13

I want to begin to use Tor Browser (on Windows) but before I need to know some issues. I have read Tor's six pillars and one of that is "Don't enable or install browser plugins". So my doubt is: does it include "normal" add-ons?

With "normal" addons I refer to extensions like Diigo Extension, Buffer, Zotero, Color Picker... I need some of them to work and improve my self-management.

Everything I have read is about plugins: VLC, RealPlayer, Flash, Java... But nothing about Firefox Add-ons.

Improve this question
8
  • 4
    From the perspective of using them in Tor, I don't think there's any distinction between a plugin and an addon. In the least, they will all reduce your anonymity by adding to your browser's fingerprint. The general recommendation is to not use them. Have a read of tor.stackexchange.com/questions/1225/…
    – Richard Horrocks
    Commented Oct 15, 2015 at 8:42
  • I understand. Thank you for your help @RichardHorrocks.
    – Ivanhercaz
    Commented Oct 17, 2015 at 0:36
  • @RichardHorrocks: See the answer. Plugins are easily detectable (as of SuperUser link), addons not so. Please reply if you disagree.
    – serv-inc
    Commented Jan 18, 2016 at 11:11
  • 1
    Thanks for pointing that out - it does appear that add-ons are difficult to detect :) I'd still recommend against them, even if not because of the fingerprinting issue. If the add-on isn't open source, you have know way to know what the code might be doing, which could include revealing your IP address.
    – Richard Horrocks
    Commented Jan 20, 2016 at 18:18
  • It seems to me that Tor can produce addons themselves, or at least thoroughly analyze the existing ones, and provide the community with a list of approved addons that do not undermine the service provided. Is there no discussion about this?
    – SquishyRhode
    Commented Jan 13, 2021 at 3:15

3 Answers 3

Reset to default
7

The worst thing that can happen is that the add-on tries to access the internet and doesn't use Tor.
--> that will destroy your anonymity and release your real IP address!

Hopefully the worst thing will not happen, but what definitely happens is that you(r browser) will get more trackable with every additional add-on!

Here are some tests to see how unique your profile is and what can/will be tracked:

...to be really save i would suggest to use Tails!
the related FAQ of Tails about this topic: "Can I install other add-ons in Tor Browser?"

Improve this answer
3
  • 2
    It's not about quantity of add-ons - it's possible to have 1000 normal add-ons and be untracked, but you can have just one bad quality one - and you're owned.
    – Alexey Vesnin ♦
    Commented Jan 11, 2016 at 1:37
  • @AlexeyVesnin that i wanted to say with the first abstract... but with more and more add-ons the possibility increases that you got one "bad" add-on! -- and well... people who check every add-on before installing, won't ask such a question! ;-)
    – DJCrashdummy
    Commented Jan 11, 2016 at 8:37
  • 1
    Actually there's a relatively short list of must-have add-ons, so it's not so difficult to check them all
    – Alexey Vesnin ♦
    Commented Jan 11, 2016 at 9:01
3

As of https://superuser.com/questions/137931/can-websites-see-my-firefox-addons, there is no default API to detect addons, as there is for plugins. As stated, malicious addons can certainly decloak you, but normal, heavily-used addons should have received some vetting, so should be a bit more trustworthy.

I have not examined the addons you listed, though.

Improve this answer
2
  • 2
    "addons can not be detected by default" is slightly misleading. There is no API that reports installed addons, like there is for plugins but many addons will affect the behaviour of the browser and due to this those can be detected.
    – cacahuatl
    Commented Jul 20, 2016 at 19:55
  • @canonizingironize: hopefully slightly less misleading now. Nice writeup at github, btw.
    – serv-inc
    Commented Jul 21, 2016 at 18:05
1

Just keep in mind that whether you use plugins or addons, many of them perform background operations communicating with remote servers. Unless you know exactly where the traffic is going and coming from as well as the transport layer being used to transmit and receive the data associated with the plugin or addon, you can't be sure that what is passing to and from your system is being channeled through tor and the corresponding relays. Without knowing all of that, it's best to keep the plugin and addon usage down to a minimum if using at all. I would recommend to refrain from using any while navigating with/through tor, and revisit where you can later with the standard browser when not connected through the tor network if you want or need to used any plugins or addons. Of course that would exclude any tor specific network locations such as .onion sites, but I'm sure you'd hate to expose yourself when you're trying to be anonymous. It's definitely a sticky situation, but always better to exercise caution when unsure (aka better safe than sorry). Some of the comments above are really useful such as reviewing a short list of must-have add-ons to keep them down to a minimum and to know that they are safe. ~RM

Improve this answer
1
  • "Some of the comments above are really useful such as reviewing a short list of must-have add-ons to keep them down to a minimum and to know that they are safe." Was there a link to see what add on suggestions those may be? Thanks!
    – ginblossom
    Commented Oct 14, 2018 at 12:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .