I know not to install Firefox addons or plugins as it can compromise your privacy as stated by the Tor project. But what are the specific ways these addons can remove your anonymity and how can users avoid having to use them?
Add a comment
|
1 Answer
How Firefox Addons remove your anonymity/privacy:
The addon collects data on the Tor browser user. Many addons usually collect some form of data and even if the Tor browser does protect the user to some extent, it's still going to hurt the user's privacy.
Example addon: Last Pass Password Manager (there are many others)
Last Pass Password Manager is a frequently used Firefox Addon and a few Tor users even use it. However, in the extension's private policy, it clearly states that it collects many types of data including your IP address, location information, Operating System, language, and: "unique device identifiers and other diagnostic data". Last Pass even uses Google Analytics which is subject to Google's private policy. Furthermore, it uses cookies to track you for login, preferences, advertisements, and security purposes. The Last Pass addon also determines the user's location through a variety of methods. While some of these tracking methods can be combated by the Tor browser, it is very likely that at least some data is collected about the user.
The addon is easily identifiable and can be used to fingerprint the user. Websites can detect if the user is using an addon and Tor and fingerprint them based on this.
Example addon: uBlock Origin (there are many others)
uBlock Origin is a very common Firefox and Addon and it has even been suggested to the Tor project to be enabled by default. Though, uBlock Origin blocks many trackers to help the user, but you can easily detect it by testing if a tracker script normally allowed when browsing Tor, but blocked by uBlock Origin and seeing whether it executes or not. Very few Tor users actually use an tracker blocker and so you could easily be detected to be using Tor and uBlock Origin, and could be fingerprinted. The Tor browser bundle already comes with NoScript and Https Everywhere and also delete all cookies when the user closes the browser. You don't need uBlock Origin on the Tor browser when the Tor browser already comes ready to block trackers - the addon would only help fingerprint you. This also applies for similar extensions including Adblock Plus, Privacy Badger, Ghostery, etc.
Possibly the worst way The addon tries to access the internet and doesn't use Tor, revealing your IP address and exposing you. Your location can be estimated using your IP address.
Example addon: This can be any addon!
It only takes one addon to expose you through this. If the addon needs to connect to the internet and does so without Tor, it makes it easy to track you. This doesn't need to be elaborated upon. Just that simple.
Overall most addons fall into one of these categories or more. That's why you shouldn't use addons with the Tor browser. There are many more ways addons can expose your identity but these are just 3 main ways. So how can we avoid using these addons we've come to depend upon?
How to avoid using Firefox addons?
Avoid installing addons which block trackers
While using a standard, conventional web browser, tracker blocking extensions come in handy since most web browsers don't automatically come blocking trackers (except for maybe Brave and Opera since they have built in ad/tracker blockers. However, the Tor browser already takes care of this issue by deleting all cookies when the browser is closed and having NoScript enabled by default to block tracking scripts. There is even an option to disable JavaScript on the Tor browser for the safest experience. By utilizing the settings the Tor browser comes with by default, you don't need addons to block trackers. Of course, data will always be collected, but the Tor browser makes sure it's collected anonymously. You can never stop a website from collecting anonymous data no matter what you try to do. Websites should have the right to collect anonymous data as they have the right to improve their services since you are using them.
Avoid installing addons which block advertisements
The reason adblockers were first created were to stop all the annoying flashy ads and popups that were so unethical and advertisements that personalized you. By using NoScript and by disabling JavaScript most annoying ads which personlaized you aren blocked. It's only right though if websites do get to display ads since that's the developers need a source of income. Fair advertisements should be alright, and the unfair ads can be blocked in Tor.
Avoid installing addons for password managers
As I have shown before the Last Pass Password Manager collects personal data on its users and it's just not worth installing these types of addons. Password managers can collect a variety of data through login and password systems and just in general. You can have an application like notepad to store your passwords and that's more of a better solution in terms of protecting your privacy. It's a better alternative to using addons for password managers.
Avoid installing any addon for convenience
The Tor browser wasn't created for convenience ; it was created for privacy. Most addons made for convenience aren't necessary since they are most likely collecting data on you. Think about this: if most Tor users don't need to use your addon, why would you even need to have the addon.
Summary:
Most addons in general are not concerned about your privacy and will expose you. Addons should be used for more conventional standard browsers like Firefox. If you have any addons installed already other than NoScript and Https Everywhere, uninstall them as soon as you can. It would also help to check the private policies of addons you install on other browsers as well in general if you do care about your privacy even during a regular browsing experience. I hope this answer gave you a sense of exactly why you shouldn't use an addon in Firefox.