Now that we covered most features of the Tor browser, I want to spend one more lecture talking about
the security settings.
What do they change and how these changes affect our privacy and anonymity.
We can access the security settings from the shield icon here beside the onion that we were using in
the previous lecture.
If this shield is empty, it means the security settings are set to the standard settings.
Clicking on it again will show you the security level that you have right now.
And as you can see, I'm at standard.
If you want to change this, you can click on advanced security settings.
And here.
You can also access this from the options menu like I showed you in the previous lecture.
So you just go here, you go to options and then go to privacy and scroll down to the security levels.
So as you can see, we have three main very simple security levels right now.
We're set to standard, which is the default.
This option will make Tor browser as usable as any other browser, just a little bit slower, but it
will allow you to access everything.
All content is available, scripts will not be blocked, so it will make all websites very nice and
usable.
But it is not the most secure setting, especially if you're using Tor browser on Windows, which is
not a very secure operating system by default.
So cranking this up to cipher will disable JavaScript on HTTP pages.
It will also disable some fonts and other HTML content.
So it might make websites function slightly different than normal.
They might look slightly different than normal, but it will be a little bit safer and more private.
And then if you crank this up all the way to the safest until disable JavaScript on all pages, even
HTTPS pages.
Obviously all traffic will be forced over https because Tor comes with https everywhere.
Videos will not play by default.
A lot of other HTML content will be blocked to make sure that you get the highest levels of security
and anonymity out of this browser.
Note how changing the security level in here changes the icon on the top, right?
So in the future, when you're using Tor and you're not sure what level you're in, you can simply look
at the icon if it's full.
That means you're in safest.
If it's half full, that means you're in safer.
And if it's empty, it means you're on standard.
You can also just click it to see exactly what security level you're on.
So now that I'm happy with my level, I'm going to keep it at the safest and we're going to close this.
And I actually want to show you the results of some tests that I did for the three different security
levels.
So with the basic or standard security level, I use this website right here and I'm going to include
its link in the resources of this lecture.
Basically, this website runs a number of tests to see how much information your browser is given about
you.
So as you can see with the standard, the browser is blocking ads.
It's not blocking invisible trackers.
It block parties that honor the do not track promise.
This is fine.
This is good.
And finally, it does not protect from fingerprinting.
So it's telling us that the browser has a unique fingerprint.
And at the bottom here, if you read this statistic, it's telling you that among the more than 200,000
browsers that were tested on this website, our browser appears to be unique so it can be used to basically
identify us.
And in here it's telling us that there are at least 17.84 bits of identifying information that can be
gathered by literally analyzing our browser.
Now.
I've also run the same test after changing my security level to medium.
And if you come here, you'll see that my browser is blocking tracking ads.
It also has partial protection against blocking invisible trackers, which is, again, very similar
to what we had with the standard.
We can also see that our browser blocks acceptable ads.
It still blocks parties that honor the do not track.
Like I said, this is fine.
And finally, our browser still has a unique fingerprint.
Now again, if we click on the show, the full details, we can get the statistics.
And again, it's saying that our browser can is still unique and the browser is given 17.8 for bits
of identifying information.
Again, it's actually identical to what we got with the standard.
Now.
Finally, I cranked my security all the way to the highest, similar to what I have right now.
And I ran the same test in here.
And as you can see, the results are much better.
So again, browser is blocking all in us.
This is fine.
It was happening with both standard and medium.
Then it's also blocking invisible trackers.
It's not accepting the do not track commitment.
Like I said, this is fine, this is good.
And finally, when it's saying, does your browser protect you from fingerprinting, this is yes.
So this is the main thing that's different here.
If you look here and it says no, and in the standard, again, it was saying no.
So our browser had a unique fingerprint, whereas right now it has less unique fingerprint, if you
want to think of it that way.
So looking at this statistic here, it's saying that only one in 114 browsers have the same fingerprint,
whereas before we had one unique fingerprint among more than 200,000 browsers.
Not only that, but our browser now only gives 6.84 bits of identifying information.
Whereas as shown before, here and here with the to medium and low security settings, it was given
17.84.
So with the high security settings, you're given much less information about your browser and about
yourself in general.
Now you can actually scroll down here after clicking on more information to see where exactly these
bits of information are coming from.
So you can see the user agent of the browser is revealing 3.74 bits of information about you.
You can see the HTTP header here revealing the language used along with more information.
Again, this is accounting for 1.58 bits of info.
Going down, we can see the browser plugins are revealing information, the time zone, even the screen
size and the colour depth.
And that's why I said don't maximise the screen because if you maximise it, this will give the true
size of your monitor again giving even more information.
And if you keep scrolling down here, you'll see exactly where each bit of information is coming from
and giving us the total of 17.48 in this example, when we had the security at medium.
Now you might think, big deal.
So what if my browser is given 17.8 for bits of information?
What does that mean?
Well, according to information theory, this information can be added together in order to identify
you.
In information theory, information is measured in bits.
And according to this formula right here, we can calculate the amount of information, a certain fact
such as your browser plug ins can reveal about your identity.
Like I said, this is measured in bits and adding all these bits together can be used to identify you.
So at the time of recording this lecture, the population of Earth is around 77 billion.
Plug in this value into this equation right here.
We can see that in order to identify a person on Earth, all we need is 32.8.
So nearly 33 bits of information.
So when searching for someone, we start adding the bits of information that we discover about them
one by one, such as their language, their location, the browser they use, and so on.
Once we get about 33 bits of information, identifying this person will become relatively easy.
So going back to what we had here, you can see the browser in the medium security settings is already
revealing 17.8 bits of information about you.
So all that's left is only 15 bits of information, and locating you will be relatively easy.
Now, granted, some of the information that we see here is incorrect, such as the screen size, because
we don't have the screen in full screen.
But you get the idea.
The more bits that your browser is given about you, the worse, because these bits can be used to locate
and identify you.
So if we look at the high security, we can see we're only revealing 6.84 bits of information.
And as I said before, some of this information is incorrect.
So it's a pretty good start.
And again, as we go through the course, we're going to talk about more advanced methods of protecting
our security and anonymity.