episode about the dark Web. Yay. Now,
Speaker 1: I've done episodes in the past relating to the dark Web.
Speaker 1: I've talked about what the dark web is, but I
Speaker 1: figured revisiting it is a good idea. That's one of
Speaker 1: those topics that tends to be in and now the
Speaker 1: news pretty frequently. In fact, the day that I record this,
Speaker 1: a couple of different news stories came out about relating
Speaker 1: to the dark Web. And when people start bandying about
Speaker 1: that name, uh, a lot of different ideas come to mind.
Speaker 1: So what is it all about? That's what we're going
Speaker 1: to try and answer. The very name conjures up this
Speaker 1: idea of a egal goods and services, kind of a
Speaker 1: black market for the Internet, and that's definitely a part
Speaker 1: of the dark Web. In fact, you might argue it
Speaker 1: is a very large part of the dark Web, but
Speaker 1: it is not the whole picture. So here we go. First,
Speaker 1: it's good to remind ourselves of how the world Wide
Speaker 1: Web tends to work. The web we typically use on
Speaker 1: a day to day basis, So your average Internet user,
Speaker 1: not someone who's a hacker or is trying to evade detection,
Speaker 1: just your average person. When this average person makes a
Speaker 1: regular run of the mill website so that they're creating
Speaker 1: their own website, he or she will build out this
Speaker 1: site and create links between pages on the site so
Speaker 1: you can navigate easily across the different pages. Maybe they
Speaker 1: include some links out to a few other sites that
Speaker 1: are of a related topic or interest. Maybe some of
Speaker 1: those sites are owned by that same person, maybe they're
Speaker 1: owned by different people. Then they might build out some
Speaker 1: meta data on their web pages. This helps tag those
Speaker 1: pages to indicate what the site is actually about. Now,
Speaker 1: assuming there are no incoming links to this website, Let's
Speaker 1: say you're Logic a brand new website and there there's
Speaker 1: no connection with anything else yet, like no one else
Speaker 1: has any incoming links to your site, then you might
Speaker 1: want to use a tool like Google's search console to
Speaker 1: fetch the U r L of your website. You know
Speaker 1: you've established it, you've got it launched on the server
Speaker 1: you fetch the u r L using that tool, and
Speaker 1: that will help index your website and Google's search index,
Speaker 1: and that tells Google where the website is and what's
Speaker 1: on it. Then Google can sent its crawlers to explore
Speaker 1: your site, follow all the links to all the different
Speaker 1: pages and build out a better understanding of what the
Speaker 1: site is about, including those individual pages, and put them
Speaker 1: all in search. And these links between pages and between
Speaker 1: sites are really important. The links are the web in
Speaker 1: Worldwide Web right, we call it a web because they
Speaker 1: are all these different links between different pages. So it's
Speaker 1: not just how you can navigate from one page or
Speaker 1: site to another, but it's also how search engines can
Speaker 1: find an index sites to include in search results. They
Speaker 1: send out these automatic crawlers that crawl the web and
Speaker 1: index everything. Ranking high in search is a really good
Speaker 1: way to get traffic to your site generally, not as
Speaker 1: not as good a way as it used to be, actually,
Speaker 1: because the way that people get their links to go
Speaker 1: visit stuff changes over time. But you want to use
Speaker 1: good search engine optimization. Now that's tricky because there are
Speaker 1: different search engines, and different search engines have different priorities
Speaker 1: as to what is important for ranking and search. They
Speaker 1: have different algorithms, and these can change without notice. So
Speaker 1: one day your site might rank really well in a
Speaker 1: particular search engine, and then the next day it suddenly
Speaker 1: is pushed to the third page or lower, and no
Speaker 1: one's seeing it when they search for whatever the terms are. Now,
Speaker 1: all of this assumes that you want people to easily
Speaker 1: find your stuff in the first place, that you want
Speaker 1: to be part of this surface web. You want search
Speaker 1: engines to index your site and make it easier for
Speaker 1: traffic to come to you. Your website is part of
Speaker 1: this surface web, the stuff that's really easy to find
Speaker 1: and navigate to on purpose, it was made intentionally that way. Now,
Speaker 1: in actuality, that represents a very small percentage of all
Speaker 1: the information that is on the web. And if you
Speaker 1: think of it, it's kind of like an iceberg, right.
