All I want is be able to use flash and javascript while using Tor (I don't intend to use it for torrents)

Normally, using flash with Tor is not recommended because firefox plugins run outside of the sandbox, so the browser's proxy settings don't apply to them, and can reveal your real IP.

But I think it should be possible to also redirect flash to the same socket as the browser, and block the other outgoing ports just in case.

Any ideas on how to do this?

  • 2
    Flash does honor the browser's proxy settings. – grawity Jun 17 '12 at 3:34
  • As of March 1st 2013 Flash does NOT honor the browser's proxy settings at all. – David Costa Mar 1 '13 at 23:40
  • @DavidCosta as today, does it still not? – Karolinger Feb 17 '14 at 0:50
  • @Karolinger on Linux, it still ignores the proxy settings. (Flash, Firefox 27.0.1 and FoxyProxy) – David Costa Feb 17 '14 at 20:51
  • What about doing transparent proxy? An example (in this case there is even the router with TOR but you could apply the same when using TOR locally) can be found here: evolware.org/?p=224 . You can then make mostly whatever port transparently passing through TOR. – fede.evol Feb 20 '14 at 9:21

The main concern is that Flash or JavaScript, could expose personally identifiable or trackable details.

Flash could be used to store a specific type of cookies ("super cookies"), while JavaScript could be used to obtain quite a bit of browser/computer unique data (a lot of the uniqueness tests here are JavaScript based). They may also be able to obtain your IP through other means, though I admit I'm unsure about this.

However, both JavaScript and Flash should connect using your browser's proxy settings. The Tor browser bundle is optimised for privacy by disabling potentially trackable features, but it is perfectly possible to run Flash through Tor - you just have to install/enable the plugin, or use a normal browser through the Tor proxy.

  • I didn't know about the super cookies, you opened my eyes. – HappyDeveloper Jun 17 '12 at 10:43
  • About proxy settings, I found this, not sure if still valid: coderrr.wordpress.com/2009/07/29/… – HappyDeveloper Jun 17 '12 at 10:46
  • From that link: "The Flash plugin for Linux does not respect any browser’s SOCKS proxy settings" – HappyDeveloper Jun 17 '12 at 10:46
  • @HappyDeveloper I admit I don't know for sure what Flash actually does, but consider if you are behind a (corporate) firewall that only allows outgoing connections through a proxy. If Flash did not follow the browser or OS's proxy settings, it would not be able to connect at all... – Bob Jun 25 '12 at 11:47

You can use a tor middlebox, there are many tutorials out there. It basically consists in running the OS of your choice in a virtual machine and route all the traffic coming from the VM through tor.

The real IP address cannot be revealed because the VM has no way to discover it but there are other risks that you accept to take if you decide to use Flash or Javascript (see Bob's answer).

There's a Linux distribution that routes all your traffic through Tor by default, it's called Tails. If you really want to use Flash within it you'll have to install and enable it (with its related security risks).


Just to add to what Grawity said, tor routes your connection (that is your whole connection) through tor. Its an "on or off" switch, not anything in between. Flash on the other hand is full of vagaries especially when dealing with content that is drm'ed and/or live streamed. I suspect that you are using torbrowser or the torbutton add on which is another issue entirely. I believe there is a checkbox that says something to the effect "disable flash while running tor" and "isolate javascript elements..." with all of this being said, I suspect that you are trying to out-maneuver some sort or region blocking attempt and or impersonate someone that you aren't. Any legit use of this should be allowed (reaching the BBC news website from Saudi Arabia for instance) by the beeb... On the other hand, in order to stream Sports from the bbc, the geolocation verification is much more strict and specifically looks for discrepancies in certificates and cookies within your flashplayer. To not route non-flash traffic through tor would be more convienient... Either way, this isn't the place to discuss this sort of thing. Apologies if my suspicion is misplaced, if it isn't do yourself (and the tor project) a favor and buy a vpn and use that.

  • 4
    your whole connection: No. Tor sets up a (SOCKS) proxy; anything not connecting through that proxy will go through the normal connection. – Bob Jun 17 '12 at 4:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.