1

Heard that JavaScript interferes with Tor when browsing the internet causing a breach in its security wall, having the effect of a hole in the ozone layer. Why is this? How does this breach work exactly.

The image below shows how to enable Javascript in Tor browser, but notice the next option Allow Scripts Globally (dangerous), which implies Javascript in Tor is somehow dangerous. Why?

enter image description here

Is there a way to actively proof-check to oneself whether enabling or disabling JavaScript is interfering with Tor's ability to anonymize my traffic?

Improve this question
5
  • Can you provide a source for this claim?
    – Steve
    Commented Jan 27, 2021 at 14:51
  • Apparently, when javascript is enabled, sites can fingerprint and track people or their IP address even if they're using Tor browser. I'm trying to understand how, and how to prove it. It is also written in Lance Henderson's book Tor Darknet bundle tor.stackexchange.com/questions/3887/…
    – user610620
    Commented Jan 27, 2021 at 15:52
  • From the accepted answer: "Scripts should not be able to get your real IP address in the TBB. If they can, that would be considered a serious bug". Tor Browser also limits the effectiveness of most fingerprinting, even with JavaScript enabled. It's impossible to answer this question without an example of how JavaScript harms anonymity.
    – Steve
    Commented Jan 27, 2021 at 15:59
  • That's why I would like to know how it can be proven since they wouldn't write "dangerous" for nothing, and despite that one person's answer, I highly doubt it's exclusive to bugs only. by the way, why call it the Tor bundle as if it's completely separate from the Tor browser. what does the bundle have besides the browser
    – user610620
    Commented Jan 27, 2021 at 16:00
  • 1
    Tor Browser Bundle is the old name: blog.torproject.org/tor-browser-bundle-gnulinux
    – Steve
    Commented Jan 27, 2021 at 16:12

1 Answer 1

Reset to default
1

It is possible that NoScript means allowing JavaScript to run unrestricted in general, not just in the Tor browser but also all browsers, can be very dangerous since after all, it can lead to tracking, XSS, Cross-Site Request Forgery after all. However, if NoScript specifically means allowing JavaScript in Tor browser is dangerous, it could be due to the potential for malicious scripts. Scripts that could accidentally make you install extensions/plugins and compromise your security, scripts that could allow for Self-XSS, or uneccesary scripts that could greatly slow Tor browser down, etc. If the user doesn't have the best security mode enabled, NoScript acts as a second layer of defense for the user's privacy which could be compromised through JavaScript.

TL;DR: NoScript considers using JavaScript unrestricted since it could hurt the user's experience by compromising their privacy through the methods mentioned above. It's not as though it would immediately make you identifiable, but it could increase the chance of hurting your privacy/anonymity. That's why Tor browser has a setting to make the privacy mode "safest" which disables JavaScript, since it can hurt your anonymity/privacy.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .