Are there Tor Browser settings that, when changed, can lead to my IP address being leaked?

  • That sure is a broad and complex question. I don't think any answer is going to be complete and correct, and even if it is, it would change tomorrow. You might like torproject.org/projects/torbrowser/design as background material. Commented Sep 25, 2013 at 21:21
  • I'm asking this from the POV of a TBB user who is afraid to leak his/her IP address. So if there are settings that should not be changed under any circumstances, it might make sense to list them here. Maybe "fingerprinting-friendly" settings after that.
    – user72
    Commented Sep 28, 2013 at 11:28

1 Answer 1


Please feel free to collaboratively edit and expand this answer until it gets somewhat complete.

  • It might be better not to maximize the Tor Browser window.
  • Do not change proxy settings.
  • Do not install add-ons, especially not those modifying the traffic (adblockers let you fetch less resources, which makes you stand out from others) and not those, which modify the looks of the browser content video or sidebars, because that might change your browser resolution, which would make you stand out as well.
  • Do not install plugins, such as Adobe Flash.
  • Enable/disable bookmark toolbar or sidebars, since that might change your browser resolution.
  • Do not enable fullscreen mode.
  • Do not disable private browsing.
  • Do not enable cookies.
  • Javascript, leave it enabled or disable it? Decide yourself.
  • Do not disable Tor Button.
  • Do not change Tor Button settings.
  • Do not enable DNT, also called "do not track", in Firefox privacy options, do not enable "Tell websites I do not want to be tracked".
  • I expand this answer during the next hour...
  • Do not enable popup windows.
  • Do not disable automatic loading of images.
  • Do not change default fonts. (?)
  • Do not choose a preferred language.
  • Do not enable "Block reported attack sites".
  • Do not enable "Block reported forgeries sites".
  • Do not enable "submit performance data".
  • Do not enable "warn me, when websites try to redirect or reload the page". (This might be recognizable by the destination server, and every bit is a bit more which can be used for fingerprinting.)
  • Do not change cache settings.
  • Do not disable "tell me when a website asks to store data for offline use".
  • When you are notified about a Tor Browser update, get the update.
  • Do not change automatic updates settings in Firefox settings, wait until Tor Browser gets it's own automatic updater.
  • Do not enable "automatically update search engines".
  • Do not enable history (you might be tempted to follow a link which contains an unique ID, which would then be pseudonymous, not anonymous).
  • Be careful with bookmarks. Do not bookmark links, which contain unique id's.
  • Do not change encryption settings (enable/disable SSL), do not change SSL root certificates (destinations servers could probe which you accept).
  • Be careful when changing settings in about:config.
  • Generally, before changing settings, you should:
    • Find out, why the setting is not changed by default in Tor Browser and eventually, propose changing the setting by default in Tor Browser.
    • use search engine and search for "tor browser change X setting" and
    • "tor browser change X setting" and
    • "site:torproject.org change X setting" and
    • custom search Tor's bug/feature tracker, example 1, example 2 and/or
    • ask on irc.oftc.net #Tor and/or
    • ask on the tor-talk mailing list