3

I'm a Pinboard user accustomed to bookmarking webpages using their bookmarklet, which looks like this:

href="javascript:q=location.href;if(document.getSelection){d=document.getSelection();}else{d='';};p=document.title;void(open('https://pinboard.in/add?url='+encodeURIComponent(q)+'&description='+encodeURIComponent(d)+'&title='+encodeURIComponent(p),'Pinboard','toolbar=no,width=700,height=350'))

Of the privacy Tor provides me as I'm browsing the web, what, if anything, would I be giving up or risking by using a bookmarklet like this?

I know not disabling javascript in the Tor browser is itself a risk, so I suppose I am asking what added or specific risk am I taking with this bookmarklet...

Improve this question

4 Answers 4

Reset to default
1

If you know and understand what the bookmarklet you use does and know the privacy implications by using this you are probably not adding specific risk.

Since you send information to pinboard.in you are however replacing anonymity with pseudonymity. This means that it might be easier for this service to reveal your identity either by doing something like giving them your email address, by allowing them create a profile around the websites you usually visit or when you use the page without Tor (maybe on accident).

The effects of making a mistake might be bigger, because even if you use a setup like this for years and you are still only pseudonymous to them one tiny mistake might cause your personality to be revealed.

Also, by looking at exit nodes you of course will be visible as someone who sometimes uses this bookmarklet which might be a trace to who you are, potentially making you trackable.

Improve this answer
1

The risk for using a link like that for that service is not something i would worry about. JavaScript becomes a risk (has been) when a third party uses it to exploit the tor browser, so that means that pinterest has to push a exploit to you, and thats extremely unlikely.

There is bigger risk for other types of exploits then what this link could do.

Improve this answer
1

If you can avoid javascript bookmarklets, please do by all means. The less information you reveal, the better off you are. If you ask a security expert, she will tell you if you are concerned about your anonymity, do not trust any website what so ever, except, if you can personally verify that at the minimum, the site is not compromised. Many sites are compromised even without their knowledge or consent, and of course some sites are honeypots with their consent. Also please read the answer to this question for additional insight to the bookmarklets issue. Can creating bookmark in TBB add any security risk for user?

Improve this answer
1

If you want to stay safe using Tor, avoid 2 things:

  • exchanging any activities, files, disk devices etc. between Tor and non-Tor

  • having anything persistent across Tor sessions - eg. bookmarklets

Why?

Both of these increase the chance of rogue forces (NSA etc.) to deanonymize you using any correlation and/or watermarking attack.

How to avoid that?

  • use separate computer and separate router for doing Tor activities

  • each Tor session should end with proper logging out from used services, and clearing cookies

  • each quarter/month/week/day destroy & rebuild all your Tor environment (how often, depends on risk level)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .