8

What changes are made to the Tor Brower Bundle or what does it ship with to prevent a website from linking user session together, including fingerprinting on the device such as browser or system characteristics?

Tor does not aim to hide the fact that one is using Tor, but it aims for unlinkability. Websites can however try to identify a visitor and then link session by simple technologies such as cookies. Does the Tor Browser or something that gets shipped in the bundle prevent session linking through cookies?

Cookies are familiar to most people, but the browser provides lots of other ways to enable a website to link sessions. Does the Tor Browser or another component prevent session linking through device fingerprinting?

Improve this question
3

1 Answer 1

Reset to default
3

Tor Browser uses several techniques that help to prevent the linking of sessions. These include

  • Tor Browser forces cookies to be discarded at the end of the browsing session. Cookies are small pieces of data that websites use to keep notes on who you are. They are commonly used as a login token, or as an identifier for adveritsment companies to track you across multiple sites. By discarding all cookies when you start a new browsing session, these cannot be used to track you across sites.

  • Tor Browser changes the User-Agent to be generic - the same as all other people using TorBrowser. A USer Agent is a piece of text that the Browser constructs and sends, that contains system information. A website might use this for adjusting content that is sent to you - such as to match your language settings, or to work around browser rendering bugs. An example of a string is Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405 which contains both the language setting, as well as the versions of the Operating System and Web Browser. By changing the User Agent to be generic all Tor Browser users appear to be using the same browser, on the same operating system. This prevents another method of session linking.

  • Tor Browser disables the Flash plugin, which has its own form of persistent storage. As Flash applets auto-load on most systems, this again prevents a method of tracking you across sessions.

  • A similar story applies for HTML5 storage capability. Websites can store data on your machine with the use of HTML5. This data can be much larger and more varied than cookies, and is technically distinct; but the risks in terms of being used as a tracking mechanism are the same.

For further changes to Firefox, be it patches or changed settings have a look at the design documents of TorButton and TorBrowser

Improve this answer
3
  • I'm fairly certain there are other techniques, but I don't have time right now to add them in.
    – Megan Walker
    Commented Oct 7, 2013 at 7:18
  • 1
    These are the obvious ones. I would be very interested what the others are.
    – weasel - Peter Palfrader
    Commented Oct 7, 2013 at 7:41
  • If javascript is enabled in your browser, there are a lot of other poptions for tracking, see panopticlick.eff.org for an example of what is possible.
    – IceyEC
    Commented Oct 8, 2013 at 12:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .