Can I detect when someone is connecting to my server via Tor?

  • Yes. There are two ways to recognize Tor users.

    The first way is through their IP address -- the list of Tor relays is public, so you can check whether the user is coming from a known Tor relay. It's actually a little bit trickier than that though, first because every Tor relay has an exit policy (so only some relays will allow users to reach your site), and second because some Tor exit relays are multi-homed, meaning they list (and listen on) a different IP address than the one they use for outgoing traffic. We offer a "bulk exit relay list" service that you can use to fetch a list of recent IP addresses whose exit policies allow connections to your site: https://check.torproject.org/cgi-bin/TorBulkExitList.py

    And as Jens points out, if somebody visits your website from an IP address that also runs a Tor exit, you won't be able to tell the difference. That's especially important in places where many users are NATed behind a single shared IP address.

    The second way is by looking at various application-level characteristics. Torbutton, and the changes in Tor Browser, are designed to make all Tor users blend together, but they're not designed to make every Tor user indistinguishable from all other normal web browsers. So you can probably build a signature based on the differences that the Tor Browser introduces (tells you the time zone is GMT, doesn't answer certain JavaScript queries, doesn't answer certain history requests, etc) to make a pretty good Tor user recognizer. Of course, if the user isn't using Tor Browser, then this one wouldn't work.

    I should also point out that being able to distinguish Tor users doesn't break their anonymity. The goal of Tor is to prevent any single point from learning that this user went to that destination. You're not learning the location of the user here -- only that she is one of the million+ Tor users.

    And finally, there's a FAQ entry that's relevant too: "You should hide the list of Tor relays, so people can't block the exits."

    Don't refer to another answer as if this is a running conversation. This answer may (and does now) sort ahead of Jens', leaving the reader to wonder to what you meant to refer.

License under CC-BY-SA with attribution


Content dated before 7/24/2021 11:53 AM