This site: http://www.hongkiat.com/blog/do-donts-tor-network/
claims that
Tor Browser Bundle should not be used to protect one’s online privacy and security. FBI’s recent takedown of Freedom Hosting (an anonymous web-hosting service running as a hidden service on the Tor network) was possible due to vulnerabilities in the Tor Browser Bundle.
Are they right? Do those vulnerabilities exist? If so, how to avoid them?
The article is mostly wrong headed, at least in how the article presents it.
tl;dr - Tor Browser does a great job of making you anonymous against passive observers, it lacks against active exploitation. You should use Tor Browser but also look to isolate and/or sandbox Tor Browser.
Tor Browser doesn't currently have any publicly known vulnerabilities, that does not mean such vulnerabilities do not exist. This is true for all software.
Law enforcement resort to exploiting vulnerabilities in end points because the Tor network does it's job. Tor Browser has forced Eve (a passive eavesdropper) to become Mallory (an active attacker). This is because Tor Browser does it's intended job well, it protects the user from leaking information and provides a solid anonymity set for users. Currently no other browser used in conjunction with Tor will provide the same protection against Eve!
While people may argue (and correctly so) that Chrom{e,ium} may provide better protection against active exploitation, it will not provide the kind of protection against passive deanonymization that Tor Browser does.
Consider also that while Chrom{e,ium} is sandboxed against specific kinds of exploitation, their sandbox is incredibly limited in it's scope.
From the perspective of an attacker who wants to plant malware or spyware on your computer, it is difficult to exploit Chrom{e,ium}. You need to chain together multiple types of vulnerabilities to execute some kind of arbitrary code outside of the sandbox while also bypassing other memory corruption exploit mitigations (never-the-less, you should remember that on an almost yearly basis people do manage to create such exploit chains). The goal of their exploit is to perform activities outside of the browser's normal usage.
Consider the case of a Tor user, leaking a DNS lookup or making a connection outside of Tor could be used to deanonymize a user. This is a totally different threat model than the one that Chrom{e,ium}'s sandbox defends against. It will leak and it could be used to deanonymize you, these are normal functions that browsers perform, which are not defended against by any extra protections you would gain against the other kind of attacker.
Their simplistic suggestion of clearing "cookies and local data" doesn't come close to covering the kind of tracking/tagging side-channels possible in modern browser features. These are things that Tor Browser is designed to defend against and is entirely out of scope for stock browsers (even with "privacy" extensions). Unfortunately Firefox does, as noted, have issues defending against Mallory...however not using Tor Browser isn't the correct solution, instead you should look to isolate and harden Tor Browser.
Hardened containers, full process sandboxing, tor enforcing packet filters or isolated proxies and virtualization are but a few of the options available.
See the Tor Browser Sandbox, QubesOS, Whonix, Tails and Subgraph for some examples of how to implement this approach.
Interesting article. I don't know what the exact vulnerabilities are they talk about. But, yes, Tor Browser like any other software, has vulnerabilities. I'm not aware of any other browser that is designed to protect your privacy as thoroughly as Tor Browser. Take a look at the design document to see for yourself what is needed to get a reasonably private browser.
So, I recommend you stick with Tor Browser. (If you find anything better, let me know.)
There are ways to improve security and privacy when using Tor Browser though:
