I read : documents should not be opened when tor running. But Tor browser bundle opens .pdf links right away in new tab using pdf.js in firefox.
Is doing that safe? Or should I disable pdf.js from about:config settings of the TBB?
2
-
good question - PDF files can embed tracking code and opening the files in most PDF readers is definitely not safe, but if you're opening it within TBB I'd imagine it is probably safe.– IvarCommented Apr 12, 2014 at 16:08
-
I think TBB should come with pdf.js disabled. I searched enough and I couldn't find whether this is safe or not. That's why I posted the question here.– user1552Commented Apr 13, 2014 at 6:13
Add a comment
|
2 Answers
Use pdf.js is not 100% sure.
There were some problems during the analysis of this addon.
First of all, Mozilla Staff some time ago did not ensure prevent 3rd party tracking via PDFs using pdf.js: https://lists.torproject.org/pipermail/tor-bugs/2013-March/039193.html
Mozilla has also been verified at least one Security bug of PDF.js using iframes: https://www.mozilla.org/security/announce/2013/mfsa2013-99.html
If you're using a linux machine with iptables properly configured then to use pdf.js is fairly safe but if you are using a windows machine then better avoid it.
-
3I think it wil be better if tor developers blocked pdf.js from within torbrowser bundle– user1552Commented Apr 15, 2014 at 12:04
I think that if you want to view PDFs that you have downloaded using Tor Browser, it is safer to do so in-browser using PDF.js than to download the PDF and open it with an external viewer like Acrobat.
With the external viewer, there is a high risk that if you click on an embedded URL in the document, that URL will be fetched by your normal browser using a direct connection, rather than with Tor Browser via the Tor network. With PDF.js in Tor Browser, any embedded links you click on will be opened using the current Tor Browser session.
Of course, if you don't need to view PDFs at all, then turning PDF.js off completely is probably a good idea.
