Tor Project Reviews Nearly One Year of Soft Launch for Android Tor VPN Beta
The Tor Project has published a review of the nearly one-year soft launch of the Android Tor VPN Beta: expanding onion routing from browser traffic to all device application traffic, and stating that the next steps for mobile will be based on real user feedback. The application remains in beta testing, aimed at users who can safely participate in feedback, and is not a finished product for high-risk scenarios.
The core difference is application circuit isolation: users select which applications use Tor, with each application having its own circuit and exit IP, preventing observers from linking privacy activities with non-privacy activities on the same device. The threat model specifies that commercial VPNs send all applications through the same tunnel, allowing operators and exit nodes to correlate traffic; Tor VPN treats each application's pseudonym as a constant, with unselected applications remaining unprotected. Implementation relies on Android connectivity interfaces and restrictions on always-on lock screen networks.
The technology stack has transitioned to the next-generation Rust implementation Arti, emphasizing memory safety and modern architecture, replacing the old C language Tor tools. The review addresses built-in obfs4 and Snowflake bridges for anti-censorship, noting that the beta version has limited anti-censorship capabilities and may not connect. The store page states that it does not collect or share user data with third parties, while warning that the platform may still identify devices and there is a risk of leakage. Distribution channels include Google Play and F-Droid, with Play showing over 100,000 downloads; the recent version is 1.9.1 Beta, which fixes database crashes on Android 8 to 10 and startup crashes on 14 to 16, and addresses issues with incorrect protection status after app updates.
Over the year, the team observed user interactions when bypassing censorship: users want key applications to reconnect, rather than having the entire device go online. The future direction is to make this application isolation a mobile privacy foundation, rather than creating another commercial VPN that sells exit nodes.
In market mechanisms, buyers are Android users who want to separate identities by application and users in censorship environments, while sellers are the non-profit Tor network and donation-driven clients; the driving force is that browser protection does not cover chat, maps, and system applications. Funding is shifting from subscription-based VPN monthly fees to donations and volunteer relays. Beneficiaries are users who need cross-application uncorrelated privacy, while commercial VPNs that funnel the entire device through the same exit and profit from logs and packages are under pressure, as are old toolchains that can only protect browser tabs.
Source: Public Information
ABAB AI Insight
The main focus of Tor's twenty-year product line has been browser isolation: separating tabs, circuits, and exits. With mobile communication moving into independent apps, even the cleanest browser cannot prevent map and instant messaging apps from sharing the same exit under the same Wi-Fi. The VPN Beta changes circuit isolation from "per tab" to "per application UID"; the threat model author describes this as a distinction from commercial VPNs, rather than a competition of speed or node count. Migrating Arti to Rust removes long-standing memory issues from C code in mobile resident processes; otherwise, a VPN service crash would expose the entire device.
Capital pathways do not follow subscription models. Distribution through Play and F-Droid, BSD licensing, and donation options are noted in the about page, while relays still rely on volunteer bandwidth. Commercial VPNs sell accountable company exits; Tor sells multi-hop without a single operator. A year of testing has resulted in a list of crashes and product details like "full protection by default, new apps automatically included," rather than user growth curves for external financing. In censorship scenarios, Snowflake disguises traffic as calls, indicating that mobile resistance is against identifying protocols, not merely changing IPs.
Comparative examples include Orbot and InviZible turning Tor into an Android VPN, and Mullvad and Proton using multi-hop and no-logs to counter correlation attacks. The industry phase has shifted from desktop anonymous browsers to system-level traffic diversion: whoever controls application-level circuits defines the pseudonym boundaries on phones. Commercial VPNs still cover the mass market that requires stable low latency; Tor occupies the segment where correlation attacks are unacceptable.
Structurally, this represents a reconstruction of the industry chain: privacy shifts from a single application function to operating system traffic scheduling. The mechanism is that the same exit IP allows advertisers and censors to create cross-application fingerprints, while circuit separation increases observation costs; if commercial VPNs replicate application tunnels, they weaken their operational model of "one account sees all traffic." Therefore, the year-end summary emphasizes not speed, but why this layer of isolation cannot be replaced by a standard VPN button.
ABAB News · Cognitive Laws
Sharing an exit means selling your applications to each other
Privacy products sell uncorrelated identities, not faster IPs
Browser protection has reached its limit; the battlefield has shifted to system traffic scheduling