Speaker 1: The part you see above the water is only a
Speaker 1: tiny fraction of the entire iceberg. Most of the mass
Speaker 1: of the iceberg is out of So it is with
Speaker 1: the Worldwide Web. You've got the surface web, the stuff
Speaker 1: you can see. That's a tiny percentage. What if you
Speaker 1: don't want to be found so easily, Maybe you're creating
Speaker 1: a database and that database has information in it that's important,
Speaker 1: and you want certain people to be able to get
Speaker 1: to it very easily, but you don't want the whole
Speaker 1: world to get there. Right, it's not that there's anything
Speaker 1: wrong in the database. Maybe there's proprietary information. Maybe you
Speaker 1: work for a company and you've built out a database
Speaker 1: that needs to be web accessible because people in your
Speaker 1: company may be trusted partners. They need to have access
Speaker 1: to this information. But you don't want the general public
Speaker 1: to get it. You want to limit people. Well, there
Speaker 1: are a couple of ways you can do this. One
Speaker 1: is you can include some code in your HTML to
Speaker 1: prevent your site from being indexed by search engines. There's
Speaker 1: a meta tag called no index all one word no
Speaker 1: index that tells search butts you don't want that site
Speaker 1: to be included on search results page. But that's kind
Speaker 1: of a minor form of protection. It does not stop
Speaker 1: other sites from linking straight to yours. Right, So I
Speaker 1: might not show up on anyone's search engine. But let's
Speaker 1: say I've created this database and I don't have any
Speaker 1: other protection on it other than the fact that I've
Speaker 1: told it not to get indexed in any search engines.
Speaker 1: There's nothing stopping someone else from creating a link to
Speaker 1: my database that would still send people straight there. Right.
Speaker 1: This section of the web that is blocked off from
Speaker 1: search engines in general is what we would call the
Speaker 1: deep web. So this is underneath the water in that
Speaker 1: iceberg metaphor. The deep web has tons of stuff in it,
Speaker 1: including stuff that's important but probably not very interesting for
Speaker 1: the general public, like those databases I was talking about
Speaker 1: that would be really important for some people and probably
Speaker 1: of no interest at all to of the of the
Speaker 1: population out there. The only way to navigate the air
Speaker 1: is to type in the specific U r L in
Speaker 1: a web browser, and it may likely have other forms
Speaker 1: of security, such as a password login page where you
Speaker 1: have to have an account in order to gain access
Speaker 1: to whatever is behind that, but you can't get there
Speaker 1: unless you already know the address. Uh. It would be
Speaker 1: like navigating to a secret location on a map, and
Speaker 1: the only way you can get to the secret location
Speaker 1: is if you already know where it is. Then beyond
Speaker 1: the deep web is the dark web. This is a
Speaker 1: subsection of the deep web. Unlike the deep web, you
Speaker 1: cannot navigate to sites on the dark Web through normal
Speaker 1: web browsers. Typically you would need special dark web browsers,
Speaker 1: the most well known of which is Tour, the tour
Speaker 1: browser bundle. Tour stands for a couple of different things. Actually,
Speaker 1: we'll get into that. A lot of shady stuff can
Speaker 1: happen on the dark web. It's not all illegal activity,
Speaker 1: but a lot of it definitely is illegal activity. And
Speaker 1: there are tons of bad actors out there on the
Speaker 1: dark Web. I'm not talking about people who do really
Speaker 1: crappy performances and movies and film and television and plays
Speaker 1: and stuff. I mean people who are out to exploit
Speaker 1: other people and companies, people who are out to steal
Speaker 1: information for profit or cause mischief. There are a lot
Speaker 1: of them on the dark web. These are people or
Speaker 1: groups who deal in data. They look for careless folks
Speaker 1: who do not protect their information very well. Even something
Speaker 1: is seemingly boring as an IP address can be dangerous
Speaker 1: in their hands. And because a ton of stuff on
Speaker 1: the dark web is at least of questionable legality, you
Speaker 1: probably don't want to leave a trail of where you've been.
Speaker 1: If you visit the dark web. Your Internet service provider
Speaker 1: would have a record of this, and then perhaps someday
Speaker 1: law enforcement officials serve that I s P with an
Speaker 1: order to hand over data. Maybe you did nothing wrong.
Speaker 1: Maybe all you were doing was just being curious and
Speaker 1: seeing what happens to be out there on the deep
Speaker 1: web or the dark web. And then you're just looking around.
Speaker 1: But now you've got a trail. The I s P
Speaker 1: knows that you went there, and now the fuzzes on
Speaker 1: your tail because you didn't cover it tracks. So there's
Speaker 1: another element to visiting the dark web that you'll here
Speaker 1: mentioned all the time, and that would be VPNs or
Speaker 1: virtual private networks. Those act as sort of a stopper
Speaker 1: between you and the dark web. There's actually a couple
Speaker 1: of different stoppers, because tour itself acts as a stopper.
Speaker 1: But the VbN is there to help provide a little
Speaker 1: protection between you and your Internet service provider. You lug
Speaker 1: into the VPN and that assigns you an I P
Speaker 1: address that is not the one that your machine actually has. Uh.
Speaker 1: This is the VPN is acting on your behalf. It's
Speaker 1: acting as your proxy. So you're signed into the VPN,
Speaker 1: it assigns you an IP address, perhaps one that belongs
Speaker 1: to a machine that would be in a totally different country.
Speaker 1: So the IP address would indicate that you are perhaps
Speaker 1: in a completely different part of the world. It might
Speaker 1: be that you're in Topeka, Kansas, but you log into
Speaker 1: a VPN and it assigns you an IP address that
Speaker 1: makes it look like you are in Singapore. So then
Speaker 1: you are able to visit sites through this VPN and
Speaker 1: from the perspective of the people on the other end
Speaker 1: of this, on the site end, Let's say that you're
Speaker 1: going to navigate to let's just pick an innocent website.
