3

In Tor browser bundle, there are some extensions like NoScript installed. However, setting NoScript to block scripts breaks many websites that rely on Javascript. Does enabling these scripts mean that the website knows who I am (or at least my IP address)? Which scripts in particular are the most dangerous?

Improve this question

4 Answers 4

Reset to default
3

The Tor Browser Bundle includes noscript, but by default it is configured to allow scripts.

You can configure it yourself to disallow scripts, but you should be aware that if you start whitelisting sites, your whitelist can be used as a sort of user fingerprint.

Scripts should not be able to get your real IP address in the TBB. If they can, that would be considered a serious bug.

Improve this answer
2
  • Still one part of the question is unanswered. Which scripts in particular are the most dangerous?
    – user263485
    Aug 24, 2014 at 7:07
  • If you use uMatrix and only allow 1st-party scripts it should prevent sites from enumerating your whitelist.
    – Tanath
    Mar 12, 2017 at 23:57
1

It makes it far more likely that a site owner will be able to track you.

There are also risks from bugs in the Tor browser..

There are many, many techniques in Javascript for trackking the user; not all of them are fixed even in current browsers. It's possible to make a semi-unique signature based on many factors in the configuration of your browser / OS. Such a signature would be fairly distinctive if you enable Javascript, but most Tor users don't. Having Javascript disabled turns off nearly all of the factors which can be used to identify the browser.

It's easy for a provider to tell you're using Tor because the Tor exit nodes IP addresses are published (by design). Tor gives you some anonymity by making it difficult to identify individual Tor users, who are many. Anything you do differently from the majority makes it much easier to identify you when you return to the same site later.

Improve this answer
0

The do not automatically know you ip, but you do run the risk of encountering java/flash exploits that can be used to try to get your ip. All though they do try their best to prevent it from happening.

The tor blog covers these issues as they arises.

Improve this answer
0

Which scripts are the most dangerous?

  1. Scripts which target tor, etc. The reason is self evident.
  2. Scripts from social media. We all know social media is inherently vulnerable, and governments use it. (Reference several pieces of news - you can look them up yourself.)
  3. Scripts from websites you don't trust. You either do or you don't.
  4. Last but not least - your own script. Your behavior on the web can be used to track you. Especially if you make starpicular spilling mistooks. ;)
Improve this answer
2

You must log in to answer this question.