This module opens with an introduction to the need for location obfuscation techniques, and what a VPN does. Instructors may then talk through basics of IP addresses, Virtual Private Networks, and the Tor network. Students will be asked to install Tor and navigate to the New York Times SecureDrop .onion page. Finally, the module opens to discussion about the properties of these various kinds of privacy networks, and cellphone location.

Prerequisites

Threat modeling
Internet and telecommunication security

Estimated time

55-60 minutes

Objectives

  • Students will be able to understand the privacy advantages of a Virtual Private Network, Tor, and Tor hidden services.
  • Students will be able to understand the limitations of Virtual Private Networks.
  • Students will be able to identify the properties important in a high-quality VPN service.
  • Students will be able to identify three radios built into cellphones and their respective implications for cellphone location tracking.

Why this matters

Because website connections leave clues about who visited (e.g., the fact that someone visited from the New York Times' IP range), by bouncing your connection around the world before exiting to the public internet, services like Virtual Private Networks and Tor can aid in research projects where it's important to hide your location.

Homework

(After class)

  • Read this piece from Freedom of the Press Foundation, "An in-depth guide to choosing a VPN"
  • Read this Wirecutter piece: "The Best VPN Service"
  • Students will choose a high-quality VPN, and write a short explanation what makes it high-quality, as opposed to other alternatives. What properties does this one have that distinguish it?

    Note that good VPNs require paid subscriptions; you don't want a free VPN, which may sell your browsing data. Professors should choose if requiring students to subscribe is appropriate for their course.
  • Try using Tor for an hour for routine browsing, and write down what this experience is like. What do you most like? What do you most dislike?

Sample slides

Obfuscating location (Google Slides)

Activities

Questions for discussion

  • Did you have any problems finding the New York Times .onion tip page? What problems did you run into?
  • What kind of problems might a source run into if they were to try this out?
  • How might you compromise your anonymity within Tor?

    Answer: If you enter your username and password into a website, that website can now identify you. If you are the only person using Tor in a given network, that is still visible to anyone who administrates that network. E.g., see this example of a student who used Tor to email in a bomb threat, in the hopes of avoiding his final exams. The lesson: The network administrator can tell you're using Tor, but not what you're doing in Tor, so if you are the only person on the network using it, it might look suspicious. Also, don't abuse Tor for evil, and study for your final exams.
  • How does it feel browsing with Tor compared to other browsers like Chrome, Firefox, or Safari? What's the difference for you?
  • Have you ever used "private browsing" windows (e.g., Incognito in Chrome)? What does this protect? What does this NOT protect?
  • When would you want to use Tor instead of a VPN?