1

Can JavaScript get my real IP even if I'm using Tor Browser? I thought Tor Browser deactivated JS by default, but I think it's not the case.

Thanks.

Improve this question
1

2 Answers 2

Reset to default
2

I'm no expert, but the most convincing answer I found is: no, JavaScript, as it is implemented in TBB, can't get your real IP.

There is a lot of confusion about that in the Web. Just do a web search and you will get a lot of different answers.

It seems like JS was originally designed in a way that it can't get your IP. People usually could do that using workarounds like requesting an external server to get your IP and then taking it back somehow. See Shog9's answer in Stack Overflow.

It changed recently with WebRTC. This standard empowers JS and makes it possible to get real IP using client-side code only. Fortunately TBB did not implement that standard.

You will find a lot of people saying that JS can give away your IP because someone could exploit some bug. While it's totally true, it's also true for every piece of software involved in Tor, so it's just no real answer.

Improve this answer
1

yes, the JS itself is capable of making an external requests in a several ways, like simple HTTP GET "some-javascript.php" with a js content type, incorporating the IP address of the HTTP request, to using document.write() and planting some plugin-related ip checkers, like flash pixel - or just simply make a XmlHttpRequest to the server-side script, returning an IP via JSON. There are alot of ways - and it's not TBB-specific, actually.

Improve this answer
4
  • Hence why it's recommended to disable JavaScript for non-HTTPS sites (every site if you're paranoid). Thankfully, WebRTC leaks are not possible since the Tor Browser has disabled the RTC protocol.
    – SuperSluether
    Apr 6, 2016 at 20:00
  • 2
    Why disable it just for non-HTTPS? Can't a HTTPS site get my IP using JS anyway?
    – Gab
    Apr 6, 2016 at 21:05
  • 1
    @Gab exactly! No matter the transport - the JS engine is a potential leak source
    – Alexey Vesnin ♦
    Apr 6, 2016 at 21:11
  • 1
    @Gab Yes, an HTTPS site can still get your IP with JS. Unfortunately, many websites require JS to work properly. Enabling it only for HTTPS sites ensures that the scripts aren't being hijacked by a 3rd party.
    – SuperSluether
    Apr 7, 2016 at 1:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .