2

Obviously sites you contact only have the IP of your exit node. But, who's to say that the web page that gets sent back to you can't just contain some JavaScript that gets your real IP then sends it back to the server? I'm sure this isn't possible some how because that would render Tor almost completely useless so more or less what I'm asking is, how does Tor prevent this?

Improve this question

1 Answer 1

Reset to default
2

How would you propose this JavaScript code obtain the client's IP address?

JS running in web browsers cannot run arbitrary commands on the host machine — that would be an extreme security violation.

Pretty much every method of finding a client's IP address you'll find in online tutorials, such as this one, rely entirely on processing XHR requests to third-party APIs. So those will only get the exit node's IP address too.

Improve this answer
2
  • So your saying that browser security would detect the code as malicious and not let it run, I think I understand
    – Cipher Visor
    Commented Dec 9, 2020 at 1:33
  • 1
    @CipherVisor I'm moreso saying that there are no features in JavaScript that would allow you get this info. It's not that a browser would detect it and prevent it, it's that there's no way to write such code to begin with
    – slondr
    Commented Dec 9, 2020 at 4:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .