Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
I heard (on youtube) it's better to configure TBB using about:config
javascript.enabled=false
network.http.sendSecureXSiteReferrer=false
network.http.sendRefererHeader=0
network.cookie.cookieBehavior=2
extensions.torbutton.saved.sendSecureXSiteReferrer=false
(It seems it does not exist in recent TBB)
Are they really neccessary? Is setting the security slider to high insufficient?
[I've heard] it's better to configure TBB using about:config
There are potential reasons you might possibly want to do this but there are things that these direct changes do not take into account, especially with the TBB.
Regarding the listed settings specifically, the issues with them are either:
They are items that already have counterparts in TBB without about:config.
They are semi-permanent solutions that can potentially cause more problems than they solve (depending on website and browsing habits).
The security concerns they address are not invalid but should be approached with thought.
It seems [about:config] does not exist in recent [versions of the] TBB.
I cannot speak for other versions, but about:config is accessible in the current revision of the Windows Tor Browser Bundle (v7.0.2).
The entries for xxx.sendSecureXSiteReferrer do seem to be missing from the basic about:config settings and likely need to be manually added if you wish to work with them.
Are [changes to these settings] really necessary? Is setting the security slider to high insufficient?
It depends greatly on what you call "insufficient". For the majority of users, using the "High" security settings in TBB is perfectly acceptable. That said, however, it does not cover every possible anonymity issue.
JavaScript
javascript.enabled=false
As it pertains to slider coverage, this is a bit of a grey area. While "High" security does disable JavaScript, it doesn't actually toggle JavaScript off in about:config. Instead, it uses NoScript, which has the same effect for security purposes.
Theoretically this could expose you if your slider settings change or NoScript is manually toggled off. However, assuming you browse any sites that you actually want JavaScript to be enabled for (some actually require it to work correctly), having the ability to toggle JavaScript on and off without accessing about:config is likely a benefit.
Cookies
network.cookie.cookieBehavior=2
Per this Mozilla Article, this disables all cookies ("No cookies are allowed").
The security slider, even set at "High", does not disable all cookies. But this same behavior is available in the TBB without about:config:
Below is a screen shot of about:config after making these changes:
To be clear, this setting was not directly altered in about:config.
On a privacy note (pun intended), while you are in the Privacy settings, I personally would also:
Note that cookies are something you may wish to turn back on later depending on site requirements. But using the TBB Privacy interface is (again) probably simpler than messing with about:config.
HTTP(S) Referer Headers
network.http.sendSecureXSiteReferrer=false
extensions.torbutton.saved.sendSecureXSiteReferrer=false
These two entries currently do not appear to be standard options available in about:config. But since at least one seems to be a valid option regarding HTTPS Referer headers, these apparently need to be manually added to about:config. Regarding the basic HTTP Referer setting:
network.http.sendRefererHeader=0
per this Mozilla Article, this toggles HTTP headers off ("Never send the Referer header or set document.referrer").
There are no settings in the TBB for Referer headers. The following paragraph from the Tor Browser Design Document gives us some insight:
When leaving a .onion domain we set the Referer header to the destination to avoid leaking information which might be especially problematic in the case of transitioning from a .onion domain to one reached over clearnet. Apart from that we haven't disabled or restricted the Referer ourselves because of the non-trivial number of sites that rely on the Referer header to "authenticate" image requests and deep-link navigation on their sites. Furthermore, there seems to be no real privacy benefit to taking this action by itself in a vacuum, because many sites have begun encoding Referer URL information into GET parameters when they need it to cross HTTP to HTTPS scheme transitions. Google's +1 buttons are the best example of this activity.
The main takeaways are:
So while these about:config options for HTTP(S) Referer headers can be set, the points above are things to consider.
Another thing to consider (and which is likely far more relevant for general browsing) is that sometimes Referer information can be blocked by simply not clicking links to sites but rather copying and pasting.
That is, when a link is copied and dropped into a new tab, the Referer header is generally blank. More broadly, many URLs come with tracking information that is not necessarily connected to actually displaying the page (and thus can safely be left off).
Leaking Referer information isn't necessarily trivial and I can't evaluate your situation. But strictly as a personal opinion, doing something like disabling Referer headers seems like a headache unless you have serious privacy concerns.
Checking Security Settings
Regardless of what settings you decide to use, I suggest you confirm that Tor is operating properly then periodically use services like JonDonym's IP Check and The EFF's Panopticlick to help verify your overall security.
