Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Didn't Tor create a local socks proxy? Why doesn't all the Web traffic go over this local socks proxy and why is JavaScript disabled in the Tor Browser bundle?

If you would connect with firefox for example to a normal socks proxy, could javascript still reveal my real ip?

share|improve this question
3  
It's additional surface area that needs to be defended and if exploited can potentially give an attacker much more than just your true IP address. For a recent example, see this advisory: lists.torproject.org/pipermail/tor-announce/2013-August/… –  Xander Aug 14 '13 at 17:24
add comment

3 Answers

up vote 3 down vote accepted

Short answer: JavaScript isn't a threat per se, but it can become one. So disable it in critical situations just in case.

JavaScript is globally enabled in Tor Browser Bundle by default. JavaScript, per se, won't reveal your IP address, it's just that many times there are security problems with the JavaScript components in your browser that would allow evil people to execute malicious code on your computer. That malicious code can reveal your IP address, MAC address, and a lot more information.

You use Tor to protect your privacy, so you'd want minimize the risk as much as possible. That's why you disable JavaScript, Flash, Java, and other components. You don't disable them because they'll compromise you all the time, you disable them just in case, which is a good practice in situations where you want to be careful about your privacy and identity.

As for your other question, Tor creates a local SOCKS proxy and other applications needs to connect to that proxy. So far, Tor doesn't have a user-friendly way to route all system traffic through it, but there are some ways to do it. I highly recommend using Tails, you can easily install it on your USB stick and it will load a full operating system configured for your privacy, with everything routed through Tor.

share|improve this answer
add comment

Javascript is a major source of tracking data - if javascript is enabled, all sorts of information can be retrieved from the respective machine the browser is running on (like screen size, appVersion, installed plugins and their versions, geolocation and so on).

This allows to identify you individually, which is what TOR is designed to avoid.

share|improve this answer
    
Thank you for your answer. So if i would connect through a socks proxy with Firefox for example. All Traffic would go through the socks connection even the javascript ajax requests from the page? –  user2414724 Aug 14 '13 at 18:00
    
It should go through the SOCKS connection. But the JavaScript can find out your local IP - and other data. (e.g. stackoverflow.com/questions/3653065/… or ip.codehelper.io ) –  foo Aug 14 '13 at 18:09
add comment

Javascript is no longer blocked in the TOR browser bundle. The reasoning is explained here

share|improve this answer
    
good link - it is a tradeoff, giving up a lot of security in exchange for ease of use, which is very important for new users. But if you make an informed decision... –  foo Aug 14 '13 at 18:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.