Speaker 1: Let's say you're going to how Stuff Works, and you're
Speaker 1: using a VPN in order to do it. Then when
Speaker 1: you contact How stuff Works as server through the VPN,
Speaker 1: how stuff works is server is getting the IP address
Speaker 1: the VPN has provided, not your personal IP address, not
Speaker 1: your machines IP address, but rather the one from the VPN.
Speaker 1: So How Stuff Works is sending information back to the
Speaker 1: VPN via that i P address, and the VPN then
Speaker 1: relays that to you. That's a level of protection so
Speaker 1: that the I s P all all they can see
Speaker 1: is that you're connecting to this virtual private network. They
Speaker 1: can't see, you know, what else is going on there
Speaker 1: because everything else is going through there. Uh, but tour
Speaker 1: adds another layer of protection. I'll talk more about that
Speaker 1: in a second. But visiting the dark web is risky.
Speaker 1: Maybe you're trying to do something that isn't really legal,
Speaker 1: Maybe you're encountering the scum and villainy of the Internet.
Speaker 1: Maybe you're doing something totally on the up and up.
Speaker 1: But just because it's the dark web, it cast suspicion
Speaker 1: on you. You've got to be careful. And there are
Speaker 1: plenty of people who suggest you use a vp N
Speaker 1: all the time, by the way, not just when you
Speaker 1: go visit the dark web, but rather go ahead and
Speaker 1: use a VPN whenever you browse the Internet, which is
Speaker 1: not necessarily a bad idea if you value your privacy.
Speaker 1: It can help keep your browsing activity private from your
Speaker 1: Internet search provider our service provider rather, and thus you
Speaker 1: don't have to worry about them seeing what kind of
Speaker 1: stuff you're looking at. Let's say that you're looking at
Speaker 1: a different Internet service provider and you don't want your
Speaker 1: current one to know. It could be something as simple
Speaker 1: as that. However, using a VPN does tend to slow
Speaker 1: things down a bit, so pages load load more slowly.
Speaker 1: You'll get your content more slowly than you would if
Speaker 1: you directly directly connected, So you balance privacy with how
Speaker 1: quickly pages load and how quickly you get the content. Also,
Speaker 1: a good VPN tends to be subscription service. You you
Speaker 1: pay a monthly fee in order to use the VPN,
Speaker 1: and you get what you pay for. A good VPN
Speaker 1: will not keep log files. For example, because of a
Speaker 1: VPNs keeping log files, then your activity is still being logged,
Speaker 1: and it's just being logged at the VPN level, not
Speaker 1: the I s B level. So dark web enthusiasts tend
Speaker 1: to go towards VPNs that are reputable, that don't keep
Speaker 1: log files and they are subscription based because they they
Speaker 1: provide these services. Also, dark webe enthusiast tend to gravitate
Speaker 1: toward cryptocurrencies like bitcoin to pay those fees because of
Speaker 1: that decentralized nature of cryptocurrency and also the fact that
Speaker 1: if you're using it properly and you're not using it
Speaker 1: too frequently, your transactions are largely untraceable. They don't link
Speaker 1: back to your identity personally, so you have some safety
Speaker 1: there by, making purchases through Bitcoin really secure. Vp ns
Speaker 1: will frequently purge all their records so again, you want
Speaker 1: to look into that if you are interested in using
Speaker 1: a vp N. So some of you may be intrigued
Speaker 1: by what I'm talking about so far and you want
Speaker 1: to know more. We're gonna go further down the rabbit
Speaker 1: hole and really talk about onions in just a moment.
Speaker 1: But first, let's sick quick break to thank our sponsor
Speaker 1: I mentioned earlier, the Tour bundle, the tor browser or
Speaker 1: Tour client. Tour grew out of the concept of onion routing.
Speaker 1: In fact, that's you know, the onion routers what Tour
Speaker 1: technically kind of stands for. And onion routing in itself
Speaker 1: was a concept that emerged out of the early mid nineties.
Speaker 1: Uh and it was funded in part by organizations like
Speaker 1: the Office of Naval Research and DARPA, so there's military
Speaker 1: money behind it. So what the heck is onion routing? Well,
Speaker 1: it involves sending data wrapped inside a series of encrypted
Speaker 1: layers and passing through a series of relays before getting
Speaker 1: to its intended destination. And those layers of encryption are
Speaker 1: like the peel of an onion. You peel down one
Speaker 1: layer of encryption and you have another layer of encryption.
Speaker 1: You do that again you get another layer of encryption,
Speaker 1: and finally, after you peel back that third layer, you
Speaker 1: get to whatever the data is, which, by the way,
Speaker 1: could still be in an encrypted format, it would just
Speaker 1: no longer be related specifically to onion routing. So an
Speaker 1: onion rolling network consists of thousands of computers run by volunteers.
