3

Using TorBrowser, login with username and password on site.com (e.g., google, amazon, etc.), then ask TorBrowser for "New Tor circuit for this site." Why does site.com (sometimes) recognize this "new Tor circuit" as associated with the same username rather than a new, currently anonymous connection?

  • I assume "New Tor circuit" request specifically forces new Tor exit node (new IP address).
  • The url is generic (not site.com/username-abc123.html).
  • JavaScript disabled.
  • It seems that TorBrowser has allowed site.com to put cookie or other identifying feature on this browser session that persists across "New Tor circuit" request.

Is this expected behavior for "New Tor circuit for this site"?

Improve this question

3 Answers 3

Reset to default
2

Requesting a new circuit will get you exactly that -- a new circuit. It does not mean that Tor won't pick the same exit again, and it will not clean any cookies. It is trivial then of course for a site to recognize you again.

What you want and what was already suggested is "New Identity". Unfortunately, Tor Browser currently has to restart to get you a clean new profile. You cannot safely get a new session without restarting the browser.

A good document that goes into more detail is https://www.torproject.org/projects/torbrowser/design/ .

This question was also previously discussed in Tor Browser Bundle (TBB) new circuit versus new identity .

Improve this answer
0

It could be a session cookie. Try using a new identity, instead of merely a new circuit. I believe that the latter will get rid of any session cookies.

Improve this answer
1
  • session cookies can be not the only reason
    – Alexey Vesnin ♦
    Feb 29, 2016 at 21:46
0

It's a persistent cookies + browser fingerprinting. You need to use a separated/dedicated virtual machine for web browsing to be 100% sure to "split identities"

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .