5

I read : documents should not be opened when tor running. But Tor browser bundle opens .pdf links right away in new tab using pdf.js in firefox.

Is doing that safe? Or should I disable pdf.js from about:config settings of the TBB?

  • good question - PDF files can embed tracking code and opening the files in most PDF readers is definitely not safe, but if you're opening it within TBB I'd imagine it is probably safe. – Ivar Apr 12 '14 at 16:08
  • I think TBB should come with pdf.js disabled. I searched enough and I couldn't find whether this is safe or not. That's why I posted the question here. – user1552 Apr 13 '14 at 6:13
2

Use pdf.js is not 100% sure.

There were some problems during the analysis of this addon.

First of all, Mozilla Staff some time ago did not ensure prevent 3rd party tracking via PDFs using pdf.js: https://lists.torproject.org/pipermail/tor-bugs/2013-March/039193.html

Mozilla has also been verified at least one Security bug of PDF.js using iframes: https://www.mozilla.org/security/announce/2013/mfsa2013-99.html

If you're using a linux machine with iptables properly configured then to use pdf.js is fairly safe but if you are using a windows machine then better avoid it.

  • 3
    I think it wil be better if tor developers blocked pdf.js from within torbrowser bundle – user1552 Apr 15 '14 at 12:04
0

I think that if you want to view PDFs that you have downloaded using Tor Browser, it is safer to do so in-browser using PDF.js than to download the PDF and open it with an external viewer like Acrobat.

With the external viewer, there is a high risk that if you click on an embedded URL in the document, that URL will be fetched by your normal browser using a direct connection, rather than with Tor Browser via the Tor network. With PDF.js in Tor Browser, any embedded links you click on will be opened using the current Tor Browser session.

Of course, if you don't need to view PDFs at all, then turning PDF.js off completely is probably a good idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.