I just noticed that the browser extension NoScript is not activated when you start the Tor Browser for the first time. This could be a high security risk because it can obviously expose the users IP address and the government can find the whistleblower.

  • 1
    The question should say 'Tor Browser' and not 'Tor' I think...
    – Kanchu
    Jul 22, 2017 at 14:07
  • Thought I would add a bit of clarification: It isn't “the government” which finds the whistle-blower; it is a particular department, agent, or team in a government which has been tasked by its supervisor and which is effectively obeying commands. Government isn't so coherent as it appears to people on the outside of it — an evident absence of democracy if those people happen to be citizens. Aug 16, 2017 at 17:34
  • NoScript is enabled by default in Tor Browser, but blocking scripts is disabled.
    – user198350
    Aug 19, 2017 at 7:58

1 Answer 1


It's to prevent one method of user fingerprinting

From: https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled

We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if a website they want to use requires JavaScript, because they would not know how to allow a website to use JavaScript (or that enabling JavaScript might make a website work).

There's a tradeoff here. On the one hand, we should leave JavaScript enabled by default so websites work the way users expect. On the other hand, we should disable JavaScript by default to better protect against browser vulnerabilities ( not just a theoretical concern!). But there's a third issue: websites can easily determine whether you have allowed JavaScript for them, and if you disable JavaScript by default but then allow a few websites to run scripts (the way most people use NoScript), then your choice of whitelisted websites acts as a sort of cookie that makes you recognizable (and distinguishable), thus harming your anonymity.

Ultimately, we want the default Tor bundles to use a combination of firewalls (like the iptables rules in Tails) and sandboxes to make JavaScript not so scary. In the shorter term, TBB 3.0 will hopefully allow users to choose their JavaScript settings more easily — but the partitioning concern will remain.

Until we get there, feel free to leave JavaScript on or off depending on your security, anonymity, and usability priorities.

  • 19
    The Tor browser is already plenty fingerprinted for you. So is traffic going through Tor. (Remember: Tor is designed to make Tor users look alike, not make Tor users look like non-Tor users.) The quoted text talks about fingerprinting of the user (which indeed is a concern) through the list of web sites for which the user allows Javascript execution.
    – user
    Jul 21, 2017 at 17:41
  • Yes, you're correct, I used the wrong terminology.
    – Ben M.
    Jul 21, 2017 at 19:59
  • 1
    Here's an idea to counter user fingerprinting: have both user defined whitelist and blacklist, and everything else is blocked randomly 50% of the time on every visit. Jul 22, 2017 at 15:32
  • 1
    This won't help against "better protect against browser vulnerabilities" though.
    – Evengard
    Aug 15, 2017 at 9:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .