Tor is Not Darkweb: A Love Story in Layers (of Encryption)

Let’s get one thing straight: Tor is not the dark web. If you just gasped and clutched your pearls — good. You’ve been lied to. Repeatedly. Possibly by bad movies, worse TV shows, or that one guy at a party who says, “I downloaded Tor and now I can see everything.” (No, Mr. H.Kuru-C. You’re just on a very slow Reddit.)

In this blog post, we’re going to:

Explain what Tor is (and what it’s not): We start with a simple explanation to clear up the most common misconceptions.
Break down how Tor works, technically but accessibly: We’ll dive into how Tor functions using its unique onion routing and relay system.
Share a brief history of the Tor Project: A quick look at Tor’s roots and how it’s evolved over time.
Show why everyday people (not just hoodie-wearing hackers) use it: Tor isn’t just for the “dark web”; here’s why ordinary folks turn to it for privacy and security.
Help you decide when Tor makes sense in daily life — and when it might be overkill: Practical advice on whether Tor is the right choice for you, and when it might just be overkill.
Run some Python experiments with Tor to see it in action: Finally, we’ll put theory into practice with some code to demonstrate Tor’s real-world use.

So let’s set the record straight.

🧅 What is Tor (and What It’s Definitely Not)

Tor stands for The Onion Router. No, it’s not a recipe. It's a privacy-focused network that lets you browse the internet anonymously by bouncing your connection through multiple servers around the world.

What it’s not:

A magical portal to black markets
A “dark web browser” (more on that later)
Illegal (in most countries)
A bulletproof invisibility cloak

Think of it like this: your normal internet traffic is like yelling in a crowded room while wearing a name tag. Tor is like whispering into a series of tubes until the message pops out the other end — with no return address.

💡 How Tor Works (With Extra Onions)

When you use Tor, your connection is encrypted and routed through a random chain of three volunteer-operated servers (called relays):

Entry node – knows who you are, but not where you’re going
Middle node – just passes traffic; knows nothing
Exit node – knows where your traffic’s headed, but not who you are

Each layer of encryption is peeled off by each relay — like an onion (hence the name). No single point ever knows the whole picture.

Here’s a visual diagram:

The result? No one — not even your ISP — can easily tell where you’re going or what you’re doing.

📰 A Short History of Tor (a.k.a. The Onion Time Machine)

1990s: The U.S. Naval Research Lab invents onion routing to protect government communications
2002: First public version of Tor is released
2006: The non-profit Tor Project is founded to maintain and improve the network
2010s: Journalists, activists, and privacy nerds embrace it
Today: Millions use it daily — from journalists to dissidents to everyday folks. Yes, a few sketchy users too — but they’re not the norm. Relax.

🛡 Why Use Tor? (Besides Feeling Cool)

People use Tor for all kinds of reasons — and most of them are completely legal:

Privacy: Because your data is your business.
Bypassing Censorship: Tor helps users in oppressive regimes access blocked information.
Whistleblowing: Tools like SecureDrop rely on Tor to protect sources.
Avoiding Surveillance: Even if you’re not doing anything wrong, you may not want to be watched. Totally valid.
Research: Investigators use Tor to look into sketchy things... without raising sketchy eyebrows.

Yes, you can use Tor to access .onion sites (a.k.a. hidden services), but that’s just one slice of the onion.

Know When to Use the Cloak (And When You’re Just Overdoing It)

Here’s the thing: privacy is contextual. You don’t wear sunglasses indoors unless you’re famous or you’ve cried during a Pixar movie. Likewise, you don’t need Tor every time you Google “banana bread recipe.”

👍 Use Tor when:

You need privacy: You're not out here trying to share your whole browsing history with your Wi-Fi provider.
You’re bypassing censorship: Got restrictions on Netflix or can’t access your favorite forum? Tor’s your key to freedom.
You’re handling sensitive info: Maybe you’re signing an NDA, chatting with a lawyer, or—hey—just trying to buy something that’s, well, a little sketchy.

🤚 Skip Tor when:

You’re ordering Uber Eats: Privacy’s not the priority when you're picking out pizza toppings.
You need speed: Tor can be slow—like dial-up internet slow. If you’re impatient (and who isn’t?), you might want to skip it.
You’re logged into Google like it’s 2007: If you’ve got your Gmail open, Tor’s not going to help you. Just accept that Google knows you’ve been watching cat videos all day.

🦁 Tor Tabs in Brave: The Lazy Person’s Guide to Stealth

Brave’s Tor Tabs = Tor for people who don’t want to mess around with different browsers. Just open a new tab in Brave, click on “Use Tor,” and boom, you’re browsing with privacy, no need to jump between apps.
It’s like having a secret identity without the awkward costume changes. Just a click, and you’re on your way.

