0

While extensions can deanonymize you in many ways, one of the worst ways they can expose you is if they connect to the internet but not over the Tor network and reveal your IP address. So would it hypothetically be possible for the Tor browser to forcefully redirect all connections made by the user's addons to keep them anonymous? If it is, will the Tor browser impliment this?

0

Firefox already sends extensions traffic through the configured proxy. Not doing so doesn't really make sense.

However, additionally Tor Browser does do more, to be even more sure that they don't go through anything other than the proxy: https://2019.www.torproject.org/projects/torbrowser/design/#proxy-obedience

And just to make sure that Tor Browser really did, I installed an extension that checked my IP address, which wasn't what I remembered my home IP address is.

Edit: @Swangie. Well, one of our answers is wrong.

The best I could find is this: "[A proxy] intercepts all requests to the Internet" also "Proxies are often part of corporate firewalls." If Firefox didn't make addons use proxy they may be blocked by firewalls.

Additionally, an extension would probably use HTTP something which is proxied.
"We have verified that these settings and patches properly proxy HTTPS, OCSP, HTTP, FTP, gopher (now defunct), DNS, SafeBrowsing Queries, all JavaScript activity, including HTML5 audio and video objects, addon updates, WiFi geolocation queries, searchbox queries, XPCOM addon HTTPS/HTTP activity, WebSockets, and live bookmark updates. We have also verified that external protocol helpers, such as SMB URLs and other custom protocol handlers are all blocked. "

I found also this: https://stackoverflow.com/questions/39582880/how-do-firefox-extensions-use-ip-address-with-anonymous-proxy-original-ip-may-b

One: Seems it isn't possible now that XPCOM has been retired from extensions: https://discourse.mozilla.org/t/any-way-to-get-local-ip-address/21408
Two: I'm not sure.
Three: "we patch OCSP and PKIX code to prevent any use of the non-proxied command-line tool utility functions from being functional while linked in to the browser".
Four: I'm not sure.

I would also have to point at the fact that the design document is 2-3 years old and only a draft.

8
  • Does the browser drop UDP traffic from extensions correctly?
    – Steve
    Mar 2 at 17:18
  • @HackerNCoder if addons can't access your home IP address, then how come they expose you as stated here: tor.stackexchange.com/a/8848/31632?
    – Swangie
    Mar 2 at 17:22
  • @Steve I am not sure. From what I read in the design docs, yes. Mar 3 at 1:10
  • @Swangie updated my post. Mar 3 at 1:10
  • @HackerNCoder, correct me if I am wrong, but from what I understood, you're saying addons use proxies and even if they connect to the internet without the Tor network, then you won't be exposed. If this is what you mean, do this mean tor.stackexchange.com/a/8848/31632 is wrong?
    – Swangie
    Mar 3 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.