And this lecture, I'm going to show you how to properly verify and install the Tor browser on an Apple
Mac OS computer.
If you want to install the Tor browser on a Windows computer, then check out the previous lecture and
if you want to install it on a Linux computer, then check out the next lecture.
Skip this lecture if you do not want to install it on a mac or computer.
Now downloading the Tor browser is very, very easy.
First of all, you want to go to the official download link and I'm going to include that in the resources
of the lecture.
And we're simply going to scroll down to the language that we want to download it in.
And I want to download the English version, and we're going to select the operating system.
So I want to download it for Mac OS and we're going to click on the 64 bit because we have a 64 bit
processor, one click on this, we'll download it for you.
But I'm not going to do that because I already have it downloaded in here and I start it in a directory
called Tor in my downloads directory.
Now once you have it downloaded you can simply double click it to start the installer and install it.
But since we are trying to protect our privacy and anonymity, it's a very good idea to verify that
this installer right here did not get modified as we downloaded it, because when you download something
from the internet, it passes through a number of nodes in which it can be modified.
So it can be modified by your Internet service provider, it can be modified by your network administrator,
and it can even be modified by hackers who managed to intercept the connection.
So to verify the integrity of this installer, you need to download a signature file so they have it
in here between the two brackets.
So as you can see, every single file has a signature with it and you need to make sure that you download
the right signature.
So I downloaded the 64 bit installer for Mac OS and therefore we have to click on this signature.
I'm not going to click it right now because I already have the signature downloaded in here and if the
file changes in any way, shape or form, the signature will not correspond to the file anymore.
And therefore, if we try to verify the file using this signature, the verification process will fail
and we will know that this file got modified.
So this signature will only validate this file if this file did not get modified since the signature
was created.
Now we have a full section in this course about encryption and verification, and you'll understand
exactly how this verification process works.
But for now, we're simply just trying to verify that this installer did not get modified as we downloaded
it.
Therefore, we're simply going to follow the instructions that the Tor website has on how to verify
the signature.
This verification process requires a specific program called GPG.
You can download it from GPG tools dot org and I'm going to include this link in the resources of this
lecture and you simply want to just click on the download and once the download is complete, click
the installer and double click the install.
And simply click on Continue, Continue.
We're leaving everything the same agreement to the agreement and click on install.
Put your password.
And give it some time to install.
Once this is installed, we're going to close it.
We're going to move the installer to the bin.
And we're actually going to give it permissions.
So we're just going to close all of this.
And now you can use the command GPG in your terminal in order to verify the integrity of this file.
So all we did so far is simply just install this program right here that we need for the verification
process.
So we're going to go to the terminal and using the terminal might seem a bit scary, but it's actually
very, very simple.
You can, first of all find it in your applications in the launchpad and here and simply you can type
terminal to start it.
And once you start it, you're simply going to run a number of commands in order to verify the integrity
of this file.
We have all of the commands in here in this page, along with a description of what they do.
And the first command that we want to run is a command to fetch or download the developer key.
The program we're using is GPG, the program that we just installed.
We're telling is that we want to locate a key and we're giving it the key that we're looking for, which
is the one belonging to the Tor browser developers.
So it's Tor browser at Tor project dot org.
And all you have to do is simply copy this and paste it in your terminal.
We're going to hit enter.
And as you can see, we got a response saying that this key has been located.
It does belong to the Tor browser developers.
We can see the email again similar to the one that we requested.
And you can see the key fingerprint right here.
Now that we have the key, we need to save it to a file.
So we're going to use another command to do that.
And again, you can simply copy it from here.
And I'm going to include the list of these commands in the resources of the lecture as well.
And we're simply going to paste it again in here.
So again, we're using the same program.
GPG We're telling it that we want to store this into a file and we're calling the output file toward
keyring so you can choose whatever name you want in here.
This file will include the key that we just downloaded, and then we're telling it which key we want
to store.
So we're telling it we want to export this specific key.
And then right here, we're actually specifying the fingerprint of the key that we just downloaded.
So notice this fingerprint is identical to the fingerprint that we see in here.
So what we're saying is we're saying we want to use GPG to export this fingerprint to the following
local file.
We're going to hit enter.
And because we don't see any errors, it means that the command got executed successfully.
So right now we should have a file in the current working directory called Talking Ring.
We can double check that by doing ls tor dot keyring and perfect.
As you can see, we have that file.
It's being listed for us.
So the next step is to actually use this key with the signature that we have in here to verify that
the installer did not get modified as it was being downloaded.
Now we have the command to do that in here, but I'm actually going to use a slightly different command
that makes things easier.
So we're still going to use GPG, the same program that we've been using so far.
We're going to say that we want to verify.
We're going to give it the the key with the dash dash key ring argument.
The key ring is named Thor dot key ring is the one that we just created right there in the previous
command.
And then we're going to give it the path to the signature file right here.
So I have my signature file in the downloads in Tor in a directory called Tor.
So we're going to type that down, we're going to type downloads T, o, r and then followed by the
name of the signature file dot a, C.
And finally, we're going to put a space followed by the name of the installer itself.
So the installer right here and now, the signature and the installer have the same file name and the
only difference is the extension right here.
So again, it's in downloads T or R and we can type capital T and hit the top button to autocomplete
because this is the only file name that we have in the directory that starts with a T, so a very simple
command.
Again, we're using GPG, the same command that we've been using.
We're saying that we want to verify a key ring and we're giving it the key ring that contains the key
for the Tor developers.
And then we're giving it the file name of the signature, followed by the file name of the installer
we're going to hit Enter.
I'm perfect.
As you can see, it's telling us that this is a good signature from the Tor browser developers.
This means that this file right here did not get modified since the developers that created the key
that we used created this signature right here.
So now we can run this file with confidence, knowing that it did not get modified and that it's going
to run exactly the same way that the Tor browser developers intended to run.
So we're going to double click it now to install it.
Now, like I said, this step is optional.
You don't have to do it, but we're doing it to protect our privacy and anonymity because if this file
gets modified, it could contain code that will have a backdoor or even render the features offered
by the Tor browser useless.
Now to install this, all you have to do is simply drag the Tor browser to your applications and that's
it.
It should be installed, so you'll be able to find it in here in your launchpad.
If you scroll to the end and I have it right here and one click on it will start it exactly the same
as any other program that you have.
We're going to tick the box to always connect automatically so that it always automatically connects
to the Tor network.
And we're going to click on Connect to Connect.
Now, don't worry about how to use this browser and all of the features.
We will cover that in details in the next lectures.