NM-001: Tor Browser acquisition and configuration

1. Scope

This document covers obtaining the browser, verifying it, and setting it up. It does not cover reaching the market itself, which is specified separately, or verifying that the page you land on is genuine, which is the subject of the verification documents.

2. Acquisition

Tor Browser is downloaded from the Tor Project website and from nowhere else. Not from a forum post, not from a file locker, not from a torrent, and not from a mirror somebody recommended. The reason is straightforward. A modified build can route your traffic wherever its author chooses while looking and behaving exactly like the real thing, and you would have no way to notice from inside it.

On the first install the signature should be verified against the Tor Project public key. The procedure is documented on the same site. It takes a few minutes once and it is the only point at which you can establish that the software is what it claims to be.

3. Security level

Open the shield control and set the level to Safest. This disables scripting across all sites, along with several media formats and fonts that have historically been a source of problems. Nexus works correctly at this level, so there is no trade being made.

A site that stops working at Safest is telling you something about itself. The correct response is to reconsider the site rather than to lower the setting, and this applies to any site reached over Tor rather than only to markets.

4. What not to change

• Do not resize the browser window to an unusual shape, since window dimensions are a fingerprinting surface and the default size is shared by many users
• Do not install extensions, because each one makes your browser more distinguishable and none of them improve what this document is about
• Do not enable a VPN inside Tor Browser expecting improvement, since the interaction is more complicated than it appears and usually not an improvement
• Do not use a mobile browser claiming Tor support in place of the real client

5. Expected behaviour

Pages will be slower than on the ordinary web. Traffic passes through several relays before it reaches the service, and that routing is the entire point rather than a defect. Two or three seconds per page is normal. Thirty is not, and is covered in the document on circuit behaviour.

6. Verification of this step

You have completed this document correctly when the browser came from the Tor Project, the signature was checked on first install, the security level reads Safest, and no extensions have been added. Nothing later in the archive compensates for getting this part wrong.