1

How does enabling javascript affect whether a Tor user's IP address is revealed if the site is not launching an exploit or attack?

For example, Instagram's privacy policy states that they collect IP addresses in their log file. So does enabling javascript automatically allows a site like Instagram to collect a Tor user's true IP address? Or does enabling Javascript mean only certain information about the browser is collected but not the true IP address?

From Instagram's privacy policy - Log file information:

Log file information is automatically reported by your browser each time you make a request to access (i.e., visit) a web page or app. It can also be provided when the content of the webpage or app is downloaded to your browser or device.
When you use our Service, our servers automatically record certain log file information, including your web request, Internet Protocol ("IP") address, browser type, referring / exit pages and URLs, number of clicks and how you interact with links on the Service, domain names, landing pages, pages viewed, and other such information. We may also collect similar information from emails sent to our Users which then help us track which emails are opened and which links are clicked by recipients. The information allows for more accurate reporting and improvement of the Service.
Improve this question

1 Answer 1

Reset to default
1

When I used the find my location feature on a few websites with JS enabled, it showed that I'm in that exit node's country. So this leads me to conclude that the chances of JS leaking the real IP is low, especially among legitimate websites. But if the site is compromised or an active attack is underway, then the enabling of JS is a vulnerability.

Improve this answer
2
  • JS cannot reveal your real IP address outside of a scenario where a vulnerability in Tor Browser is exploited. There is no legitimate way for javascript to get your IP (in Tor Browser), they will only see the exit IP.
    – cacahuatl
    May 8, 2017 at 2:29
  • Thanks for the clarification! There's a lot of misinformation out there. I can't see why a legitimate site like Facebook, Instagram, or Twitter would leverage an exploit, even if compelled by authorities.
    – Natalie Lotz
    May 8, 2017 at 6:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .