a great post that was published a few years ago on Matt Traudt’s blog with some tips for people using Tor and the Tor Browser.

it also addresses common misconceptions like disabling JS and using fingerprinting tests, which unfortunately I see floating around every other day on the internet.

@k_o_t@lemmy.ml @TheAnonymouseJoker@lemmy.ml can we get this thread pinned? i didn’t read it all but it looks like decent advice and the question about what’s tor and how to use it best comes up frequently

There’s generally nothing wrong with logging in to “real” accounts over Tor.

Tor Browser intelligently isolates your traffic so logging in to your “real” Facebook while doing secret stuff on a different website is not correlate-able via traffic patterns.

It also isolates local state (like cookies) so it won’t leak that way.

I found this problematic. He is encouraging the use of PII accounts over Tor, which is a very risky thing to do for someone not familiar with how to make and stick to an OPSEC.

A lot of his advice is actually what I practice and preach, but this and the JavaScript one makes me feel less confident here. Preferring JavaScript stay disabled is a better choice, the next best is only allowing JavaScript when needed momentarily. This is why TailsOS which ships with a uBlock Origin Tor Browser is more helpful.

@fishonthenet@lemmy.ml
creator
link
fedilink
0
edit-2
4M

I will start by saying that the author of the article was a tor researcher and dev so this gives some context on the content and me posting this.

which is a very risky thing to do for someone not familiar

may I ask why? I generally agree with the sentiment of the article but I don’t have a very strong opinion on this and maybe I’m missing something.

PS I don’t think the usual “I will end up in a list of people who use Tor” argument is a valid one.

Preferring JavaScript stay disabled is a better choice, the next best is only allowing JavaScript when needed momentarily.

I disagree with this, it’s simply overkill for 99% of the people with arguably no benefit at all. what’s there to gain?

I just ran TBB and used deviceinfo.me to verify, what JS vs noJS can reveal. Here, JS reveals all this information, noJS does not.

  • 32/64 bit OS
  • OS Core (Linux or NT kernel, revealing your actual OS)
  • browser build number
  • country and GPS location which are spoofed
  • multiple nameserver connections, resolved and unresolved IPs
  • 2 user agents, one with spoofed details and other with OS Core and display manager
  • spoofed CPU cores
  • private/incognito mode
  • tracking protection on or off
  • browser window size spoofed or not
  • monitor colour depth support
  • current page scroll position
  • last key pressed, therefore keylogging
  • current mouse cursor position
  • last clicked position on page
  • estimation of your connection speed using page load time, network time, DNS lookup time, TCP connection time, server load time, page download time, browser load time

Can the author explain me why keeping JS on is so helpful, if your goals go beyond basic privacy expectations?

You want to know what a JS enabled Tor Browser looks like? A standard Firefox private mode tab with uBlock Origin medium mode and arkenfox user.js applied.

Edit: I forgot to address this one

may I ask why? I generally agree with the sentiment of the article but I don’t have a very strong opinion on this and maybe I’m missing something. PS I don’t think the usual “I will end up in a list of people who use Tor” argument is a valid one.

People have a habit of typing stuff where they should not, and using literally something like a personal Facebook account over Tor and typing PII should have no opinion other than that it can be risky. All the above information I mentioned is trackable for even a single JS script allowed, and any website where you have such a personal account likely is not a very privacy respecting entity that will allow you to live JS free.

@fishonthenet@lemmy.ml
creator
link
fedilink
0
edit-2
4M

I just ran TBB and used deviceinfo.me to verify

ironic how this is posted below an article that says that testing websites are not reliable and that you should not read into the results unless you understand them. I don’t think this is the case, sorry about being painfully honest but I don’t want people to freak out over tests instead of reading a well written article:

  • all of the metrics you mention as spoofed (plus a lot more, even ones that you mention in your list like navigator UA, window size, TP on/off, color depth, private mode…) carry close to no entropy. that’s because Tor Browser has a crowd and users fit in that crowd, so even if the script was advanced to go over all the metrics covered by TB (which most of the time isn’t the case), the crowd would allow you to fit in.
  • the spoofed UA in the http-header is actually for passive fingerprinting. generally speaking, your actual OS cannot be spoofed and even with JS disabled it can be bypassed by using CSS/fonts. while it’s true that TB safest mode restricts the font list and it will probably defeat most PoC out there (I think? I don’t remember but it should) it’s a big sacrifice in terms of usability when you could simply fit in with the crowd of people using TB on your same OS: arguably that’s good enough for almost everyone.
  • timing attacks are mitigated.
  • stuff like position in page, last item clicked, cursor position etc is fuzzy, how do you fingerprint based on that? plus https://github.com/arkenfox/TZP#-fingerprints-are-always-loose

