4

I read that javascript should be disabled in the Tor browser, as it could harm my anonymity. However, Javascript is enabled in Tor default configuration.

  • Why did the developers made the choice to enable Javascript by default?
1

They weighted the pros and cons, between security and user experience.

You are right, Javascript makes your browsing unsafe. It allows a website to deanonymize Tor users. It has been used previously by the FBI, when they seized Freedom Hosting. The FBI put a malicious script on their server. When the visitors came and loaded the content, the script was executed client-side. It exploited a 0-day vulnerability in Firefox, making the clients contact, with their public IP, a server controlled by the FBI.

Another reason to disable Javascript is browser fingerprinting. Basically, Javascript has access to a lot of parameters which can differ from a computer to another one (browser plugins, language, fonts installed, etc.). Panopticlick provides an interesting test to check whether you can be fully identified using these information.

However, Javascript is also a necessary component of the Web. Simply disabling it would break the user experience on most of the websites. As Tor documentation says, it would be an impediment to new users. The developers choose to favor them by activating Javascript in the default configuration. User experience comes first; the users wanting more privacy can still disable Javascript using the NoScript plugin.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.