Tor circuit construction
A Tor client picks three relays from the consensus directory: a guard, a middle, and an exit. Through telescoping handshakes (Diffie-Hellman with each relay in turn), the client builds an encrypted tunnel where each relay only knows its immediate neighbours. The client wraps every cell in three layers of symmetric encryption, peeled off one per hop.
The guard relay is reused for months. Without that, a client rotating guards every circuit would eventually pick a malicious one and reveal connections. Sticky guards reduce the window for end-to-end traffic confirmation.
Circuits last about ten minutes by default. The same circuit handles all streams from one client to one destination during that window. Different destinations may share a circuit (for performance) or get isolated circuits (for unlinkability).
.onion v3 addresses
A .onion address is the public key of the service, base32-encoded. Onion v2 used 16 characters of a SHA-1 hash; v3 (2018+) uses 56 characters of an Ed25519 public key:
3g2upl4pq6kufc4m.onion (v2, deprecated)
duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion (v3)v3 is longer because the address IS the public key. No DNS lookup. The Tor client uses the address to look up introduction points in the distributed hidden-services directory, then establishes a rendezvous-point circuit. The service authenticates with its private key during connection.
v2 was deprecated in 2021 because 80-bit SHA-1 collisions are reachable and several vanity-address tools demonstrated cheap impersonation.
Browser fingerprinting sources
EFF's Cover Your Tracks and the Mozilla telemetry reports both demonstrate that a regular browser is uniquely identifiable from one visit:
- Canvas fingerprinting: render text to a hidden canvas and hash the pixel result. Subtle differences in font rendering and antialiasing across drivers produce stable per-device fingerprints.
- WebGL fingerprinting: render a 3D scene, read back the pixels. Identifies the GPU.
- AudioContext fingerprinting: process a known signal through the browser's audio stack. Output differs per OS/CPU.
- Font enumeration: measure rendered text width for many fonts; the set of installed fonts is distinctive.
- Timezone, screen resolution, plugin list, language headers: still meaningful even on top of the above.
Tor Browser normalises most of these (uniform window size, blocked canvas without permission, default fonts). Regular browsers add some friction (Firefox Resist Fingerprinting, Safari Intelligent Tracking Prevention) but nothing fully eliminates the surface short of running a fingerprint-uniform browser.
Differential privacy in one paragraph
A differentially private algorithm adds calibrated noise to query answers so that two databases differing in one row produce nearly-indistinguishable answers. The formal guarantee: P[A(D1) in S] <= e^epsilon * P[A(D2) in S]. Smaller epsilon = more noise = stronger privacy. Apple, Google, and Microsoft use DP for telemetry; the US Census 2020 used it for the redistricting data.
Trade-off: aggregate accuracy decreases as epsilon decreases. Real systems pick a privacy budget per user per time window and stop releasing data when it runs out. The math is subtle and easy to get wrong; libraries like Google's differential-privacy or OpenDP exist to make it less so.
Tracking that survives all of the above
Some tracking does not rely on cookies or fingerprints at all:
- Login: the moment you sign into anything, that service has a stable identifier across visits and across devices.
- Cross-device identifiers: same email used for multiple accounts links them via the platforms that buy data.
- Network-side tracking: ISPs and mobile carriers can correlate based on IP, timing, and DNS regardless of browser-side defenses.
The cleanest privacy posture is segregated identities: separate browsers (or browser profiles) for separate aspects of life, never logged into the same provider, never receiving the same emails.