I was browsing using Tor, with Javascript enabled/ 'allow scripts globally'. I made an automated take-down request for something posted on a website, and the next day went back to check if the item was still there. It was, and irritated, i made the request again, and got an automated 'you have already made this request' type response on the website. Which is wierd because I was using a different Tor circuit than the previous day. So what is happening? Is it:

  1. The website just acknowledging that 'somebody' already made the request?
  2. The website recognising both requests were TOR users?
  3. The website somehow identifying me as me despite TOR (presumably by some JS exploit)

If it's #3 then it must be pretty easy to identify TOR users who have JS enabled, no? Because it was just a random website not one inhabited by black-hat hackers or spooks. well, i assume not lol.

  • It shouldn't be trivial or possible, and would require an exploit. More-likely you had the same exit node, that exit node was already used, or the request was otherwise determined to be a duplicate. – Alexander O'Mara May 30 '16 at 23:35
  • 3
    @AlexanderO'Mara I disagree. Session cookies are not disabled by Tor by default. I could set a session for the user. The session cookie is stored on the client side. So once they come back to the website I can associate their data with the session cookie. – Bacon Brad May 30 '16 at 23:44
  • @baconface I'm pretty sure Tor Browser dumps all that when it resets. – Alexander O'Mara May 30 '16 at 23:45
  • most likely either you left something behind that allows identification of you or the site left something behind to identify you. Options would be: same exit-node, a cookie, the fingerprint of your browser... AFAIK the tor-browser drops cookies after being closed, unless configured otherwise though – Paul May 30 '16 at 23:45
  • 1
    See panopticlick.eff.org for info about browser fingerprint. Visit it with the Tor browser – Neil Smithline May 31 '16 at 2:13

There are several ways to track visitors between sessions which are in no way hindered by TOR:

  • HTTP cookies (yes, even .onion domains can use cookies like any other domain)
  • Persistent storage with JavaScript in Localstorage or IndexDB
  • Persistent storage in plugins like Flash
  • Browser Fingerprinting, i.e. looking at a combination of browser version, installed plugins, screen resolution, installed fonts and what other information you can get. Each of that by itself might not be enough to identify someone uniquely but can be when you look at the combination of all of it simultaneously.

If you want to avoid getting tracked, you might want to use the TOR Browser provided by the torproject.org. It is a Firefox build with all of the above switched off as far as reasonably possible.


Sometimes for non persistent tracking purposes, websites encode a string that is propagated across each page of the site you surf through. If you have a browser history entry of such a page, clicking through it refreshes the history on the server side. This assumes you do not use no history settings on your client.


Another method in addition to other answers: ETag can also be used in compliant browsers and doesn't need any plugin installed, nor will it pop up any questions to the user. TOR Browser is the way to go.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.