One is the fact that a 'rogue' node could modify it, or swap it out for an entirely different file. Now with files, there's two aspects to cover.

This doesn't mean someone isn't looking at what you are requesting, but could potentially happen especially with a 'rogue' node. There's implied trust in the Tor network at the beginning and endings of connections. One of them has to be the fact that the entry/exit nodes for your connection to the server (and the other way around), can alter data. There are several things to consider when downloading files from the Tor network. If it does, however, that's the purpose of systems like Whonix.

I suspect this doesn't matter to you, since you are installing another browser it's mostly a matter for people with high anonymity needs.

Other times, opening a file can break anonymity in less obvious ways for instance, opening a video file in your media player may trigger a fetch of a remote media file, giving that server your IP. Now, as far as anonymity goes, the warning you get from the tor browser bundle is essentially saying that by opening files outside of the browser, they can't protect you any more - they can't make any guarantees about what those files will do, and it's possible they will send your real IP back to some server somewhere.ĭownloading chrome over Tor, for instance, does not mean that chrome will be automatically protected through tor it will make requests to websites directly (unless you configure it differently), and the install process might even send a note to Google saying 'hey, this person installed chrome'. The way to solve this is to use https, in which case your connection to the website has an additional layer of encryption that will produce a large, obvious warning if someone tries to tamper with the response.

Usually, the reason to be cautious about downloading executables over Tor is that the Tor network creates a man-in-the-middle scenario: the exit node can alter the download, or replace it entirely, so that you receive some sort of malware instead.

How safe is tor