Speaker 1: By the way, you can actually volunteer to UH to
Speaker 1: act as a tour relay UH. You are volunteering up
Speaker 1: some of your bandwidth each month to that purpose UM,
Speaker 1: and there are a lot of folks who advocate for
Speaker 1: that sort of thing. When you're doing that, those those
Speaker 1: computers that are part of this relay system, they're running
Speaker 1: special software to act as relays. Traffic passing through an
Speaker 1: onion network will go through three relays before reaching the
Speaker 1: intended destination. So your computer is the client that you're
Speaker 1: running a tour client technically, and when you ever you
Speaker 1: send a request out, it's going to pass through three
Speaker 1: relays on the tour network before it gets to the
Speaker 1: destination on the other side to retrieve whatever it is
Speaker 1: you're looking for. You're hopping around. If you think about
Speaker 1: spy movies, whenever people are tracing a call and they're like, oh,
Speaker 1: we've got it. It's coming from you know, Los Angeles, California. Wait, no, no,
Speaker 1: we're tracing it back. It's actually over in Tokyo. No wait,
Speaker 1: we're tracing it back. The whole thing where that you're
Speaker 1: seeing that the call is hopping through satellites over and
Speaker 1: over and again, you're trying to trace it back to
Speaker 1: original source. That's kind of what Tour is doing. It
Speaker 1: does it in threes. So let's say I'm using the
Speaker 1: Tour browser and I want to visit super secret site X.
Speaker 1: Here's what happens from a high level perspective. First, my
Speaker 1: Tour browser, also known as the client, will encrypt my request,
Speaker 1: and those three layers, the entity that holds the key
Speaker 1: to my request exists on the relays of the Tour network.
Speaker 1: The ultimate one, the closest layer of encryption to my data,
Speaker 1: is held by what is called the exit relay. That's
Speaker 1: the point where my request leaves the Tour network and
Speaker 1: hits the destination. Uh. More on that in a second. So,
Speaker 1: now my request will have layers of encryption around it.
Speaker 1: Uh the first layer being the one from the exit relay.
Speaker 1: The second layer will be a layer of encryption around
Speaker 1: the first That one can only be decoded by a
Speaker 1: key that's one step back from the exit relay. That's
Speaker 1: the middle relay. And then my client wraps one more
Speaker 1: layer of encryption around that, and the holder of the
Speaker 1: key to that outermost layer of encryption is the guard
Speaker 1: relay or entrigue relay, the first relay my request will encounter.
Speaker 1: So if you think of it as data in the center,
Speaker 1: you have layer three around that, layer two around that,
Speaker 1: and layer one on the outermost layer. I send my
Speaker 1: request out, I say I want to see super secret
Speaker 1: site X, and I'm I'm using my tour network browser.
Speaker 1: The request then goes to that entry or guard relay,
Speaker 1: which has that first key to decrypt just the outer
Speaker 1: layer of encryption. That's all it can do. So it
Speaker 1: sees that it's got an incoming request from me. Uh,
Speaker 1: it knows that I'm the one requesting it, but it
Speaker 1: doesn't know what I'm requesting. All it knows is here's
Speaker 1: a here's a big encrypted data package. It uses the
Speaker 1: key to decrypt that outermost layer of protection around my request.
Speaker 1: The only thing it sees is where it needs to
Speaker 1: send that data packet two. Next, it doesn't know what's
Speaker 1: inside the other layers of encryption. It just knows, oh,
Speaker 1: I need to send this to this specific middle relay,
Speaker 1: and so it does. The middle relay, all it knows
Speaker 1: is that just received an encrypted package from relay number one,
Speaker 1: the entry relay, and it uses it's key to decode
Speaker 1: that particular layer mid layer two, and all it sees
Speaker 1: is where it needs to send it to next, the
Speaker 1: exit relay. So the middle relay doesn't know that that
Speaker 1: initial request came from you at all. It just knows
Speaker 1: that the entry relay was the one that sent it
Speaker 1: to it, and the exit relay is the one that
Speaker 1: sends it to. So then the middle relay unwraps that
Speaker 1: and then sends it on to the exit relay, which
Speaker 1: uses its key to finally unwrap the data. So the
Speaker 1: exit relay actually gets to see the data you sent.
Speaker 1: In fact, that's a very important thing to to stress.
Speaker 1: The exit relay, the last relay in the Tor network
Speaker 1: to send something out to the Destiny nation. It's sending
Speaker 1: that information out as if it is your machine, so
Speaker 1: it can see exactly what you are sending out, and
Speaker 1: if you're sending out unencrypted information, it can see all
Speaker 1: of that. If it's in clear text, it can see
Speaker 1: all that, including things like user names and passwords. So
Speaker 1: with that in mind, you have to make sure that
Speaker 1: you are pretty comfortable with the fact that there is
Speaker 1: a machine out there that is getting access to all
Speaker 1: of that stuff. If you're sending out unencrypted communications, if
Speaker 1: you've got another level of encryption on there, if you're
Speaker 1: using something like HTTPS, then that's not as big a
Speaker 1: concern because that information is still encrypted as it passes
Speaker 1: through that exit relay. But if you're using clear text,
Speaker 1: boy howdy, that could be a dangerous thing. If the
Speaker 1: person who owns that exit relay is not ethical, they
Speaker 1: might take advantage of that information. Uh So, guard relays,
Speaker 1: those entry points to the Tour network are particularly vulnerable
Speaker 1: if an oppressive government wants to cut off access to Tour.