You want to know what a JS enabled Tor Browser looks like? A standard Firefox private mode tab with uBlock Origin medium mode and arkenfox user.js applied.

that’s simply not true. TB has further enhancement and code changes, it is based on ESR plus it’s not the same as a private window at all since private mode does not write to disk for example. most importantly tho: TB has crowd and the Tor network, that’s vital and a huge difference. a traffic analysis would also probably identify Firefox + uBO in medium mode vs TB. also, arkenfox does not try to make Firefox turn into TB, that’s clearly stated in the wiki and I would know as I am a repo admin :-)

Can the author explain me why keeping JS on is so helpful

usability, a browser with JS disabled by default is not a good everyday browser for most. the more people use Tor Browser daily and have a good experience with it, the larger the crowd gets.

All the above information I mentioned is trackable for…

I mean once you are subscribed, why would they want to fingerprint you? they already know who you are. when facebook operates as third party it will be isolated plus on a different circuit and with fingerprinting protection, plus (from arkenfox’s wiki):

if a fingerprinting script should run, it would need to be universal or widespread (i.e it uses the exact same canvas, audio and webgl tests among others - most aren’t), shared by a data broker (most aren’t), not be naive (most are) and not be just first party or used solely for bot detection and fraud prevention (most probably are)

I also don’t get what the difference between typing private stuff on facebook on tor or behind a vpn or on your ISP’s network is. however I must say that I still understand why from a “peace of mind” perspective it makes sense to keep stuff isolated, so as I said above mine is not really a strong opinion here.

sorry about typing a lot, but I figured this was valuable information to share, despite being nothing new.

ironic how this is posted below an article that says that testing websites are not reliable and that you should not read into the results unless you understand them

Turns out, he is not talking about the kind of people I fit in. I am using Tor for more than a decade at this point, and have been a very avid I2P torrent user as well since many years. If not the same, I compare pretty well in experience in this aspect.

He is talking about the kind of people who open Panopticon for fingerprint tests and misread the fractions and decimal numbers and information there when comparing, and then scream on reddit with misinterpreted posts aimed to get awards and upvotes at the cost of sanity of many people.

deviceinfo.me is not the kind of site and data used for demonstrations he is talking about. I have a fair amount of experience to make this claim.

To expand on the attacks that are mitigated, avoidance is a better measure than mitigation. Hence the reason why I say noJS is a better policy, the next best is turning on JS manually when needed. Keeping JS on all the time is a fool’s errand if they want to go beyond standard levels of privacy and anonymity. The author himself mentions in the last line as a subtle disclaimer why it can be a choice.

You know how gait movements IRL work? Turns out, Google Recaptcha makes very good use of how you move and click with cursor on the captcha boxes. If you thought AI/ML image training was the only thing Google was making users do, now you know something new.

You want to know what a JS enabled Tor Browser looks like? A standard Firefox private mode tab with uBlock Origin medium mode and arkenfox user.js applied.

that’s simply not true. TB has further enhancement and code changes, it is based on ESR plus it’s not the same as a private window at all since private mode does not write to disk for example. most importantly tho: TB has crowd and the Tor network

Firefox has a bigger userbase than Tor Browser users, and it is a pretty uncontested claim logically. Firefox has Tor Project’s code for anti fingerprinting and per site data isolation upstreamed to Firefox’s private browsing mode since the past 15-20 or so versions now.

usability, a browser with JS disabled by default is not a good everyday browser for most. the more people use Tor Browser daily and have a good experience with it, the larger the crowd gets.

Does that not make the argument for Firefox stronger for regular daily browsing usage, since it has an even bigger userbase? You can use uBlock Origin and you can enjoy Tor Browser’s dFPI and per site data isolation benefits in Firefox’s private browsing mode.

I also don’t get what the difference between typing private stuff on facebook on tor or behind a vpn or on your ISP’s network is.

