4

This question already has an answer here:

I read that javascript should be disabled in the Tor browser, as it could harm my anonymity. However, Javascript is enabled in Tor default configuration.

  • Why did the developers made the choice to enable Javascript by default?

marked as duplicate by Richard Horrocks, Jens Kubieziel Mar 22 '16 at 7:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

They weighted the pros and cons, between security and user experience.

You are right, Javascript makes your browsing unsafe. It allows a website to deanonymize Tor users. It has been used previously by the FBI, when they seized Freedom Hosting. The FBI put a malicious script on their server. When the visitors came and loaded the content, the script was executed client-side. It exploited a 0-day vulnerability in Firefox, making the clients contact, with their public IP, a server controlled by the FBI.

Another reason to disable Javascript is browser fingerprinting. Basically, Javascript has access to a lot of parameters which can differ from a computer to another one (browser plugins, language, fonts installed, etc.). Panopticlick provides an interesting test to check whether you can be fully identified using these information.

However, Javascript is also a necessary component of the Web. Simply disabling it would break the user experience on most of the websites. As Tor documentation says, it would be an impediment to new users. The developers choose to favor them by activating Javascript in the default configuration. User experience comes first; the users wanting more privacy can still disable Javascript using the NoScript plugin.

Not the answer you're looking for? Browse other questions tagged or ask your own question.