The project itself isn’t new — the code has been available on GitHub for more than a year. What’s different now is that Cloudflare’s Ryan Lackey and Lookout Security’s Marc Rogers went on stage at DefCon to announce plans to make PORTAL more accessible. They want to make it much, much easier for “ordinary” Internet users to take a page from the OPSEC handbook.
PORTAL stands for Personal Onion Router To Assure Liberty. It’s Tor in a box — and in this case the box is one of TP-Link’s pocketable routers. A handful of compatible models are listed on the project page, though two are preferred: the MR11U and WR703N. They’re “chipped” models, having twice as much flash storage (8GB) and RAM (64MB) as the other supported models.
It’s like a funnel for Tor. You don’t need to remember to enable anything on a connected computer to use it. Normal Internet traffic goes in, Tor traffic goes out (and comes back, of course). Thanks to built-in support for Tor’s pluggable transports, PORTAL offers a bit of added protection against some more advanced types of traffic analysis that could undermine your privacy.
Because it’s an external box, PORTAL “never has your sensitive information on it,” noted Lackey in a chat with Ars Technia.You can expect the usual Tor browsing performance penalty with PORTAL, and it isn’t a bulletproof (or NSA-proof, if that’s a term worth using any more) solution, either. It’s not advertised that way, though. Lackey and Rogers want it to be a hassle-free way for the average surfer to operate in relative anonymity, safe from prying eyes and content filters.
Those of you who like the sound of PORTAL but don’t necessarily trust the chips inside a TP-Link router may want to check out PORTAL of Pi. It’s the same firmware modified to run on the uber-popular Raspberry Pi. For an out-of-the-box solution that truly tech-challenged folks can still probably handle, there’s Safeplug.