33
As so often in anonymity, it boils down to a tradeoff between security and usability. JavaScript certainly doesn't have an excellent track record from a security point of view and disabling it will save you from a bunch of nasty attacks. But whether we like it or not, it's a crucial usability part of today's Internet. Disabling it in the Tor Browser Bundle ...
10
The Tor Browser Bundle ships with Javascript enabled because disabling Javascript disrupts the user experience and even usability of such a significant portion of the internet.
That being said, you should disable Javascript unless you absolutely need it to access a specific site!
See also the FAQ entry: Why is NoScript configured to allow JavaScript by ...
8
There is node-Tor, but I am not sure what their status is.
8
Do you have NoScript set to globally forbid all Javascript? NoScript in Tor Browser 3.5 seems to allow scripts by default, so you might want to check if it is overriding your Firefox settings. Click on the NoScript icon on the toolbar and select "Forbid scripts globally". You might also want to go to the "Options" (in the same menu) and edit the Whitelist ...
6
Mozilla removed option to disable JavaScript in Firefox version 23. Since
Tor Browser 3.5+ series based on Firefox ESR 24, it shipped without this switch.
In addition to Mike's answer, you can also consult to How do I disable JavaScript? section on Tor Browser Bundle 3 FAQ.
Also, setting on javascript.enabled to false on about:config should actually ...
5
Instead of blocking the access from the firewall (iptables), it is easier to block it from the browser itself. If you are using Firefox or Iceweasel, you can disable Javascript completely (using NoScript addon, or any similar addon).
If you don't want to disable Javascript, you can disable only WebRTC connections. To do that, enter about:config in your ...
3
The Tor Browser Bundle includes noscript, but by default it is configured to allow scripts.
You can configure it yourself to disallow scripts, but you should be aware that if you start whitelisting sites, your whitelist can be used as a sort of user fingerprint.
Scripts should not be able to get your real IP address in the TBB. If they can, that would be ...
2
This has nothing to do with JavaScript, this font loading is done by CSS (the stylesheets). Technically it is no different than loading of images, except that fonts you already have on your system may not be loaded, allowing for some guessing what OS you run.
There is already a patch in Tor Browser that mitigates some of the worst risks with this way to ...
2
As users with different JavaScript settings are easier to fingerprint it would seem to make sense to limit the number of sets someone can fall into.
Ideally JavaScript would be either on or off, whereas off would be the best possible solution if not so many websites would require JavaScript to work. The reason for it being on by default is just that.
If ...
2
The actual Tor browser bundle has an option in the plugins window to activate the NoScript plugin so you only need to restart the browser with that program.
2
I found a way to do that on linux:
apt-get install tor
download Multi-TOR from here: https://github.com/jseidl/Multi-TOR
run ./multi-tor.sh 10 for 10 socks ports (for example)
You can use selenium or splinter python (for example) and import socks port
put the script on a while or for statement as u wish
good luck
from pyvirtualdisplay import Display
import ...
2
Any application can connect over Tor if it supports SOCKS, or if it can be properly wrapped using torsocks or usewithtor. Aside from that, it seems like you just need a headless browser or some other Javascript execution environment, of which there are many.
2
Click on 'Options' (in NoScript), then click on the 'Appearance' tab: check off the options you want see. The upper right part contains the most important ones.
2
It looks like it attempts to learn your IP address via a WebRTC connection. That this is possible was reported a while ago, but it never affected TorBrowser users as WebRTC is disabled in TorBrowser. So, the js is not dangerous if you use Tor in the recommended way. If you don't, it is rather likely it'll leak your real IP address.
2
When you are using Flash (swf files), you are letting the door to your anonymity wide open. Flash can see your IP address and reveal it to the hosting site, thus de-anonymizing you.
Furthermore, consider using an open-source browser such as Firefox or TorBrowser. They are safer than closed-source browsers such as Google Chrome, and they don't have a ...
2
Try to enable noscript 'allow' for your dashboard. It may be the javascript disabled.
Or as it seems from the question and it is not browser based issue, try different relay / bridges if it is really related to the fact you are using Tor.
2
You can use the facebook adress onion :
https://www.facebookcorewwwi.onion/
But you still need Javascript.
2
I've tested this on both a hosted installation, and a wordpress.com site.
The hosted installation works as it should. There's no need to turn off Noscript. Everything under http://foobar.com/wp-admin/ is accessible.
The wordpress.com blog - http://foobar.wordpress.com/wp-admin/ - is full of Javascript, so Noscript has to be deactivated.
However, even ...
2
I want to monitor a website without making it a priori evident that it is being monitored
Problems:
The set of exits isn't (very) large, you'll repeat after a given time scale.
The exits are weighted, you're more likely to use high capacity ones.
The timing and uniformity of the HTTP requests.
The (likely) quite unique user-agent and chosen set of headers ...
2
Strange to see this problem, because the "safest" security level is supposed to block Javascript with the help of NoScript.
Anyway, you can do an additional JS block by visiting about:config (enter this in the URL bar or copy&paste about:config?filter=javascript.enabled). Accept the warning and proceed with caution. Then, start searching for 'javascript'...
2
Tor doesn't block APIs (this is virtually impossible and probably not what you want to do), Tor blocks web pages which addresses match a given check on a blacklist or entire types of content like JavaScript, iframes and fonts. There is no list as such.
1
Thanks for the suggestion, hawkeye. I tried all the options on the Appearance tab and none of them produced the desired result.
However, if I check the "Temporarily allow [...]" box on the Appearance tab AND ALSO uncheck "Cascade top document's permissions to 3rd party scripts" on the Advanced, Trusted tab, then NoScript starts listing all domains that ...
1
It makes it far more likely that a site owner will be able to track you.
There are also risks from bugs in the Tor browser..
There are many, many techniques in Javascript for trackking the user; not all of them are fixed even in current browsers. It's possible to make a semi-unique signature based on many factors in the configuration of your browser / OS. ...
1
If you want to stay safe using Tor, avoid 2 things:
exchanging any activities, files, disk devices etc. between Tor and non-Tor
having anything persistent across Tor sessions - eg. bookmarklets
Why?
Both of these increase the chance of rogue forces (NSA etc.) to deanonymize you using any correlation and/or watermarking attack.
How to avoid that?
use ...
1
If you can avoid javascript bookmarklets, please do by all means. The less information you reveal, the better off you are. If you ask a security expert, she will tell you if you are concerned about your anonymity, do not trust any website what so ever, except, if you can personally verify that at the minimum, the site is not compromised. Many sites are ...
1
If you know and understand what the bookmarklet you use does and know the privacy implications by using this you are probably not adding specific risk.
Since you send information to pinboard.in you are however replacing anonymity with pseudonymity. This means that it might be easier for this service to reveal your identity either by doing something like ...
1
The risk for using a link like that for that service is not something i would worry about.
JavaScript becomes a risk (has been) when a third party uses it to exploit the tor browser, so that means that pinterest has to push a exploit to you, and thats extremely unlikely.
There is bigger risk for other types of exploits then what this link could do.
1
If you need the javascript turned on to sign in to a website, your biggest problem is not javascript, your biggest problem is signing in. By signing in you are revealing who you are!!! Of course, you may use a pseudonym to sign in, but even using pseudonym, you are not anonymous any more. You are pseudo-anonymous. Now you should be real careful not to ...
1
The current version of Tor Browser Bundle has the NoScript icon on the top left of the page:
Just click on the S and the menu of NoScript will open. Here you can disable JavaScript or make other changes.
Only top voted, non community-wiki answers of a minimum length are eligible
