34

Tor Browser Bundle ships with NoScript (which can disable JavaScript), but NoScript’s functionality is disabled. This means that by default in the Tor Browser Bundle, all JavaScript code is allowed to execute – including potentially adversarial code.

What was the rationale behind this decision?

  • JavaScript is disabled by default since version 3.5 – user263485 Aug 24 '14 at 7:13
  • 1
    @user263485 That's largely untrue now. – user139336 Feb 17 '17 at 13:37
33

As so often in anonymity, it boils down to a tradeoff between security and usability. JavaScript certainly doesn't have an excellent track record from a security point of view and disabling it will save you from a bunch of nasty attacks. But whether we like it or not, it's a crucial usability part of today's Internet. Disabling it in the Tor Browser Bundle would break an enormous amount of web sites. To make matters worse, a large fraction of Tor's users are no computer experts. They would likely be confused by all these broken web sites and end up not using Tor anymore.

To spin the thought further, less usability means less users which means a smaller anonymity set and less user diversity. After a disabled JavaScript would have chased away the less technically savvy users, the network might end up being composed of geeks who don't mind having no JavaScript. There goes the user diversity and also some anonymity.

The current tradeoff seems sane. While JavaScript is enabled and makes web sites look nice, the NoScript extension (while allowing JavaScript) and a set of other TorBrowser patches takes care of a number of other attacks.

  • 2
    A very good answer! I'm curious about one thing - your answer implies that NoScript by virtue of being installed can prevent some attacks. Am I reading that correctly? I thought NoScript was a simple boolean deny on domain X, allow on domain Y kind of extension. – Megan Walker Sep 25 '13 at 19:52
  • 4
    You are reading that correctly, Samuel: NoScript does more than the name suggests! It is able to block other content such as Java and Flash and has XSS countermeasures, among other things. The web site gives a good overview: noscript.net/features – Philipp Winter Sep 25 '13 at 19:57
  • 5
    Might be useful to link to torproject.org/docs/faq#TBBJavaScriptEnabled as well? – Roger Dingledine Sep 25 '13 at 20:18
  • Might be useful to disable by default. In light of the last events with Freedom Hosting. – perpetuity Oct 5 '13 at 22:23
10

The Tor Browser Bundle ships with Javascript enabled because disabling Javascript disrupts the user experience and even usability of such a significant portion of the internet.

That being said, you should disable Javascript unless you absolutely need it to access a specific site! See also the FAQ entry: Why is NoScript configured to allow JavaScript by default in the Tor Browser Bundle? Isn't that unsafe?

  • 2
    Why do you say "you should disable Javascript"? Reference, please! – user66 Sep 25 '13 at 20:25
  • 3
    For another recommendation to disable Javascript, see this Tor security advisory – Steven Murdoch Sep 26 '13 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.