2

I would really like to know why Tor does not pre-include add-ons such as Privacy Badger or Disconnect.

Thank you for your time!

Improve this question
1
  • I've wondered this as well, but presumed that the added vulnerability surface area of the add-on wasn't worth the incremental protection it gives over simply staying anonymous on Tor (never log into anything, don't visit your own sites, etc.), and getting new identities as often as you desire.
    – pseudon
    Commented Sep 7, 2017 at 22:54

2 Answers 2

Reset to default
3

Adding plugins almost always creates as many issues at it solves (assuming those things needed solving in the first place).

While I wasn't able to locate anything on Disconnect, I remembered that Privacy Badger had a bit of push a few years ago. A bit of Googling revealed tickets that list integration of Privacy Badger as a "won't fix".

This ticket specifically lists:

  • They were working on a cookie patch that made at least some of what Privacy Badger does extraneous.

  • Since Privacy Badger builds a dynamic block list over time, this is potentially unique enough for malicious scripts to fingerprint individual users.

A later ticket is clearer about the whole cookie thing:

It is useless in TBB due to these reasons:

  • TBB runs in private mode, and extensions don't have access to cookies in this mode.

  • TBB blocks 3rd-party cookies by default.

Improve this answer
1

You should not be installing extensions in the Tor Browser Bundle.

Some people have suggested we include ad-blocking software or anti-tracking software with Tor Browser. Right now, we do not think that's such a good idea. Tor Browser aims to provide sufficient privacy that additional add-ons to stop ads and trackers are not necessary.

Additionally it is possible to do fingerprinting using the extension's UUID: https://bugzilla.mozilla.org/show_bug.cgi?id=1372288

Since Privacy Badger builds a dynamic block list over time, this is potentially unique enough for malicious scripts to fingerprint individual users.

Their security concern is on the way Privacy Badger builds it's list. PB's blocked list is not pre-installed, rather, generated as the user browses and PB learns what is tracking. Because in Tor Browser you wouldn't save any of this, PB would never get to learn what to block. And that's a good thing for the TBB purposes, you don't want anything saving your browsing history in that case.

For normal browsing it's a different case, there PB can learn and block most forms of tracking.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .