2

I have Tor running as a system service, but I also want to use Tor Browser Bundle to browse the web. This means (I think) that I have two copies of tor running, one as 'debian-tor' and one as 'user'. Because I have two different Tor instances running, I likely have two different guards that I always use at the same time. This is bad because an adversary can now track my physical movements more easily by observing my guards and correlating connections made to them.

How do I use Tor Browser Bundle with system tor, without letting the tbb-tor connect to the network?

4

This is a bad idea for several reasons, especially with Tor Browser 4.5 alpha or newer as the circuit use behavior between vanilla (eg: a system tor) and Tor Browser's bundled tor instance is substantially different in several ways.

That said, the instructions at https://trac.torproject.org/projects/tor/wiki/TorBrowserBundle3SAQ should still work, assuming you understand the differences between the two copies of tor and wish to do it anyway.

1

You will use two guards, but for two different types of connections and may not use both simultaneously.I don't see much advantage for your adversary. If you want to be more quiet, you can still add some noise to your connections by adding random tcp trafic (watching video on youtube...).

1

By adding the following to extension-overrides.js in your TBB profile

pref("extensions.torlauncher.start_tor", false);
pref("extensions.torlauncher.prompt_at_startup", false);

about:tor will report that something's not working, but that's not really accurate in this scenario.

0

If you're that worried, then you could change the SOCKS5 port from 9150 to 9050, but that might confuse your Torlauncher add-on.

I'd maybe confirm this answer with the Tor project mailing list to be sure that it's equivalent to add HTTPS Everywhere, NoScript, and Torbutton to a regular FireFox/IceWeasel profile.

I'm mostly worried that you'd miss the TBB's upgrade cycle, well maybe Torlauncher handles that, not Torbutton. TBB might patch a FireFox vulnerability faster than Debian.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.