14

In a recent Tor security advisory, Roger Dingledine writes:

Consider disabling JavaScript (click the blue "S" beside the green onion, and select "Forbid Scripts Globally"). Disabling JavaScript will reduce your vulnerability to other attacks like this one, but disabling JavaScript will make some websites not work like you expect. A future version of Tor Browser Bundle will have an easier interface for letting you configure your JavaScript settings [11]. You might also like Request Policy [12]. And you might want to randomize your MAC address, install various firewalls, etc.

He makes a few other suggestions, like not using Windows and switching to a LiveCD such as Tails. My question, though, relates to the "etc." in Roger's statement that "you might want to randomize your MAC address, install various firewalls, etc." Besides disabling Javascript, installing RequestPolicy, and following Roger's other recommendations, what else can/should I do to harden Firefox?

As Roger states, "JavaScript is one big vector for attack, but many other big vectors exist, like css, svg, xml, the renderer, etc." Okay, so I should probably disable images and CSS then? Short of using a text-based browser like Lynx, what can I do?

I am less concerned with linkability/fingerprinting than I am with security, i.e. maintaining the anonymity of my IP address by not getting owned.

The security advisory quoted above also touches on stuff Tor users can do at the OS level to increase security. This could involve using Tails or possibly a VM-based approach (examples are Qubes or Whonix). There are plenty of other OS options, like OpenBSD, Hardened Gentoo, and so on, each with its pros and cons.

Let's just focus on Firefox, though - regardless of OS.

Even then, this is a pretty broad question. Maybe it should be split into more than one question?

4
  • How learning effort would you agree too?
    – adrelanos
    Sep 25, 2013 at 22:11
  • And when asking/answering it's easy to mess up security and anonymity. When it's just about security, you could disable features such as loading pictures. That would be more secure (less processing program code), but less anonymous.
    – adrelanos
    Sep 25, 2013 at 22:12
  • adrelanos: Point taken about not mixing up security and anonymity. In response to your question, a steep learning curve is fine. I don't claim to be very sophisticated, but feel free to give advice even if you think it might be too advanced.
    – user48
    Sep 27, 2013 at 17:50
  • Switching to a different OS than Windows or Mac OSX is highly suggested, and will increase your security, also. Don't run any software when TBB is running, it isn't advised.
    – Carrot155
    Apr 5, 2014 at 14:22

5 Answers 5

8

This isn't Firefox option per se, but consider clicking Use new identity after every task you do using Tor. This will ensure it looks like you are connecting to Tor for first time, and no one will be able to match your new connections to older ones.

6

Another idea is to prevent the computer you run Tor on from knowing your external IP address by connecting it to the Internet via a NAT router. This helps mainly in combination with something like Tails which prevents Internet access except via Tor.

Even if your Firefox gets compromised it won't be able to send out requests directly to the Internet (due to the Tails firewall) and it will only be able to discover your internal IP address if it tries to send that back to the command and control server via Tor.

It would be better to connect to the NAT router via a wired connection and disable wireless on your computer, because if an attacker can see the MAC addresses of nearby wireless APs, they would be able to look this up on a geolocation database.

This won't stop all attacks, and in particular it won't stop an attack targeted against you, but it will make it harder to exploit a Firefox flaw.

0
4

https://blog.torproject.org/blog/tor-weekly-news-%E2%80%94-november-6th-2013 warns that

Using Firefox and Tor Browser Bundle at the same time is not a great idea because the two interfaces are almost identical, and it is easy to get the two browsers mixed up, even if you know what you are doing.

If you still feel it is convenient to have both browsers open at once, a simple "low-tech" solution to that is to install a different theme in one of the browsers.

3
  • 1
    Since TBB 3.x they open up as different programs (and thus different icons), at least in Ubuntu. This makes determining the two apart quite easy.
    – cubecubed
    Jun 19, 2014 at 3:19
  • I don't recommend installing a different theme in one of the browsers. Install a theme only on your Firefox if you want. If you do it on your TBB it makes you standout among other users and make it easier to track you.
    – user263485
    Aug 24, 2014 at 7:18
  • Does TBB really report what theme you use? Of course it's better to be safe than sorry, but it sounds like a bug … (OTOH, only having a theme on the non-Tor Browser as you say should work just as well.)
    – unhammer
    Aug 25, 2014 at 8:05
0

(This answer is just about the Tor software without using any special OS or any other software.)

Keep your Tor Browser Bundle up to date

First of all, always keep your Tor Browser Bundle up to date. If there is a newer version available, don't use the old Bundle anymore. Download the new bundle and install it to a separate folder. Don't install over the old files. This ensures that no trace from the old installation which may compromise your security is left. Completely remove the old folder.

Forbid scripts globally

Second, click on the Scripts enabled at the upper left area of Tor and click "Forbid Scripts Globally (advised)". The icon now should look like this: Scripts disabled.

Click on the Scripts disabled again and click on Options. Chose the tab Appearance. Make sure that Allow Scripts Globally (dangerous) is unchecked.

Disallow scripts globally

Disable Embeddings

Now switch to the Tab Embeddings. Disable all embeddings like Flash, Java etc:

  • Forbid Java
  • Forbid Adobe Flash
  • Forbid Microsoft Silverlight
  • Forbid other plugins
  • Forbid <IFRAME>

Forbid embeddings

Check your config

Enter about:config in the address bar. Search for javascript.enabled and make sure it is false.

1
  • Afaik all these options still habe to be configured this way in order to secure the Tor browser (refereing to v4.0).
    – dialogik
    Nov 11, 2014 at 5:51
0

As a side note, upon looking further into the FF extension "Request Policy," additional Firefox extensions are no longer recommended on the current General FAQ page at torproject.org. The Tor Security Advisory referenced in the question above is dated 5 August 2013.

Current:

Can I install other Firefox extensions?

The Tor Browser is free software, so there is nothing preventing you from modifying it any way you like. However, we do not recommend installing any additional Firefox add-ons with the Tor Browser Bundle. Add-ons can break your anonymity in a number of ways, including browser fingerprinting and bypassing proxy settings.

Some people have suggested we include ad-blocking software or anti-tracking software with the Tor Browser Bundle. Right now, we do not think that's such a good idea. The Tor Browser Bundle aims to provide sufficient privacy that additional add-ons to stop ads and trackers are not necessary. Using add-ons like these may cause some sites to break, which we don't want to do. Additionally, maintaining a list of "bad" sites that should be black-listed provides another opportunity to uniquely fingerprint users

An undated past version (maybe August 2013?) of the same page:

Can I install other Firefox extensions?

Yes. Just install them like normal. But be sure to avoid extensions like Foxyproxy that screw up your proxy settings. Also, avoid privacy-invasive extensions (for example, pretty much anything with the word Toolbar in its name).

Generally, extensions that require registration, and/or provide additional information about websites you are visiting, should be suspect.

Extensions you might like include RefControl (referer spoofing), SafeCache, Better Privacy, AdBlock Plus (EasyPrivacy+EasyList), Cookie Culler, Request Policy and Certificate Patrol.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .