0

A couple of months ago, I was looking at a youtube video and there were some steps to make Tor secure. For example it was suggested that the users should check that pop up windows are blocked, choose never remember history, select the option warn me when sites try to install add-ons, select block reported attack sites and block reported web forgeries. Furthermore, it was suggested that the users deactivate from the No-script options Java, Adobe Flash, Microsoft Silverlight, other plugins, /, , and @font face.

Today I visited the website of Tor and looked at the security tips, https://www.torproject.org/download/download.html.en#Warning. In the first tip it says " It is pre-configured to protect your privacy and anonymity on the web as long as you're browsing with Tor Browser itself. Almost any other web browser configuration is likely to be unsafe to use with Tor."

Does this mean that I don't have to apply any of the aforementioned changes? Is this because there was a recent update of Tor? Or the above changes do not make any difference?

Thank you very much

Improve this question

2 Answers 2

Reset to default
1

Does this mean that I don't have to apply any of the aforementioned changes?

Correct, Tor Browser doesn't allow third party plugins, so Flash, Silverlight and other plugins won't be loaded. This sounds like they were trying to configure a non-Tor Browser browser to use Tor (this is something the Tor Project explicitly recommends that you do not do).

Those changes (and many more improvements) are already included in Tor Browser by default.

Is this because there was a recent update of Tor?

It's certainly not a recent change. For a good few years now (since they moved away from providing Tor Button as an addon, to producing the fully fledged Tor Browser) those changes haven't been required to be made.

Or the above changes do not make any difference? They're (mostly) already there.

"How to configure Tor (Browser) to run securely?"

What you can do is go to the Tor Button (Green Onion) menu and go to security settings, this will take you to a screen with a slider. The slider has 3 settings, Low, Medium and High. These settings incrementally disable potentially dangerous functionality at the expense of some more advanced web browsing features. Disabling Javascript, webfonts, JIT, SVG and more.

So, disregard the video guide you saw, it's either many years old and no longer relevant, or recommending something that the Tor Project suggests that you don't do (for good reason). Tor Browser already provides those settings and does so in a more robust way than the steps outlined in the guide. If you want to improve your security, you can use the Security Slider to set your settings to a level that's appropriate for you.

Improve this answer
2
  • Thank you for the useful information. Actually, the Noscript options about disabling Java, Adobe Flash, Microsoft Silverlight, other plugins, audio/video,iframe, frame and @font face, are included in the tab Embeddings and under the heading Additional restrictions for untrusted websites. After reading the manual of No-script, I believe that you disable the above settings so that when you click globally allow scripts or temporarily allow scripts and you visit an untrusted website you won't have the above scripts running. Do you know in which cases we will need to mark some sites as untrusted?
    – user6905
    Oct 18, 2017 at 9:22
  • Tor Browser actually has patches in the firefox source code to stop it from loading in third party add-ons, which means even if NoScript weren't blocking Java, Flash, Silverlight, etc. the Firefox that Tor Browser uses still wouldn't load them.
    – cacahuatl
    Oct 18, 2017 at 19:14
-1

Similar to -> "You can have peace. Or you can have freedom!"

The same story about Tor Browser. Security vs Anonymity.

Security:

You would easily find tons of hate speeches of community with dev-team, where every one crying about Enabled by Default Java-Script. Really, it is a headache of large group of savvy hackers who doesn't producing TorBrowser but like to use something like that.

Moreover, every time when FBI cracks something in "DarkWeb", they reports about new 0-Day vulnerability in JavaScript machine inside TorBrowser, thereafter - release new "patched" version of this Super-Dooper-Modified FireFox and calms down like nothing happened.

Anonymity:

From the other side, when you will try to change something in such product like TorBrowser you will "mark" your Browser as a special one. And it is way to profile you from other crowd of TorBrowser-users. You might break the Idea lying in the background of TorBrowser's design.

When you are installing kind of "Plugin", or disabling "JavaScript", or disabling "Loading of Picture" - you becoming visible, discernible from millions "Default" users.

Finally,

When we talking about TorBrowser: "You can't have Anonymity AND can't have Security... with TorBrowser Firefox-based with enabled Java-Script by default by st..id dev-team!!!!"

Ghm...

sorry..

Improve this answer
5
  • This is both wrong and reads like it was written by Charles Manson.
    – cacahuatl
    Oct 27, 2017 at 3:24
  • "The Summer of Hate", "A Taste of Freedom", "Look at Your Game, Girl", "I'm on Fire" C'mon dude, what is wrong? Java-Script is Safe? You are kidding whole the world, not only me...
    – sqkgkahaew
    Oct 27, 2017 at 6:00
  • 1. Javascript isn't the only dangerous thing in the browser. 2. It has a security slider which disables javascript and many other dangerous features. 3. You can mitigate the potential impact of it's insecurity by running it in a confined environment. 4. Most users need javascript to do what they want with Tor Browser, it's easier for savvy users to disable than for non-savvy users to enable. You need a large anonymity set for anonymity tech to work. 5. The Tor Browser developers do not "calm down" after a bad thing happens, they actively working to help mitigate problems before they happen.
    – cacahuatl
    Oct 27, 2017 at 22:13
  • The list of things that are wrong in your answer are too long to fit into a single comment. So, I'll leave it there but this answer is, in my opinion, trash.
    – cacahuatl
    Oct 27, 2017 at 22:14
  • symmetrically...
    – sqkgkahaew
    Oct 28, 2017 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .