In this video, I'm going to show you how to properly install the Tor browser and make sure that it
was not modified as it was being downloaded.
The method that I'm going to show you here will work on Windows 11 and Windows ten.
If you want to install the Tor browser on Linux or Mac OS, then skip this lecture as I will cover this
process for other operating systems in the next lectures.
So first of all, we're going to download the Tor browser from their official website.
We're going to scroll down.
And we want to download it for Windows and I want to download the English version.
And as you can see, we have a 32 bit and 64 bit version depending on your processor.
Now I have a 64 bit processor in my computer.
Therefore I'm going to click on the 64 bit.
As you can see, it's going to download it here for me.
And once the download is complete, it's going to go into your downloads.
So I'm going to open up my file manager and I'm going to go to downloads and we have the installer right
here.
Now, just like any other program, you can simply double click this and click on next, next, next,
next and it will be installed on your system.
But because we are trying to protect our privacy and anonymity, it is a good idea to verify the integrity
of this file before we run it, to make sure that this file did not get modified as it was downloaded.
Because if the file gets modified as it's being downloaded, it could contain backdoors or it could
contain code that would render the privacy and anonymity features that this browser offers useless.
Because when you download something from the internet, it passes through a number of nodes in which
it can be modified.
So it can be modified by your Internet service provider, it can be modified by your network administrator,
and it can even be modified by hackers who manage to intercept the connection.
So in order to verify the integrity of this file, we're going to need to download the file signature
associated with it.
So as you can see, every single file has a sig.
A sig is short for signature, and this is a file that the developers create once they package the program
and they create it for us so that we can use it to make sure that the program did not get modified since
this file was created.
So if this file gets modified in any way, shape or form, it will break the signature.
And the verification process that I'm about to show you will fail.
So you want to make sure you download the right signature for the file that you downloaded.
So I downloaded this file.
That means I should download the signature.
So we're going to download the signature.
And again, it's going to go into my downloads.
So we have it right here.
And finally, we need to download the public key for the developers that create Tor.
You can download it from their website from here.
So if you scroll down.
We have the download link in here so you can click on it.
You're going to see gibberish on the page, but that's fine.
That's their public key.
So we're going to right click this file and save file as we're going to keep it in our downloads and
you can name it anything you want.
I'm just going to name it Tor browser key and you can use any extension you want, but I'm going to
name it dot key just to eliminate the confusion.
And we're going to select all files from here.
We're going to click on Save.
And if I go to my downloads now, I have the installer right here, I have the signature file right
here and I have the developer's key right here.
So the developers are the people that created the Tor browser and created this file right here.
Once they create this file, they create a signature that corresponds to this version of the file.
This signature will only be valid if this file is not modified.
If this file gets modified in any way, shape or form, the verification between the two will break
and this signature will become invalid.
Now we have a full section about encryption and verification later on in the course, and we will explain
how this whole process works in details.
But basically we're going to use the public key for the developers that created this package to make
sure that this package did not get modified since they created it and created this signature for it.
Now to do all of this, we're going to need to use a program that does the verification for us.
The program is called GPG for when I'm going to include the download link in the resources and to download
it.
We're just going to set this to zero because we don't want to donate anything and we're going to click
on Download.
And that said, download it for us and here we're going to run this program to install it on our computer.
And installing it is going to be very, very simple.
We're simply going to click on next next install, keeping everything to the default settings.
Once the installation is complete.
Again, we're going to click on next and I'm going to take this box so it doesn't launch it for me automatically.
We're going to click on Finish and the program is installed for us.
So we're going to use that program to verify that this package did not get modified.
And as you can see, we have the program here on my desktop or you can find this under your application
in the start menu.
It's called Cleopatra, so we're going to double click it to start it.
And we're going to click on import to import a key, and we want to import the public key for the developers.
So we're going to select all files from here and we're going to select the file with the DOT key extension.
So that's the file that we downloaded from the Internet.
We're going to click on Open and give it some time to import it and verify it.
And perfect.
Now, the developer key, as you can see in here, is the Tor browser developer's key is added successfully
to this program, Cleopatra.
Next, we want to verify that the installer did not get modified and we're going to do this by clicking
on Decrypt Verify.
We're going to select the file that we want to verify.
So I'm going to go to my downloads and we're going to select the installer.
So this file right here, remember it's the application.
Now, as you can see, we're actually not selecting the signature, but it's going to automatically
use the signature that has the same name as the file that you downloaded.
That's why it's very important to make sure when you're downloading Tor is to download the right signature
file for the right file that you downloaded.
So going back to Cleopatra, we're simply going to select the application, the Tor Installer.
We're going to click on Open and give it some time to verify it for us.
And perfect.
As you can see, it's telling us that it's verified the third browser installer with the signature file.
Now you could ignore this part that says the data could not be verified because it's only referring
to the fact that the key is not trusted by us.
So I can simply right click the key and trust it to get rid of this message.
But the main thing that we're looking for is it's saying that the signature is matching the file and
we know that the key is the key of the developers.
And we downloaded it from the official website.
And if we click on Show Audit Log, you will see that it's telling us that it is a good signature from
Tor browser developers and we have their email right here.
So this basically means that the file that we have right here, the installer did not get modified since
the owner of this key created this file and created its signature.
Now, like I said, this step is optional.
You could have simply double click this file and install Tor, but now we know that it was not modified
and we know that we can use it with confidence that it will work exactly the same way that the developers
intended it to work.
So as long as we trust the developers, we should trust this program.
So we're going to double click it now to install and install.
And it is very, very simple.
We're simply going to click on okay for the language and we're just going to click on install to install
it.
And now the installation is complete.
I'm going to antique run the Tor browser for now.
We will talk about it in details on how to use it and its features in the next lectures.
And we're just going to keep this ticked so that it's added to our start menu and desktop.
We're going to click on Finish and now we have a verified version of the Tor browser installed on our
Windows computer.
As I mentioned, if you want to install it on Linux or Mac OS, then check out the next lectures.