MobileActive.org

Orbot is an anonymizing and circumvention app that connects Android phones to the Tor network. Developed by The Guardian Project, it is currently the only way to use Tor on a mobile phone.

Who should use it?

Orbot is for Android users who need to browse anonymously or circumvent blocked sites. It should work on both older and new model Android phones, and does not require a rooted phone (although there are some advantages to using it with one). Orbot is designed for proficient Android users.

How does it work?

Orbot sets up a connection to the Tor network and makes it available to apps through a local proxy.

• For anonymous web browsing, you also need a browser app that can route your communications through a proxy. Firefox for Android with the ProxyMob add-on will work on most newer Android 2.x and 3.x phones that run Firefox easily. Orweb is a browser designed specially for Orbot, and is recommended for all other Android 1.x, 2.x and 3.x phones.
• For anonymous instant messaging, you need an instant messaging app that can do the same. Gibberbot is an under-development app that will provide this functionality soon; Beem works now but does not provide end-to-end encryption, meaning it’s useful for avoiding surveillance by someone on your network (ISP, mobile network operator) but not for hiding your communications from the remote site
• The exception is if you have a rooted phone, in which case Orbot can send all traffic from all apps through Tor without additional configuration.

Why use it?

• Orbot is currently the only readily available mobile app that can connect to the Tor network - it is also the only mobile app approved by the Tor Project.
• Orbot is developed by the Guardian Project, an intiative dedicated to developing easy to use mobile apps for people who need privacy, security and anonymity in their communications
• The code for Orbot is open source and freely available for download - there are no costs involved except your airtime while browsing.
• The project encourages user feedback through a mailing list, feedback form on their website, twitter account and IRC channel.

Potential risks

Despite the impressive credentials of Orbot, there are always risks to be aware of when you want to be sure you’re browsing and chatting anonymously.

• To use Orbot, you need to have installed and configured the app, connected to the Tor network, and configured your browser or instant messaging client to route traffic through Orbot’s local proxy. If you don’t have Orbot configured correctly, you may not be browsing using Tor. To check, go to https://check.torproject.org/
• With Orbot and any other Tor client, your ISP or mobile network operator can tell you are using Tor to browse anonymously - but not what sites you are accessing.
• Unless you encrypt your browsing by using HTTPS (or use an instant messaging app that supports HTTPS - Gibberbot does, Beem does not), the last node in the Tor system (the exit node) can see your communications in plain text.

Installation and setup

Before you begin, check how much space you have on your phone (usually shown in settings - on my HTC here, it’s under SD Card & Phone Storage). You need at least 30Mb.

1. Install Orbot by scanning the barcode on the Tor Project’s download page, or search for it in the Android market.
2. Install an Orbot-compatible browser app
   
   1. If you have an Android 1.x phone (G1, MyTouch3G, Hero, Droid Eris, Cliq, Momen) or an older or less powerful Android 2.x or 3.x phone that won’t run Firefox, install Orweb in the Android market.
   2. If have an new model Android 2.x or 3.x phone (Nexus, Evo, Galaxy, Droid, and most Android phones less than a year old), install Firefox for Android from the Android Market, and use it to browse to https://addons.mozilla.org/en-US/mobile/addon/251558/ to install the ProxyMob Addon
   3. If you have a rooted phone, Orbot transparently sends all traffic through Tor while it is connected, and you don’t need to install a specific browser app.
3. Install an Orbot-compatible instant messaging app
   1. Gibberbot works on Android 1.x and 2.x phones, and is available from the Android market
   2. If you have a rooted phone, Orbot transparently sends all traffic through Tor while it is connected, and you don’t need to install a specific instant messaging app.
4. Set up Orbot by following the wizard. This should appear the first time you start the app, but can also be called up by opening Orbot, pressing the menu key on you phone, and choosing ‘Help’ from the menu.
   1. Unless you have a rooted phone, click the check box on the Orbot Permissions screen to continue without root, then click next
   2. You should already have installed the latest Orbot-enabled apps in the previous step. If you want to try other apps, install them on the Orbot-enabled apps screen
   3. On the Orbot-enabled apps screen, click the proxy settings button to see the proxy settings you should use to connect your chosen browser and instant messaging app to Orbot. It’s a good idea to write these down!

Running Orbot, browsing with Orweb and chatting with Gibberbot

1. Start up Orbot, and initiate the connection to the Tor network by pressing down for a couple of seconds on the big button in the middle of the screen. The button changes colour - yellow while connecting, and green once a connection has been made.
2. Set Gibberbot to use Tor by checking the ‘Connect using Tor’ option on the login screen. Then, sign in! See our followup guide to secure instant messaging with Gibberbot for more about Instant Messaging security. Set and test proxy settings in your browser.
   
   1. If you’re using OrWeb, no further configuration is required. Browse to https://check.torproject.org/ (press the menu key and select ‘Go’ to enter an address) to confirm you’re using Tor. 
      If you’re using Firefox for Android and the ProxyMob add-on, you’ll find the proxy settings in the Add-ons menu under ProxyMob’s add-on options. Use 127.0.0.1 (the address that tells the browser that the proxy is running on your phone itself) as the proxy host for both HTTP and SOCKS. Set the HTTP proxy port to 8118, and/or the SOCKS proxy port to 9050. Browse to https://check.torproject.org/ to confirm you’re using Tor.

Security App Checklist