1

When opening up Tor Browser for the first time I am notified of the existence of the Security Slider. The docs explain what each security level does in terms of functionality. I haven't found a solid answer on what threats I would be protecting myself from at each level.

Why should I set the slider to High rather than Medium or Low from a security standpoint (known exploits/attacks, attack vectors), rather than anonymity standpoint (though not to be disregarded)?

1

The Security Slider allows you to choose compromise between security and convenience.

At normal, convenience is first. All features are enabled.

At safer, javascript over HTTP is disabled. This is important as without using HTTPS, an attacker (for example an exit node) could inject malicious javascript. Also, video and audio playback often has security problems, plus ads use it to be annoying, so it is disabled. I am not sure why symbols are disabled, but I suspect there may be either rendering problems (symbol going beyond the space it is supposed to be in) or crashes similar to all those UTF character freezes and crashes on mobile phones.

At safest, all javascript is disabled by default. This will in addition to preventing MITM injection also prevents XSS attacks and intentional attacks by the sites you visit.

| improve this answer | |
  • 2
    There are some other things the slider does. For example, at higher levels, it disables various performance optimizations like JIT that can be abused in attacks, as well as complicated and often-exploited formats like SVG. – forest May 12 '18 at 23:06
  • Another thing to note is that the security level you choose contributes to your browser fingerprint, but this isn’t a problem assuming there are many Tor users using each setting. – Steve Jun 12 '18 at 4:01
  • @Steve Because there are only three settings, the fingerprinting risk is reduced. – forest Jul 12 '18 at 3:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.