4

Some time ago, I was browsing this website over tor. After selecting a location in the menu, it was able to tell me exactly how far away the nearest test centers to my location were, which means it was able to get my location.

I use NoScript with TorBrowser and I'm usually careful about allowing JavaScript to run. Of course, some websites are near unusable, if not completely, if some of the necessary scripts are not allowed to run.

  1. How does the website get this information when I'm browsing using tor?
  2. How can I tell when a website I'm visiting has this capability?
  3. Is there anything I can do to prevent them from obtaining this and any other information that shouldn't be visible when browsing over tor?
Improve this question
4
  • 7
    After selecting a location in the menu, it was able to tell me exactly how was away the nearest test centers to my location were, which means it was able to get my location. This sounds a lot like I told someone where I was, how did they know where I am?
    – Nomad
    Commented Feb 11, 2019 at 11:21
  • Hi. Just to clarify. The way the applet in the website works is that picking a location (a city, I think) shows a list of test centers in that location. What I meant was that the distances between each test center shown and my actual location was approximately correct. So, selecting the location as a different city would have shown a different list of test centers with the approximate distance from where I was.
    – user942937
    Commented Feb 11, 2019 at 13:07
  • @user942937 It seems like that is a coincidence. It is basing the distance off of the IP address which likely happened to be geolocated roughly to where you are. It did not deanonymize you.
    – forest
    Commented Feb 12, 2019 at 6:59
  • But if Tor is supposed to hide my location by showing the exit node's location instead and if it was able to tell which country I was in (exit nodes from here are not too common), or my approximate location based on my ISP, doesn't that break anonimity?
    – user942937
    Commented Mar 3, 2019 at 8:29

2 Answers 2

Reset to default
7

tl;dr: Yes, JavaScript can break anonymity provided by Tor if there's a browser vulnerability involved, if you enable features that weren't designed anonymity in mind (like WebRTC or Geolocation API), or through giving out more information for browser fingerprinting.

This particular site (https://pearsonpte.com/) uses the Geolocation API on line 31: navigator.geolocation.getCurrentPosition(). This doesn't use geolocation data for your IP address, but a location provider like GPS chip on your device. Usually the browser prompts you for a permission per site, but this can be allowed or denied globally. Allowing geolocation globally would be dangerous as it reveals your location in much more detail than your IP address.

Configuring your browser to prevent everything that could reveal your identity takes a lot of effort and is likely to fail. Even if you have all the knowledge to disable everything necessary, the more you customize your settings the more unique fingerprint your browser will have (Am I Unique?). Tor Browser is a standalone bundle with a pre-configured Mozilla Firefox with NoScript and HTTPS Everywhere, but the default settings enables JavaScript on the site itself and warns about external scripts. Being extra careful you might want to tighten the settings by removing some of these:

Tor Browser NoScript default settings

Tor Browser is not perfect against the browser fingerprinting, but it helps a lot with other mistakes you could make. Am I Unique? test results first with default settings compared to the results with JavaScript disabled also suggests that disabling JavaScript might be a good idea:

But only 12 browsers out of the 992892 observed browsers (0.00 %) have exactly the same fingerprint as yours.

But only 1796 browsers out of the 992968 observed browsers (0.18 %) have exactly the same fingerprint as yours.

Even using the Tor Browser you could screw up in several ways including:

  • You forget (or neglect) to update the browser. Outdated versions can be quite dangerous: there has been vulnerabilities in e.g. handling file:// URLs and bypassing NoScript.

  • The site ask your permission to use HTML5 features like canvas image data. Tor Browser lets you allow it on your own risk, but you have been warned.

    Tor Browser warning on HTML5 canvas image data

  • You could allow scripts globally or trust a site you shouldn't (assuming you disabled scripts).

  • NoScript detects potential Cross-Site Scripting attack, but you can allow requests to external sites.

  • Tor Browser is pre-configured with e.g. geo.enabled & geo.provider.ms-windows-location set to false, but it doesn't lock any of the settings in about:config.

Improve this answer
6
  • You should point out that JS can only break anonymity if it uses an exploit against the browser. Unless a security vulnerability is exploited, it cannot break anonymity.
    – forest
    Commented Feb 12, 2019 at 4:27
  • I think of WebRTC and Geolocation API etc. Those are features rather than exploits, yet they can leak information. