2

Obviously sites you contact only have the IP of your exit node. But, who's to say that the web page that gets sent back to you can't just contain some JavaScript that gets your real IP then sends it back to the server? I'm sure this isn't possible some how because that would render Tor almost completely useless so more or less what I'm asking is, how does Tor prevent this?

1

How would you propose this JavaScript code obtain the client's IP address?

JS running in web browsers cannot run arbitrary commands on the host machine — that would be an extreme security violation.

Pretty much every method of finding a client's IP address you'll find in online tutorials, such as this one, rely entirely on processing XHR requests to third-party APIs. So those will only get the exit node's IP address too.

2
  • So your saying that browser security would detect the code as malicious and not let it run, I think I understand Dec 9 '20 at 1:33
  • 1
    @CipherVisor I'm moreso saying that there are no features in JavaScript that would allow you get this info. It's not that a browser would detect it and prevent it, it's that there's no way to write such code to begin with
    – slondr
    Dec 9 '20 at 4:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.