14

I just noticed that the browser extension NoScript is not activated when you start the Tor Browser for the first time. This could be a high security risk because it can obviously expose the users IP address and the government can find the whistleblower.

  • 1
    The question should say 'Tor Browser' and not 'Tor' I think... – Kanchu Jul 22 '17 at 14:07
  • Thought I would add a bit of clarification: It isn't “the government” which finds the whistle-blower; it is a particular department, agent, or team in a government which has been tasked by its supervisor and which is effectively obeying commands. Government isn't so coherent as it appears to people on the outside of it — an evident absence of democracy if those people happen to be citizens. – can-ned_food Aug 16 '17 at 17:34
  • NoScript is enabled by default in Tor Browser, but blocking scripts is disabled. – user598527 Aug 19 '17 at 7:58
33

It's to prevent one method of user fingerprinting

From: https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled

We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if a website they want to use requires JavaScript, because they would not know how to allow a website to use JavaScript (or that enabling JavaScript might make a website work).

There's a tradeoff here. On the one hand, we should leave JavaScript enabled by default so websites work the way users expect. On the other hand, we should disable JavaScript by default to better protect against browser vulnerabilities ( not just a theoretical concern!). But there's a third issue: websites can easily determine whether you have allowed JavaScript for them, and if you disable JavaScript by default but then allow a few websites to run scripts (the way most people use NoScript), then your choice of whitelisted websites acts as a sort of cookie that makes you recognizable (and distinguishable), thus harming your anonymity.

Ultimately, we want the default Tor bundles to use a combination of firewalls (like the iptables rules in Tails) and sandboxes to make JavaScript not so scary. In the shorter term, TBB 3.0 will hopefully allow users to choose their JavaScript settings more easily — but the partitioning concern will remain.

Until we get there, feel free to leave JavaScript on or off depending on your security, anonymity, and usability priorities.

  • 19
    The Tor browser is already plenty fingerprinted for you. So is traffic going through Tor. (Remember: Tor is designed to make Tor users look alike, not make Tor users look like non-Tor users.) The quoted text talks about fingerprinting of the user (which indeed is a concern) through the list of web sites for which the user allows Javascript execution. – a CVn Jul 21 '17 at 17:41
  • Yes, you're correct, I used the wrong terminology. – Benny Jul 21 '17 at 19:59
  • 1
    Here's an idea to counter user fingerprinting: have both user defined whitelist and blacklist, and everything else is blocked randomly 50% of the time on every visit. – Dialecticus Jul 22 '17 at 15:32
  • 1
    This won't help against "better protect against browser vulnerabilities" though. – Evengard Aug 15 '17 at 9:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.