I was using the Tor browser bundle with JavaScript turned off and when I clicked on a page with a video playing my application outside of Tor kicked in and popped up as an overlay over the Tor page asking me if I wanted to download the video!?
Anyone know how this could happen and if the IDM app would have contacted the onion site I was on thus revealing IP and making Tor useless?
Yes, this kind of application (which is going around hooking itself into applications like malware) can indeed compromise Tor Browser usage.
It may download outside of Tor Browser, or download through Tor Browser but leak DNS or any number of other activities. In this case I'd consider it to be akin to malware, even if the authors had no real ill intent, it is working against your interests and forcing its way into applications that it has no right to be in.
It would not be safe to use Tor Browser on an infected system and so I'd consider it unsafe to use Tor Browser on a system with such applications. It's possible that other applications are doing this without making obvious popups and so you haven't yet noticed. Consider Tails as an alternative operating system to help mitigate against such accidental leaks, in cases where they'd endanger you.
It's not a Tor browser fault, but it's how the data leaks: a side-effect of a very good step in browser evolution called "external container handler". The idea itself is brilliant by design: in your case you don't need to install a thing in your browser, specifically - you just call the helper container with a component to handle the content type your browser can't handle, a video in your case. But - as with most of good ideas - an implementation brings us problems. Yes, the container is created, but by OS, separated from the "calling party"(the browser in this case, it's not just a browsers problem). And it does not give a single concern about the network settings: it can just ask OS to give the system-wide proxy, it can ignore all the settings and just go directly. That's why Tor Browser - and any standalone browser is defenately not the secure way of browsing, you saw the practical illustration yourself. The VM, isolated and routed - is the secure and leak-safe way.
P.S. Don't blame Tor Browser or your OS - they're doing what they are supposed to do by design: your OS is a basic OS, and Tor Browser is just a browser. They can not do beyound the tasks they're designed for. It's your responsibility to use safe setup
Open Internet Download Manager (IDM) and go to Downloads -> Options -> and navigate to File types tab
Find
Don't start downloading automatically from the following sites:
and add *.onion to the sites list.
I'm not 100% sure if this can prevent leak DNS problem.
IDM Support team suggested me this method.