You missed where I said how having JS on means you are keylogged easily. Your caps lock is also detectable, just to be clear. You are also forgetting that making strings out of this keylogged stuff, and then applying stylometry analysis is a very easy and cost effective way into unmasking identities behind pseudonyms. I do this myself regularly as part of OSINT investigations. It is how I have also unmasked many sockpuppets on Lemmy, Matrix, Reddit in the past few years.

The author has a very agreeable position with me on what he speaks, but it is like how anti-imperialist viewpoints sound very correct in today’s political scenario, but every single nuance does not have to be perfect to get the idea across. He is getting the idea across here, and that is why you are arguing at length with me.

Edit: I think this explanation is lacking. I must expand on it.

First I will get out of the way elements that can be spoofed with JS on:

  • browser build number, country and GPS coordinates, CPU cores, user agents

Now it is time to address elements which having JS on reveals. Feel free to correct me whatever is spoofed by Tor Browser.

  • OS Core
  • multiple nameserver connections, resolved and unresolved
  • private/incognito mode
  • tracking protection on or off
  • browser window size
  • monitor colour depth support
  • current page scroll position
  • current mouse cursor position
  • last key pressed (keylogging)
  • caps lock on or off
  • last cursor clicked position on page
  • estimation of your connection speed using page load time, network time, DNS lookup time, TCP connection time, server load time, page download time, browser load time

Monitor colour depth support may not be a significant issue, as many have standard monitors.

Can you explain me how these are spoofed in Tor Browser while having JS on? I have ignored the fonts as those are spoofed, and there are no timing attack vectors in this list. The last bullet point, if you want to talk about, can be used to identify if someone used a really fast connection ISP at an unusual place and time.

Nameserver connections can be a possible issue with exit node identification, if we are to assume the OPSEC of an average journalist just downloading and using Tor Browser on any machine. If we assume relays can protect them, we have other vectors here, like…

… page scroll and mouse cursor positions, caps lock on or off, last key pressed.

Keylogging, as explained earlier, is a very cost effective way to unmask people. Telling people on top of it to feel free to use a personal Facebook account over Tor network, puts them in the mindset of typing personally identifiable messages, even becoming trackable down to how many errors a person makes and hits Backspace key. Imagine people typing messages under a pseudonym on a forum anonymously in a couple tabs besides the Facebook/Twitter tab, and writing with the same mental personality in mind.

I think this reply now feels a little more apt.

Sorry if way too OT, :( What torrent i2p client are you using? I don’t like the idea of vuze with a plugin, neither biglybt. I’m more inclined to something like rtorrent (ncurses, and if used with detached screen, then on any ssh session you can remotely monitor, without needing additional remote accesses or web publishing)…

I use I2P Java client, but you can use I2PD C++ client as well.

ohh, so I can use any torrent client (rtorrent for example), as long as I only use i2p sort of trackers, or so I understand from your post, and also from the wiki, perhaps specifying the binding address and port, or something like that…

I only know of BiglyBT that works with I2P, never tried rTorrent with I2P trackers. I just use the in-browser torrent client whenI need to once in a few months. Sorry if I cannot help here, you might need to hunt some documentation or wiki for I2P port binding.

Don’t worry, I checked on BiglyBT before. It does the dual function, it does hook to i2p trackers, which are special, and can as well hook to clear internet trackers, and whatever is being downloaded can be shared and exposed on both. It’s a specialized i2p torrent client, like vuze.

That’s what I was trying to avoid using, :( I’m looking to see if I could use any torrent client, and just tunnel its traffic into the i2p router, like if it were a VPN or ssh tunnel. But so far, it seems you need a specialized torrent client, which can connect as a minimum, to i2p trackers, and use the different i2p file sharing protocols…

If I’m mistaken, let me know, but it seems that’s the only way. At least what I’ve read. Oh well, dI don’t trust VPNs, and I don’t like the idea of using something I don’t trust, unless forced to do it…

Thanks a lot !

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

  • Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
  • Don’t promote proprietary software
  • Try to keep things on topic
  • If you have a question, please try searching for previous discussions, maybe it has already been answered
  • Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
  • Be nice :)

Related communities

Chat rooms

  • [Matrix/Element] (link is dead)

  • Discord

much thanks to @gary_host_laptop for the logo design :)

  • 0 users online
  • 14 users / day
  • 56 users / week
  • 126 users / month
  • 286 users / 6 months
  • 1 subscriber
  • 275 Posts
  • 920 Comments
  • Modlog