Speaker 1: To connect to a guard relay, your client has to
Speaker 1: know which machines it can communicate with, or which one
Speaker 1: specific specifically it needs to communicate with, which means somewhere
Speaker 1: there has to be a list of all the different
Speaker 1: relays on the Tour network, because otherwise there's no way
Speaker 1: to build these circuits of relays where it goes from
Speaker 1: client to guard relay to middle relay to exit relay.
Speaker 1: So you have to have a list somewhere. But lists
Speaker 1: are dangerous, right, What if an oppressive government gets hold
Speaker 1: of that list, then they just aim to shut down
Speaker 1: those machines and no more Tour network, or they aim
Speaker 1: to try and spy on those machines and try to
Speaker 1: decrypt the information through some means or another. So you
Speaker 1: to protect the guard relays from getting blacklisted. Tour actually
Speaker 1: maintains a secret internal list of guard relays. They are
Speaker 1: called bridges. These are a subset of entry relays, a
Speaker 1: subset of those entry slash guard relays. Bridges are uh
Speaker 1: The overall list is secret. So when you download and
Speaker 1: launch a Tour client. When you do that, your client
Speaker 1: requests from the Tour network a uh uh an entry
Speaker 1: point where do I start? So I can start making
Speaker 1: these encryption keys. And if it needs to be a bridge,
Speaker 1: then the bridge one will send you a small selection
Speaker 1: of potential bridges, but not the whole list. That way,
Speaker 1: if that request is compromised in any way, the whole
Speaker 1: list as it remains safe, right, or most of the
Speaker 1: less remains safe, only the ones that were shared are
Speaker 1: compromised the rest remain secret. There remains safe, so you
Speaker 1: can always recruit more volunteers to run tour software. So
Speaker 1: if you lose some, if if the government shut some down,
Speaker 1: or if a government shuts some down because they're not
Speaker 1: all located in the United States, then you can attempt
Speaker 1: to replace them with new volunteers. The middle relay and
Speaker 1: exit relay are are different. The exit relays are also
Speaker 1: kind of a big target because if you shut down
Speaker 1: the exit relays then information can't pass from the tour
Speaker 1: network to their destinations. But that's also pretty tricky. They
Speaker 1: tend to be restricted to very trustworthy volunteers. Entry and
Speaker 1: middle points tend to be a little less of problem
Speaker 1: from that perspective, mostly because you've got so many levels
Speaker 1: of encryption wrapping around that data. But exit relays, because
Speaker 1: of the sensitivity to data and because they are tempting targets,
Speaker 1: tend to be more trustworthy in general, and they're they're
Speaker 1: frequent reviews to make sure that those exit points are
Speaker 1: trustworthy and no one's being a jerk face, I guess.
Speaker 1: So the important thing to remember is that the entry
Speaker 1: and middle relays have no way of knowing what is
Speaker 1: in that data. Request you're sending UM and the only
Speaker 1: one that does know is the exit relay before it
Speaker 1: sends it onto the to the destination AH. The maintenance
Speaker 1: for this entire network falls to about ten pivotal tour
Speaker 1: nodes called directory authorities. Nine of those contain lists of
Speaker 1: the relays, the tenth contains a list of the bridges.
Speaker 1: Those ten directory authorities are located mostly in Europe and
Speaker 1: the United States. In fact, Central and Eastern Europe and
Speaker 1: the United States mainly and UH. They are the backbone
Speaker 1: of the Tour network. Using tour can help keep your
Speaker 1: communications secret. If you were to send a request through
Speaker 1: a browser, normally there'd be several points along the way
Speaker 1: where someone could potentially snoop on your traffic. So let's
Speaker 1: say that you're connecting. Let's say you're in a coffee
Speaker 1: shop and you're on a laptop and you want to
Speaker 1: connect to the Internet and you're just using regular connections.
Speaker 1: So if you connect through the coffee shops WiFi, there
Speaker 1: could be someone at that coffee shop who's sniffing WiFi
Speaker 1: packets and trying to spy on communications that are going
Speaker 1: through the coffee shops WiFi network. And that's before it
Speaker 1: ever gets to an Internet service provider or the Internet
Speaker 1: at large. It's purely local. That's a problem no matter better,
Speaker 1: whether you're using tour or a normal browser. You don't
Speaker 1: want to try and do any sort of secure browsing
Speaker 1: over an open WiFi network. That's that would be ridiculous.
Speaker 1: It would be like putting all your money in a
Speaker 1: super super duper high security vault and leaving the back
Speaker 1: door of the vault open. It would be like putting
Speaker 1: a back door in the vault in the first place.
Speaker 1: It's not a good idea. So from that point, from
Speaker 1: the WiFi point, the information gets into the I s P.
