New Me: Understanding Expert and Non-Expert Perceptions and Usage of the Tor Anonymity Network

Tor is an anonymizing network originally built by researchers in 2002. Today it is used by over 1.7 million people daily for anonymization, the evasion of security controls, and other use cases. While some Tor users have a background in cybersecurity or software, many of its users are not especially technologically savvy.

In Gallagher2017, researchers sought to understand the difference in use-cases and in understanding across this spectrum of users. The first step to gaining this insight was to recruit Tor users to interview, which is a difficult task since Tor users are a population very sensitive to observation. Despite this difficulty, 17 subjects were recruited and interviewed. Then, using a 5 question post-interview test, the participants were categorized as either "expert" or "non-expert/novice" and the two groups were analyzed separately.

Many of the findings were not surprising:

• Experts reported using Tor as a tool for multiple use cases while novices typically had one use case. Some novices believed that their use case was all Tor was built for.
• When asked to "draw what happens when you use the Tor Browser Bundle" experts tended to draw technical diagrams, detailing the path Tor takes through the Tor network.

Other findings were less intuitive:

• Many novices described how Tor worked through metaphors primarily concerned with the social good. Some metaphors used were the "Tree of Knowledge", "Fort Knox", or "the Statue of Liberty".
• No major differences were found between the two groups in their understanding of the trade-offs between national security and Tor.

Despite the small sample size of the paper, the authors were able to observe some interesting contrasts that enabled them to make meaningful recommendations to assist novices' understanding or to address comments made by all users. For example, a recommendation given to the Tor project was to include more detailed route information in the browser to make it obvious that Tor is not a centralized service but one that uses nodes owned by different entities.