Usability of anonymous web browsing: an examination of Tor interfaces and deployability

ABSTRACT

Tor is a popular privacy tool designed to help achieve online anonymity by anonymising web traffic. Employing cognitive walkthrough as the primary method, this paper evaluates four competing methods of deploying Tor clients, and a number of software tools designed to be used in conjunction with Tor: Vidalia, Privoxy, Torbutton, and FoxyProxy. It also considers the standalone anonymous browser TorPark. Our results show that none of the deployment options are fully satisfactory from a usability perspective, but we offer suggestions on how to incorporate the best aspects of each tool. As a framework for our usability evaluation, we also provide a set of guidelines for Tor usability compiled and adapted from existing work on usable security and human-computer interaction.

REFERENCES

• 1: Anonymity bibliography. In Freehaven. ONLINE: http://freehaven.net/anonbib/.
• 2: Foxyproxy 2.2.1 http://foxyproxy.mozdev.org (accessed Nov 2006).
• 3: Privoxy 3.0.3 http://www.privoxy.org (accessed Nov 2006).
• 4: Tor 0.1.1.25 http://tor.eff.org (accessed Nov 2006).
• 5: Torbutton 1.0.4 http://freehaven.net/~squires/torbutton/ (accessed Nov 2006).
• 6: Torpark 1.5.0.7a http://www.torrify.com (accessed Nov 2006).
• 7: Vidalia 0.0.7 http://vidalia-project.net (accessed Nov 2006).
• 8: Oliver Berthold , Hannes Federrath , Stefan Köpsell, Web MIXes: a system for anonymous and unobservable Internet access, International workshop on Designing privacy enhancing technologies: design issues in anonymity and unobservability, p.115-129, January 2001, Berkeley, California, United States
• 9: M. Bishop. Psychological acceptability revisited. In L. Cranor and S. Garfinkel, editors, Security and Usability, pages 1--12. O'Reilly, 2005.
• 10: David L. Chaum, Untraceable electronic mail, return addresses, and digital pseudonyms, Communications of the ACM, v.24 n.2, p.84-90, Feb. 1981 [doi>10.1145/358549.358563]
• 11: Sonia Chiasson , P. C. van Oorschot , Robert Biddle, A usability study and critique of two password managers, Proceedings of the 15th conference on USENIX Security Symposium, p.1-1, July 31-August 04, 2006, Vancouver, B.C., Canada
• 12: L. Cranor. Privacy policies and privacy preferences. In L. Cranor and S. Garfinkel, editors, Security and Usability, pages 447--472. O'Reilly, 2005.
• 13: R. Dingledine and N. Mathewson. Anonymity loves company: usability and the network effect. In L. Cranor and S. Garfinkel, editors, Security and Usability, pages 547--560. O'Reilly, 2005.
• 14: Roger Dingledine , Nick Mathewson , Paul Syverson, Tor: the second-generation onion router, Proceedings of the 13th conference on USENIX Security Symposium, p.21-21, August 09-13, 2004, San Diego, CA
• 15: N. Good and A. Krekelberg. Usability and privacy: A study of KaZaA P2P file sharing. In L. Cranor and S. Garfinkel, editors, Security and Usability, pages 651--667. O'Reilly, 2005.
• 16: C. Karat, C. Brodie, and J. Karat. Usability design and evaluation for privacy and security solutions. In L. Cranor and S. Garfinkel, editors, Security and Usability, pages 47--74. O'Reilly, 2005.
• 17: I. Kerr. Anonymity. In progress encyclopedia article available from www.idtrail.org.
• 18: K. Kirby. Bidding on the future: Evidence against normative discounting of delayed rewards. In Quarterly Journal of Experimental Psychology, pages 54--70. 126, 1997.
• 19: D. Koblas and M. R. Koblas. Socks. In UNIX Security III Symposium (1992 USENIX Security Symposium), pages 77--83, 1992.
• 20: J. Muir and P. van Oorschot. Internet geolocation and evasion. In Technical Report TR-06-05. School of Computer Science, Carleton University, April 2006.
• 21: Steven J. Murdoch , George Danezis, Low-Cost Traffic Analysis of Tor, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.183-195, May 08-11, 2005 [doi>10.1109/SP.2005.12]
• 22: Jakob Nielsen, Heuristic evaluation, Usability inspection methods, John Wiley & Sons, Inc., New York, NY, 1994
• 23: Venkata N. Padmanabhan , Lakshminarayanan Subramanian, An investigation of geographic mapping techniques for internet hosts, Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications, p.173-185, August 2001, San Diego, California, United States
• 24: P. Wason. On the failure to eliminate hypotheses in a conceptual task. In Quarterly Journal of Experimental Psychology, pages 129--140. 12, 1960.
• 25: Cathleen Wharton , John Rieman , Clayton Lewis , Peter Polson, The cognitive walkthrough method: a practitioner's guide, Usability inspection methods, John Wiley & Sons, Inc., New York, NY, 1994
• 26: Alma Whitten , J. D. Tygar, Why Johnny can't encrypt: a usability evaluation of PGP 5.0, Proceedings of the 8th conference on USENIX Security Symposium, p.14-14, August 23-26, 1999, Washington, D.C.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.1 MODELS AND PRINCIPLES
      H.1.2 User/Machine Systems
          Subjects: Human factors

Additional Classification:
  H. Information Systems
  H.1 MODELS AND PRINCIPLES
      H.1.2 User/Machine Systems
          Subjects: Software psychology

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Privacy

General Terms:
Human Factors, Security

Keywords:
Tor, anonymity, browsing, onion routing, privacy, privoxy, usable security