3

Using TorBrowser, login with username and password on site.com (e.g., google, amazon, etc.), then ask TorBrowser for "New Tor circuit for this site." Why does site.com (sometimes) recognize this "new Tor circuit" as associated with the same username rather than a new, currently anonymous connection?

  • I assume "New Tor circuit" request specifically forces new Tor exit node (new IP address).
  • The url is generic (not site.com/username-abc123.html).
  • JavaScript disabled.
  • It seems that TorBrowser has allowed site.com to put cookie or other identifying feature on this browser session that persists across "New Tor circuit" request.

Is this expected behavior for "New Tor circuit for this site"?

2

Requesting a new circuit will get you exactly that -- a new circuit. It does not mean that Tor won't pick the same exit again, and it will not clean any cookies. It is trivial then of course for a site to recognize you again.

What you want and what was already suggested is "New Identity". Unfortunately, Tor Browser currently has to restart to get you a clean new profile. You cannot safely get a new session without restarting the browser.

A good document that goes into more detail is https://www.torproject.org/projects/torbrowser/design/ .

This question was also previously discussed in Tor Browser Bundle (TBB) new circuit versus new identity .

0

It could be a session cookie. Try using a new identity, instead of merely a new circuit. I believe that the latter will get rid of any session cookies.

  • session cookies can be not the only reason – Alexey Vesnin Feb 29 '16 at 21:46
0

It's a persistent cookies + browser fingerprinting. You need to use a separated/dedicated virtual machine for web browsing to be 100% sure to "split identities"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.