Speaker 1: The I s P can see both where requests are
Speaker 1: coming from as in your location, and what the request is,
Speaker 1: so that the data itself, what you are doing, your
Speaker 1: browsing activity, all of that can be recorded and is
Speaker 1: recorded by your I s P. So if the I
Speaker 1: s P were served with legal papers later on, or
Speaker 1: if an organization like the n s A we're snooping
Speaker 1: in on that I s P, your activities would be
Speaker 1: known to them and that request would then pass from
Speaker 1: your I s P through the inner at to the
Speaker 1: I s P that handles whatever server that you're navigating to,
Speaker 1: like whatever server holds the website that you are trying
Speaker 1: to go to, and that um would mean that that
Speaker 1: server would also know where you are and what you're
Speaker 1: asking for obviously, and so anyone snooping on that server
Speaker 1: would be able to determine what you're what you're up to.
Speaker 1: So there are a lot of points along the line
Speaker 1: where you have an unsecured UH data connection where someone
Speaker 1: could potentially know what's going on and spy on you
Speaker 1: and maybe steal information. If you use HTTPS, that adds
Speaker 1: a layer of encryption on top of communications. That means
Speaker 1: anyone looking at points between you and the server you're contacting,
Speaker 1: they can see that you're communicating in some way with
Speaker 1: that server, right, They see that you're sending a request
Speaker 1: to this target server, but they cannot see what the
Speaker 1: communication is because it's encrypted, So they don't know what
Speaker 1: you're saying. They just know you're talking to that server
Speaker 1: and that the servers talking back to you. Uh. They do, however,
Speaker 1: know where you are because you're not that that information
Speaker 1: is not hidden, so they don't know what you're requesting,
Speaker 1: but they know where you are, They know when you
Speaker 1: requested it, and they know who you're talking to, and
Speaker 1: that in itself can end up being a problem. If
Speaker 1: you are working in a place that has an oppressive government,
Speaker 1: that could be enough to get you into some hot water.
Speaker 1: And it may be that you did nothing at all wrong,
Speaker 1: but in the eyes of that oppressive regime, they're saying, well,
Speaker 1: you were talking to this entity at this time from
Speaker 1: this place, and that's all we need to come after you.
Speaker 1: Using Tour eavesdroppers that are looking at you between you
Speaker 1: and your I s P will know where you are,
Speaker 1: and they'll know that you're sending communications to the Onion
Speaker 1: router network, but they won't know what that information um
Speaker 1: is and they don't know where the information is ultimately going, right,
Speaker 1: They just see, okay, you're sending communications to Tour. Those
Speaker 1: communications are already encrypted and three layers of encryption. And
Speaker 1: because the outer layer only tells the data packet which
Speaker 1: relay it needs to go to for the first entry relay,
Speaker 1: for the entry relay into Tour, anyone snooping on your
Speaker 1: data at that early stage. All they know is you're
Speaker 1: sending information to the Tour network. But they wouldn't know
Speaker 1: anything beyond that. They wouldn't know where the ultimate destination was,
Speaker 1: and they wouldn't know what was actually in the information
Speaker 1: once it hits the tour network. Now your location would
Speaker 1: be secret because it would just look like the communication
Speaker 1: is moving from one part of the tour network to
Speaker 1: the next part of the tour network. So it would
Speaker 1: be safe. If anyone were trying to snoop in on
Speaker 1: the tour network, they would just see communications passing between
Speaker 1: relays with no meaningful information to identify you. If there
Speaker 1: were someone sniffing at an exit relay, they could get
Speaker 1: all the information coming out of the relay with the
Speaker 1: exception of your physical location, So they could get whatever
Speaker 1: the data is because it would no longer be in
Speaker 1: that those three layers of encryption, So if it's unencrypted data,
Speaker 1: they could get that. Uh, they could essentially know who
Speaker 1: you are, but and where you were going, what what
Speaker 1: the ultimate site is that your destination is, But they
Speaker 1: wouldn't know where you are because the location would still
Speaker 1: be Tour network. But ultimately that might not be enough
Speaker 1: protection for you. So if you combine tour and HTTPS,
Speaker 1: that's best because then it really limits what information any
Speaker 1: snooper can get when their eaves dropping on you. On
Speaker 1: the front side of the tour network, So before your
Speaker 1: information hits Tour, the snoop would only see that you're
Speaker 1: sending communications to Tour, but they would and be able
Speaker 1: to see what it was because you've encoded it in
Speaker 1: uh in you've encrypted it. Rather on the back side
Speaker 1: of the tour network, snoops would see that there's information
Speaker 1: coming from Tour to a site, but there'd be no
Speaker 1: data linking you to that request, to that communication, So
Speaker 1: all they could say is somebody is using the tour
Speaker 1: network to connect to this site, but we don't know
Speaker 1: who it is because the communications inside are encrypted and
Speaker 1: the location data is masked to the tour network. So
Speaker 1: it's the safest of all the options. Now, I went
Speaker 1: through great links to explain at a very very high
Speaker 1: level was going on with tour networks, because these are
Speaker 1: the sort of links that people who visit the dark
Speaker 1: web will go to in order to maintain their privacy
Speaker 1: and be able to do the things they do without
Speaker 1: getting caught, sometimes the thing as they do being extremely
Speaker 1: illegal or unethical or both. Uh sometimes illegal but not unethical.
