35

Tor Browser Bundle ships with NoScript (which can disable JavaScript), but NoScript’s functionality is disabled. This means that by default in the Tor Browser Bundle, all JavaScript code is allowed to execute – including potentially adversarial code.

What was the rationale behind this decision?

Improve this question
2
  • JavaScript is disabled by default since version 3.5
    – user263485
    Aug 24, 2014 at 7:13
  • 2
    @user263485 That's largely untrue now.
    – user139336
    Feb 17, 2017 at 13:37

2 Answers 2

Reset to default
34

As so often in anonymity, it boils down to a tradeoff between security and usability. JavaScript certainly doesn't have an excellent track record from a security point of view and disabling it will save you from a bunch of nasty attacks. But whether we like it or not, it's a crucial usability part of today's Internet. Disabling it in the Tor Browser Bundle would break an enormous amount of web sites. To make matters worse, a large fraction of Tor's users are no computer experts. They would likely be confused by all these broken web sites and end up not using Tor anymore.

To spin the thought further, less usability means less users which means a smaller anonymity set and less user diversity. After a disabled JavaScript would have chased away the less technically savvy users, the network might end up being composed of geeks who don't mind having no JavaScript. There goes the user diversity and also some anonymity.

The current tradeoff seems sane. While JavaScript is enabled and makes web sites look nice, the NoScript extension (while allowing JavaScript) and a set of other TorBrowser patches takes care of a number of other attacks.

Improve this answer
4
  • 2
    A very good answer! I'm curious about one thing - your answer implies that NoScript by virtue of being installed can prevent some attacks. Am I reading that correctly? I thought NoScript was a simple boolean deny on domain X, allow on domain Y kind of extension.
    – Megan Walker
    Sep 25, 2013 at 19:52
  • 4
    You are reading that correctly, Samuel: NoScript does more than the name suggests! It is able to block other content such as Java and Flash and has XSS countermeasures, among other things. The web site gives a good overview: noscript.net/features
    – Philipp Winter
    Sep 25, 2013 at 19:57
  • 5
    Might be useful to link to torproject.org/docs/faq#TBBJavaScriptEnabled as well?
    – Roger Dingledine
    Sep 25, 2013 at 20:18
  • Might be useful to disable by default. In light of the last events with Freedom Hosting.
    – perpetuity
    Oct 5, 2013 at 22:23
11

The Tor Browser Bundle ships with Javascript enabled because disabling Javascript disrupts the user experience and even usability of such a significant portion of the internet.

That being said, you should disable Javascript unless you absolutely need it to access a specific site! See also the FAQ entry: Why is NoScript configured to allow JavaScript by default in the Tor Browser Bundle? Isn't that unsafe?

Improve this answer
2
  • 2
    Why do you say "you should disable Javascript"? Reference, please!
    – user66
    Sep 25, 2013 at 20:25
  • 3
    For another recommendation to disable Javascript, see this Tor security advisory
    – Steven Murdoch
    Sep 26, 2013 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .