Several answers to other questions recommend setting Tor Browser to “remember history” to, for example:
- Save passwords.
- Add permanent HTTPS certificates: answer 1, answer 2.
The last answer has a disturbing comment by cacahuatl: “N.B. this will break some of Tor Browsers protections.”
What does this mean, exactly? Not saving history is one of Tor Browser’s protections. Is that what the comment is referring to, or is there a more subtle problem?
I found one related question: Is it dangerous to leak information to remember history or accept cookies in Tor browser?. As the answer to that question points out, this question is ambiguous.
My question is more specific: Does setting Tor Browser to “remember history” cause Tor Browser to violate any of the requirements defined in the Tor Browser Design and Implementation document [1]?
Besides the comment I mentioned above, my concern is that both the implementation of the Tor Browser requirements and the implementation of “remember history” are complex. The implementation of the Tor Browser requirements is partly described in the document linked above: this description is already complex, and even that is very much out of date. The implementation of “remember history” is complex in the sense that it changes several other settings, and there is no guarantee that all affected settings are listed in the preferences screen. Nor is there any guarantee that the implementation of the Tor Browser requirements is independent of the implementation of “remember history”.
To emphasise how complex Tor Browser is, here is just part of the implementation for the “New Identity” feature:
we manually clear the following state: HTTP auth, SSL state, crypto tokens, OCSP state, site-specific content preferences (including HSTS state), the undo tab history, content and image cache, offline and memory cache, offline storage, Cache storage, IndexedDB storage, asm.js cache, cookies, DOM storage, the safe browsing key, the Google wifi geolocation token (if it exists), and the domain isolator state.
[1] Also accessible via an onion service.