Speaker 1: I'll explain more in just a moment, but first let's
Speaker 1: take another quick break to thank our sponsor. All right,
Speaker 1: so you've installed a tour bundle and you're using HTTPS connections,
Speaker 1: you're using a VPN to add extra encryption, extra distance.
Speaker 1: You're protecting yourself from eavesdroppers, whether they are hackers or
Speaker 1: oppressive governmental organizations. What are you going to find when
Speaker 1: you go to the dark Web. Well, it's actually a
Speaker 1: little hard to navigate. You have to look around for
Speaker 1: various resources to find where the the sites are because
Speaker 1: it's by its nature, it's not designed for you to
Speaker 1: be able to have like a really effective search engine
Speaker 1: for the dark Web. If you did, it would be
Speaker 1: a lot easier for law enforcement to track down dark
Speaker 1: web sites and and target them. So there are lots
Speaker 1: of resources online that act as sort of a directory
Speaker 1: for websites that are on the dark Web, and you
Speaker 1: would find stuff that's of varying degrees of legality from
Speaker 1: it's technically legal, but it's really difficult to get hold
Speaker 1: of to this is totally illegal stuff. And it can
Speaker 1: include things like controlled substances like drugs, like illegal drugs.
Speaker 1: It can include sites that link you two hacker forums
Speaker 1: where you can learn how to exploit systems. You can
Speaker 1: take tutorials, you can talk with other hackers. You can
Speaker 1: download malware that you could then use on other people
Speaker 1: to exploit people or systems. You could hire hackers for
Speaker 1: their services to do things of that nature. There are
Speaker 1: marketplaces that sell weapons with no restrictions on them. On
Speaker 1: this dark market. There are counterfeit goods that you could
Speaker 1: buy super cheap that look like the real thing. Uh.
Speaker 1: Then there's also tons and tons of data of information,
Speaker 1: information that's been gathered through various means, often stolen through
Speaker 1: security breaches or credit cards skimming or other methods. Now, personally,
Speaker 1: I am mostly against purchasing anything off the dark web,
Speaker 1: particularly dangerous stuff. I I personally find it distasteful. But
Speaker 1: in some places you might find governments that could restrict
Speaker 1: access to things that might be really helpful, and it's
Speaker 1: because of the particular laws of that region. So, for example,
Speaker 1: maybe there's an area where stuff like birth control is
Speaker 1: really hard to get hold of, and you could argue, well,
Speaker 1: that's unethical to deny people birth control so or or
Speaker 1: you know, protect and from things like STDs, that kind
Speaker 1: of stuff. So it's important to remember what is legal
Speaker 1: and what is ethical doesn't always match up right just
Speaker 1: because something might be illegal doesn't always mean it's unethical,
Speaker 1: and just because something is ethical doesn't necessarily mean it's legal.
Speaker 1: There's a lot of leeway there. Still, there's an awful
Speaker 1: lot of dangerous and questionable stuff on these dark markets,
Speaker 1: including stuff that could really seriously cause harm to yourself
Speaker 1: or others, and some of it exploits innocent victims. So
Speaker 1: I'm not for any of that. Like I I'd rather
Speaker 1: not see anyone hurt themselves or hurt someone else, and
Speaker 1: so for that reason, I am pretty negative toward these
Speaker 1: dark markets. But there's a lot of money to be
Speaker 1: made there, so obviously they're going to exist. Purchasing stuff
Speaker 1: on the dark market obviously comes with its own risks.
Speaker 1: Users tend to deal almost exclusively cryptocurrency, like I mentioned,
Speaker 1: because you don't want those purchases to be traced back
Speaker 1: to you. Using your own personal credit card to buy
Speaker 1: illegal substances is a pretty dumb thing to do. But
Speaker 1: it's not all black markets filled with illegal materials. There's
Speaker 1: also gambling sites where you can take a chance to
Speaker 1: win money through various online casino games. Those may not
Speaker 1: be legal in your area, but you can find them online.
Speaker 1: Um I would seriously questioned the validity of those sites
Speaker 1: before engaging in online games of chance. But if that's
Speaker 1: your thing, those can be found on the deep web.
Speaker 1: There are information exchanges dedicated to share as much information
Speaker 1: as possible, essentially kind of the dark web version of
Speaker 1: wiki leaks, sort of a whistleblower kind of approach. There's
Speaker 1: obviously a lot of pornographic material on the dark web too,
Speaker 1: things that again would not really fly in the surface web,
Speaker 1: even uh uh, you know, stuff that's of definite questionable
Speaker 1: legality or is straight out illegal and ethical. You can
Speaker 1: find it much more easily on the dark web because
Speaker 1: there's much less chance of the people who are dealing
Speaker 1: in it of getting caught. It can get very upsetting,
Speaker 1: very quickly. Actually, uh, these sites are not necessarily the
Speaker 1: most reliable entities out there. You can look at a
Speaker 1: directory and say, oh, I'm gonna go visit this particular
Speaker 1: side on the dark web, and then you try and
Speaker 1: visit it. You type in the long and complicated u
Speaker 1: r L that makes no seemingly seemingly makes no sense,
Speaker 1: and then you get an error back after you wait
Speaker 1: forever for the page to load. Uh. Or you might
Speaker 1: find that the thing you purchased never gets to you,
Speaker 1: you get scammed out of money, or you go to
Speaker 1: a gambling site and you find out that not only
Speaker 1: did you not win anything, but they took extra money
Speaker 1: from you. Um. They're also are sites that are frequent
Speaker 1: targets of various enforcement agencies for obvious reasons, so things
Speaker 1: like markets like the Silk Road would get taken down.
