Is there a difference (in terms of anonymity) between pressing "New Identity" and closing then reopening Tor Browser?
Pressing the "New Identity" button takes < 1 second before being ready whereas closing and reopening the browser takes ~5 seconds
Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.Sign up to join this community
Effectively, they should be the same. The New Identity button is there to provide a clean instance of the Tor Browser, with various caches and other information cleared and new circuits.
There is one exception to this, in systems like Tails or Whonix (where the Tor Browser is configured to use a pre-existing instance of the Tor daemon). In those cases you should prefer New Identity, because New Identity also sends the
NEWNYM signal to the Tor daemon which causes it to mark all existing circuits as 'dirty' (to avoid re-using circuits attached to the old identity) and clears out DNS and and Rendezvous caches on Tor itself (to avoid re-using cached and potentially tainted cached information from the old identity). In those cases New Identity provides a more thorough unlinking of old and new activities than simply closing and re-opening the Tor Browser.
From the Tor Browser Design Specification:
nsIDOMWindowUtil.suppressEventHandling(). We then stop all page activity for each tab using
browser.webNavigation.stop(nsIWebNavigation.STOP_ALL). We then clear the site-specific Zoom by temporarily disabling the preference
browser.zoom.siteSpecific, and clear the GeoIP wifi token URL
geo.wifi.access_tokenand the last opened URL prefs (if they exist). Each tab is then closed.
After closing all tabs, we then emit
"browser:purge-session-history"(which instructs addons and various Firefox components to clear their session state), and then manually clear the following state: searchbox and findbox text, HTTP auth, SSL state, OCSP state, site-specific content preferences (including HSTS state), content and image cache, offline cache, offline storage, Cookies, crypto tokens, DOM storage, the safe browsing key, and the Google wifi geolocation token (if it exists). We also clear NoScript's site and temporary permissions, and all other browser site permissions.
After the state is cleared, we then close all remaining HTTP keep-alive connections and then send the
NEWNYMsignal to the Tor control port to cause a new circuit to be created.
Finally, a fresh browser window is opened, and the current browser window is closed (this does not spawn a new Firefox process, only a new window). Upon the close of the final window, an unload handler is fired to invoke the garbage collector, which has the effect of immediately purging any
blob:UUIDURLs that were created by website content via