Install and verify Tor Browser on Ubuntu
Published on 05 October 2025
Introduction
In a world where digital privacy is increasingly threatened, Tor Browser remains an essential tool for preserving one’s anonymity and freedom of information. However, it is crucial never to run a downloaded software without havingverified its authenticity. This article presents a comprehensive method for :
-
Download Tor Browser and its signature`.asc`
-
Check the validity of the downloaded file
-
Install and launch Tor Browser on Ubuntu
-
Add it to the desktop menus for daily use
-
Exploring educational and ethical OSINT resources via Tor
Downloading Tor and its signature
Create a dedicated folder for the Tor browser:
mkdir -p ~/workspace/tipiak/tor
cd ~/workspace/tipiak/torThen download the Tor Browser archive and its signature:
wget https://www.torproject.org/dist/torbrowser/14.5.7/tor-browser-linux-x86_64-14.5.7.tar.xz
wget https://www.torproject.org/dist/torbrowser/14.5.7/tor-browser-linux-x86_64-14.5.7.tar.xz.ascCryptographic verification of the signature
This step isindispensableto ensure that the downloaded file indeed comes from the Tor Project and has not been modified.
1. Import the Tor Project’s public key
gpg --auto-key-locate nodefault,wkd --locate-keys [email protected]Check that the key is properly imported:
gpg --list-keys [email protected]2. Verify the signature
gpg --verify tor-browser-linux-x86_64-14.5.7.tar.xz.asc tor-browser-linux-x86_64-14.5.7.tar.xzIf everything is correct, the following message will be displayed:
gpg: Good signature from "Tor Browser Developers (signing key)"In case of an uncertified key warning, this simply means that you have not yet signed the Tor Project’s trusted key, but the signature remains valid.
Practical case: Valid signature but uncertified key
It is common to encounter a message like this one during verification:
gpg --verify tor-browser-linux-x86_64-14.5.7.tar.xz.asc tor-browser-linux-x86_64-14.5.7.tar.xz
gpg: Signature faite le mar. 16 sept. 2025 14:26:26 CEST
gpg: avec la clef RSA CAAE408AEBE2288E96FC5D5E157432CF78A65729
gpg: Bonne signature de « Tor Browser Developers (signing key) <[email protected]> » [inconnu]
gpg: Attention : cette clef n'est pas certifiée avec une signature de confiance.
gpg: Rien n'indique que la signature appartient à son propriétaire.
Empreinte de clef principale : EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290
Empreinte de la sous-clef : CAAE 408A EBE2 288E 96FC 5D5E 1574 32CF 78A6 5729This message indicates that the signature is technically "good" (the file has not been altered), but your GPG system cannot certify trust in the key itself. To dispel this doubt, it is imperative to compare the fingerprint of the main key (EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290) with that published on the official Tor Project website.
According to the official site, the expected fingerprint is:`EF6E286DDA85EA2A4BA7DE684E2C6E8793298290`.
Since the displayed footprint by`gpg`matches exactly that of the official site, you can be certain that the key is legitimate and the file is safe. The warning of "untrusted key" is then information about your local GPG configuration, and not about the validity of the signature or the authenticity of the file.
Why verify the signature?
GPG signature verification is a fundamental act of digital security. It allows:
-
Guaranteeauthenticityof the downloaded software
-
Prevent the installation of a file compromised by a malicious actor
-
Participate in thedigital sovereigntyindividual
-
Promote a responsible and ethical digital culture
@startuml left to right direction actor "User" as U actor "TorProject server" as S usecase "Download Tor and its signature" as D usecase "Import the public key" as K usecase "Check the GPG signature" as V usecase "Install and launch Tor" as I U --> D U --> K U --> V U --> I S --> D @enduml
Extracting and launching Tor Browser
Extract the downloaded archive:
tar -xvf tor-browser-linux-x86_64-14.5.7.tar.xz
cd tor-browserThen launch the browser:
./start-tor-browser.desktopOn the first launch, a configuration window will open to establish the connection to the Tor network.
Integration with the Ubuntu desktop
To add Tor Browser to the applications menu:
./start-tor-browser.desktop --register-appYou can then:
-
Launch Tor Browser from the applications menu
-
Add it to dock favorites
-
Create a keyboard shortcut if desired
@startuml start :Téléchargement de Tor; :Importation de la clé GPG; :Vérification de la signature; if (Signature valide ?) then (Oui) :Extraction du navigateur; :Lancement du navigateur Tor; :Enregistrement dans le bureau; else (Non) :Supprimer le fichier compromis; endif stop @enduml
Explore educational resources with Tor
Tor is not only an anonymity tool. It constitutes an access portal to educational and research resources, notably in the fields of :
-
OSINT (Open Source Intelligence)
-
Educational sharing and open source
-
https://archive.org(access via Tor for more privacy)
-
https://github.com/[python
import sys sys.stdout.write(sys.stdin.read())](accessible via Tor)
-
https://librarygenesis.pro(access to free scientific literature)
-
Transmission of knowledge and understanding of humanity in the digital society
-
Resources on digital culture, freedom of expression, and access to knowledge
-
Free documentation on cybersecurity and technology ethics
Updating Tor Browser
To ensure optimal security, it is crucial to keep Tor Browser up to date. The browser includes an automatic update mechanism that can be triggered from the command line.
From the Tor Browser installation directory, simply restart the startup script:
cd ~/workspace/tipiak/tor/tor-browser
./start-tor-browser.desktopOn launch, Tor Browser will automatically check whether there is a new version. If so, it will download and install it for you.
This simple method ensures you always have the latest security patches and the most recent improvements, which is essential for secure browsing.
Conclusion
Checking your downloads is an essential reflex for anyone wishing to evolve in a safe digital environment. Installing Tor in a verified manner, it isprotect one’s digital integrity, preserve trust in free software, et strengthen its informational autonomy.
Digital security is an act of conscience, not of paranoia.
@startuml
title Synthetic view of Tor usage
actor Utilisateur
rectangle "Tor Browser" {
rectangle "Anonymity" as A
rectangle "OSINT search" as O
rectangle "Educational sharing" as E
}
Utilisateur --> A
Utilisateur --> O
Utilisateur --> E
@enduml
References
-
Official site of the Tor Project:https://www.torproject.org/download/[https://www.torproject.org/download/]
-
Signature verification documentation:https://support.torproject.org/tbb/how-to-verify-signature/[https://support.torproject.org/tbb/how-to-verify-signature/]
-
Ubuntu Documentation:https://ubuntu.com[https://ubuntu.com]
-
Educational archive:https://archive.org/details/opensource[https://archive.org/details/opensource]
|
This article is part of the series Security and Digital Awareness aiming to promote responsible and educational practices around the free tools. |