ZeroDay exploits and how do we stay safe from them

Question

Tor is a browser that guarantees anonymity if used properly. But today I stumbled upon a piece of code which is claimed to be a Zero day exploit for Tor browser.

It can be located by the following link. https://lists.torproject.org/pipermail/tor-talk/2016-November/042639.html

As a person who takes privacy very seriously, I am scared to use Tor and Tor like services simply because I can be easily exposed should any of these vulnerabilities are exploited. But, we have no choice other than these services either. Right now, this exploit is still active and working.

My question is specific. Can there be a method to use the internet securely without failing under these zero day exploits?

p.s. in a case like this, shouldn't we at least put a notification via Tor Browser to its users asking them to refrain using the service until everything is fixed? I understand it may take away the trust from some users, but its better than exposing them.

Answer 1

Security and anonymity are things that can never be guaranteed. If you set strict configurations you can lower the probability of being exploited. Everything is exploited eventually, what matters is how fast the development team releases a patch.

You shouldn't be afraid to use tor because of vulnerabilities, vulnerabilities are everywhere whether you use Firefox, Chrome, Tor, whatever.

For zero day exploits all you can do is prepare. Navigate tor in a sandbox and with no personally linking data in that sandbox (i.e. don't login to your real gmail account), keep your OS/browser/plugins/anything you use updated regularly, avoid shady sites, etc. Follow the basic guidelines on how to configure/use tor: https://www.torproject.org/download/download.html.en#Warning

It's always possible that someone will break into your car, all you can do is make it harder for them to do it. If I'm in a parking garage I'm looking for the low hanging fruit, so people who don't have their car locked. It's not time efficient to spend all that time/effort on you when someone else's door was unlocked.

Expect your machine will be compromised, prepare for the worst. Don't keep anything important cached in your browser, don't keep a list of passwords on your machine, don't leave your wallet in your car.