Speaker 1: And that means the connection points in the dark web
Speaker 1: are constantly shifting as sites come online or go offline.
Speaker 1: They are not as constant as most of the stuff
Speaker 1: we see on the surface web, So navigating the dark
Speaker 1: webs pretty slow due to all those jumps that you're
Speaker 1: making in order for you to visit it safely, and
Speaker 1: you might end up just getting an error message, which
Speaker 1: can get really frustrating. Dark websites also have a special designation.
Speaker 1: You don't get a dot com or a dot org
Speaker 1: type top level domain. You see a dot onion designation.
Speaker 1: Now that's not an official route in the domain name system,
Speaker 1: but is a way of designating a site as being
Speaker 1: a tour only accessible site. And I think there are
Speaker 1: some very legitimate uses for the dark web. I don't
Speaker 1: mean to suggest that it's only a place where criminals
Speaker 1: go or illegal activity is the only thing that happens there. So,
Speaker 1: for example, let's say you are an ambassador, and you're
Speaker 1: an ambassador to a nation that has known antagonistic views
Speaker 1: towards your home country, the country you are representing. So
Speaker 1: you're an ambassador to some country that is hostile at
Speaker 1: least in some degree towards your home, you would probably
Speaker 1: want a secure means to communicate back to your home country.
Speaker 1: When you're trying to send messages back home, whether whether
Speaker 1: it's to your loved ones or to coworkers or your government,
Speaker 1: or whatever it may be, you want to be able
Speaker 1: to make sure those communications are secure, that the government
Speaker 1: that is at least some level hostile towards your home
Speaker 1: isn't snooping on what you have to say and either
Speaker 1: making plans to do terrible things or to alter the
Speaker 1: data in some way or prevent it from getting to
Speaker 1: where it needs to go. Having a method to encrypt
Speaker 1: the messages and hide your location would be really help
Speaker 1: full when you're sending sensitive information back home, and some
Speaker 1: of the sites on the dark Web are all about
Speaker 1: encrypted communications so that you can have these kind of
Speaker 1: communications between people and not worry about third parties snooping
Speaker 1: in on it. So there are a lot of opportunities
Speaker 1: for people like protesters or whistleblowers or people who are
Speaker 1: living under oppressive regimes to use the dark web to
Speaker 1: send information and files back and forth. So it is
Speaker 1: a valuable resource. It's just that when you have a
Speaker 1: resource like this that's valuable the way you can say
Speaker 1: there are legitimate uses where someone who is concerned about
Speaker 1: government overreach wants to be able to communicate freely with others.
Speaker 1: They're they're legitimate cases where that should be allowed. It
Speaker 1: also opens up the opportunity for these dark markets. I
Speaker 1: mean there's again, if there's money to be made, if
Speaker 1: there's demand, the supply will follow. So that is an
Speaker 1: overview of the dark web. I do not recommend and
Speaker 1: just checking it out for fun zies. If you are
Speaker 1: going to check it out, I do recommend you use
Speaker 1: a VPN and that you use to our browser, and
Speaker 1: that you enable all the security features. You don't have
Speaker 1: stuff like JavaScript turned on, and you are super careful
Speaker 1: because even if you're not doing anything illegal or unethical yourself,
Speaker 1: there are a lot of a lot of entities on
Speaker 1: the dark web that will jump at the chance of
Speaker 1: taking advantage of people who are not covering their tracks properly,
Speaker 1: so be careful out there. Well, that wraps up this discussion.
Speaker 1: If you guys have any suggestions for future episodes of
Speaker 1: tech Stuff, send me a message. My email address is
Speaker 1: tech Stuff at how stuff works dot com, or drop
Speaker 1: me a line on Facebook or Twitter to handle at
Speaker 1: both of those is tech Stuff hs W. You can
Speaker 1: go to our show merchandise page. That's what I wanted
Speaker 1: to say. It's not a weird way of saying that anyway.
Speaker 1: It's at t public dot com slash tech Stuff. You
Speaker 1: can find t shirts, tote bags, phone cases, all sorts
Speaker 1: of stuff with lots of different designs. Every purchase goes
Speaker 1: to benefit the show and you get some cool merchandise
Speaker 1: in return, So go check that out. Don't forget to
Speaker 1: follow us on Instagram and I'll talk to you again
Speaker 1: really soon for more on this and thousands of other topics.
Speaker 1: Because it how stuff Works dot com.