Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
I would like to install GreaseMonkey on KBB. I understand that any script might add fingerprinting issue. What if I only install GreaseMonkey?
As a side note: I only want to run my own script to read the source and output to the console. Will the host(the website) know that I run GreaseMonkey?
The sites you connect to can in fact determine if you're running GreaseMonkey and issue targeted attacks. In fact, a site can fingerprint which plugins you have installed making you vulnerable to uniquely identifying your browser across sessions. Installing GreaseMonkey has the same risks of installing any add-on but it's particularly a problem because of the new capabilities and scripts that GreaseMonkey allows. But still, there are no exploits that I know of that specifically target GreaseMonkey and as always, it's recommended you only visit trusted sites.
While you can safely install the add-on, using userscript opens a whole new set of attack vectors on your browser.
Until recently, it was possible to run userscripts using greasmonkey, while disallowing sites to run javascript using the noscript add-on.
When that is the case, you are safe since the site cannot detect that you alter their pages.
In the new tor 7.0.x, neither greasemonkey nor tampermonkey seem to work, unless I disable the noscript add-on. :-(
