0

While extensions can deanonymize you in many ways, one of the worst ways they can expose you is if they connect to the internet but not over the Tor network and reveal your IP address. So would it hypothetically be possible for the Tor browser to forcefully redirect all connections made by the user's addons to keep them anonymous? If it is, will the Tor browser impliment this?

Improve this question

1 Answer 1

Reset to default
0

Firefox already sends extensions traffic through the configured proxy. Not doing so doesn't really make sense.

However, additionally Tor Browser does do more, to be even more sure that they don't go through anything other than the proxy: https://2019.www.torproject.org/projects/torbrowser/design/#proxy-obedience

And just to make sure that Tor Browser really did, I installed an extension that checked my IP address, which wasn't what I remembered my home IP address is.

Edit: @Swangie. Well, one of our answers is wrong.

The best I could find is this: "[A proxy] intercepts all requests to the Internet" also "Proxies are often part of corporate firewalls." If Firefox didn't make addons use proxy they may be blocked by firewalls.

Additionally, an extension would probably use HTTP something which is proxied.
"We have verified that these settings and patches properly proxy HTTPS, OCSP, HTTP, FTP, gopher (now defunct), DNS, SafeBrowsing Queries, all JavaScript activity, including HTML5 audio and video objects, addon updates, WiFi geolocation queries, searchbox queries, XPCOM addon HTTPS/HTTP activity, WebSockets, and live bookmark updates. We have also verified that external protocol helpers, such as SMB URLs and other custom protocol handlers are all blocked. "

I found also this: https://stackoverflow.com/questions/39582880/how-do-firefox-extensions-use-ip-address-with-anonymous-proxy-original-ip-may-b

One: Seems it isn't possible now that XPCOM has been retired from extensions: https://discourse.mozilla.org/t/any-way-to-get-local-ip-address/21408
Two: I'm not sure.
Three: "we patch OCSP and PKIX code to prevent any use of the non-proxied command-line tool utility functions from being functional while linked in to the browser".
Four: I'm not sure.

I would also have to point at the fact that the design document is 2-3 years old and only a draft.

Improve this answer
8
  • Does the browser drop UDP traffic from extensions correctly?
    – Steve
    Mar 2, 2021 at 17:18
  • @HackerNCoder if addons can't access your home IP address, then how come they expose you as stated here: tor.stackexchange.com/a/8848/31632?
    – Swangie
    Mar 2, 2021 at 17:22
  • @Steve I am not sure. From what I read in the design docs, yes.
    – HackerNCoder
    Mar 3, 2021 at 1:10
  • @Swangie updated my post.
    – HackerNCoder
    Mar 3, 2021 at 1:10
  • @HackerNCoder, correct me if I am wrong, but from what I understood, you're saying addons use proxies and even if they connect to the internet without the Tor network, then you won't be exposed. If this is what you mean, do this mean tor.stackexchange.com/a/8848/31632 is wrong?
    – Swangie
    Mar 3, 2021 at 14:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .