2

I have Tor running as a system service, but I also want to use Tor Browser Bundle to browse the web. This means (I think) that I have two copies of tor running, one as 'debian-tor' and one as 'user'. Because I have two different Tor instances running, I likely have two different guards that I always use at the same time. This is bad because an adversary can now track my physical movements more easily by observing my guards and correlating connections made to them.

How do I use Tor Browser Bundle with system tor, without letting the tbb-tor connect to the network?

Improve this question

4 Answers 4

Reset to default
4

This is a bad idea for several reasons, especially with Tor Browser 4.5 alpha or newer as the circuit use behavior between vanilla (eg: a system tor) and Tor Browser's bundled tor instance is substantially different in several ways.

That said, the instructions at https://trac.torproject.org/projects/tor/wiki/TorBrowserBundle3SAQ should still work, assuming you understand the differences between the two copies of tor and wish to do it anyway.

Improve this answer
3
  • Neat! How does TBB's tor differ?
    – Jeff Burdges
    Commented Apr 25, 2015 at 12:47
  • And more here : trac.torproject.org/projects/tor/ticket/13005
    – Jeff Burdges
    Commented Apr 25, 2015 at 15:08
  • 2
    @JeffBurdges TBB 4.5 has features like per-tab circuits, so basically every tab makes you look differently. But maybe this should become its own question?
    – meee
    Commented Apr 25, 2015 at 16:36
1

You will use two guards, but for two different types of connections and may not use both simultaneously.I don't see much advantage for your adversary. If you want to be more quiet, you can still add some noise to your connections by adding random tcp trafic (watching video on youtube...).

Improve this answer
1

By adding the following to extension-overrides.js in your TBB profile

pref("extensions.torlauncher.start_tor", false);
pref("extensions.torlauncher.prompt_at_startup", false);

about:tor will report that something's not working, but that's not really accurate in this scenario.

Improve this answer
0

If you're that worried, then you could change the SOCKS5 port from 9150 to 9050, but that might confuse your Torlauncher add-on.

I'd maybe confirm this answer with the Tor project mailing list to be sure that it's equivalent to add HTTPS Everywhere, NoScript, and Torbutton to a regular FireFox/IceWeasel profile.

I'm mostly worried that you'd miss the TBB's upgrade cycle, well maybe Torlauncher handles that, not Torbutton. TBB might patch a FireFox vulnerability faster than Debian.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .