6

Tor software recommends to use its own modified Firefox browser to get complete anonymity. I want to do same modifications in Firefox by myself. I have noticed following changes:

  1. Use Tor proxy settings.
  2. Use Tor remote dns resolution.

What are all other changes so that I am able to replicate Tor browser in default Firefox browser?

migrated from security.stackexchange.com Apr 6 '15 at 19:40

This question came from our site for information security professionals.

2

There are source level changes to FireFox, thanks to Yawning for correcting this here. I'll add a caveat to this answer.

I previously believed the FireFox in TBB differs from stock FireFox though FireFox configuration, add-ons, and add-ons configuration. We can explore the add-ons :

At minimum, you should install HTTPS Everywhere because malicious exit nodes can sniff traffic leaving the Tor network.

Additionally TBB comes with a specially configured NoScript. I'd install NoScript but copy over the TBB's NoScript config files. Afaik, TBB's NoScript is much milder than default NoScript, so that TBB works with sites that NoScript breaks.

Finally, TBB has a Torbutton extension that "disables many types of active content", which sounds worth installing. I donno if Torbutton merely adjusts NoScript's configuration or if it plays a more active role.

You might read Google Chrome Incognito Mode, Tor, and Fingerprinting too because that describes shortcomings in the Chrome browser that prevent the TBB extensions from working securely enough. I've just asked about using Chrome through a web proxy on Tor.SE, which might net some interesting answers too.

2

A description of the many changes made to Firefox to preserve users' anonymity is given in the Tor Browser Design Document.

1

Actually, that looks like it's about it.

If you look under TOR's how to TORify, it looks like you're using the first listed solution:

Classical / common way: use the application's proxy settings

Advantages: Does not need third party software (wrapper) Only a few proxy settings needed, sometimes a few more settings like 'use remote DNS' are required Disadvantages: Each application has to be checked and configured against DNS leaks The application is not forced to honor the proxy settings. Some applications such as Skype and BitTorrent do not care what the proxy settings are and use direct connections anyway. Also once the application is infected, it's not forced to honor the application settings

It also looks like you'll have to leave TOR open (though not the modified browser, just the program that routes your information).

That should do it, but to double check, I'd run a test at DNS leak test, and check TOR project in order to make sure that you're not leaking anything. Of course, this is assuming that you don't have any cookies or anything that could leak information on firefox and that you're not using it for anything other than over TOR, and are wiping all data after you're done.

  • Don't forget about blocking html5 canvas fingerprinting, and flash cookies that are shared between browsers. Depends how anonymous you want to be. – SilverlightFox Apr 5 '15 at 22:48
  • Good point. Disabling scripts and plugins is also recommended. – Cyrus Roshan Apr 5 '15 at 23:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.