💻 Demonstration: Bypassing IP-Based Rate Limiting Using Tor

Let’s put theory into practice.

Say you’re working with a server that only allows one POST request per IP address. It’s a simple but effective anti-abuse mechanism — often used in form submissions, public APIs, or lightweight systems without user authentication to prevent spam or repeated actions.

But what happens when someone routes their requests through Tor, and switches exit nodes after each request?

Let’s find out.

🧩 Part 1: The Server – Only One POST Per IP

Let’s say we’re running a simple Flask server that only allows one POST request per IP address. This is a lightweight anti-abuse technique commonly used in public APIs or unauthenticated form submissions.

# server.py
from flask import Flask, request, jsonify
from werkzeug.middleware.proxy_fix import ProxyFix

app = Flask(__name__)
app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1)  # So we get real client IP behind proxies

seen_ips = set()

@app.route('/submit', methods=['POST'])
def submit():
    ip = request.remote_addr
    if ip in seen_ips:
        return jsonify({'status': 'blocked', 'message': f'IP {ip} has already submitted'}), 403

    seen_ips.add(ip)
    return jsonify({'status': 'success', 'message': f'Received from IP {ip}'}), 200

if __name__ == '__main__':
    app.run(port=5000)

This server allows a single POST per IP — every additional attempt is blocked.

🧩 Part 2: Setting Up Tor on the Client (Ubuntu)

To test IP-based restrictions, we’ll use Tor to route traffic through different exit nodes. Here's how to set it up on an Ubuntu client machine:

Install Tor and necessary Python libraries:

sudo apt update
sudo apt install tor
pip install requests[socks] stem

Edit your Tor config:

Open /etc/tor/torrc with sudo:

sudo nano /etc/tor/torrc

Uncomment or add the following lines:

ControlPort 9051
CookieAuthentication 0
HashedControlPassword <hashed_password>

To generate a hashed password:

tor --hash-password mytorpassword

Copy the hash into torrc and restart Tor:

sudo systemctl restart tor

🧩 Part 3: The Client – Rotating IPs via Tor

Now let’s write a Python client that uses Tor’s SOCKS proxy and requests new circuits (new exit IPs):

# tor_client.py
import requests
import stem
from stem.control import Controller
import time

def renew_tor_circuit(password='mytorpassword'):
    with Controller.from_port(port=9051) as controller:
        controller.authenticate(password=password)
        controller.signal(stem.Signal.NEWNYM)

def tor_request():
    session = requests.Session()
    session.proxies = {
        'http': 'socks5h://127.0.0.1:9050',
        'https': 'socks5h://127.0.0.1:9050',
    }
    return session

if __name__ == '__main__':
    for i in range(5):
        renew_tor_circuit()
        print(f"[{i+1}] Requesting new Tor identity...")
        time.sleep(5)  # Give Tor time to switch circuits

        session = tor_request()
        try:
            response = session.post("http://127.0.0.1:5000/submit", json={"demo": "tor rotation"})
            print(response.json())
        except Exception as e:
            print(f"Request failed: {e}")

🔍 What’s Happening Behind the Scenes?

The server checks request.remote_addr for IP-based access control.
The client connects through Tor’s SOCKS5 proxy (127.0.0.1:9050).
Every loop iteration calls NEWNYM via Tor’s control port (9051) to get a fresh exit node, which gives you a new IP.
After each rotation, the client retries the same POST endpoint, bypassing the restriction because the server thinks it’s a different user.

Even though the server enforces strict per-IP limits, Tor lets the client reset its public-facing IP each time.

⚠️ Why This Matters (and Where It Breaks Down)

This simple demonstration shows just how fragile IP-based protections are when facing privacy-preserving tools like Tor. It also highlights both the power and ethical responsibility of anonymity networks.

Use cases:

Circumventing censorship in oppressive regions.
Accessing resources that wrongly block you due to shared IPs.
Automating access to a site that rate-limits unfairly.

But it's also a reminder: not every use is innocent — and not every server can afford to trust just IP addresses.

🧠 Conclusion: Tor, in Code and in Context

Tor is more than just a browser for journalists and activists — it’s a robust, programmable anonymity layer.

We just saw:

How servers often depend on IPs for control.
How Tor can render those controls ineffective.
How Python can interface with Tor to rotate circuits and obfuscate client identity.

And this is just the tip of the iceberg.

Whether you’re researching privately, bypassing censorship, or just trying to keep your digital footprint smaller — Tor offers you the power to do it. Responsibly.

So go forth, code ethically, and remember: Tor is not the dark web. It’s the privacy web.

Oh Hi There! I am Eyaadh