Tor browser for ordering — setup and real limitations

Using Tor when browsing vendor sites is a reasonable privacy measure but it comes with practical limitations that are worth understanding before you rely on it.

What Tor actually does

Tor routes your traffic through three relays (nodes) before it reaches the destination. Each relay knows only the previous and next hop, not the full path. Your ISP sees that you are using Tor but not where you are connecting. The destination server sees the exit node's IP address, not yours. This makes it significantly harder for a passive observer to connect your browsing to your identity.

Setup

Download Tor Browser from the official Tor Project website. It comes configured for privacy by default. Do not install additional extensions — the point of Tor Browser is its standardized fingerprint. Using a modified version partially defeats the purpose because your browser fingerprint becomes unique again.

Vendor sites that run standard HTTPS over clearnet work with Tor Browser. A minority of vendor sites run on .onion addresses (Tor hidden services), which require Tor Browser to access. These sites do not exit through a public relay, which provides additional security.

The real limitations

Exit nodes can see unencrypted traffic. Any site you visit without HTTPS is readable by the exit node operator. All vendor sites should be using HTTPS — if you see an HTTP vendor site, do not submit any information through it regardless of whether you are using Tor.

Tor is slow. Page load times are three to ten times longer than normal browsing. Photo uploads in particular are painful. Some vendor sites time out during file uploads over Tor connections due to upload size limits or connection timeouts.

JavaScript is the deeper issue. Tor Browser allows JavaScript by default for usability, but JavaScript can leak information. If maximum anonymity is the goal, enabling the "safest" security level in Tor Browser disables JavaScript. This breaks most modern vendor sites that require JavaScript to function. The practical compromise most people make is using Tor with JavaScript enabled for vendor browsing and relying on the IP anonymization alone.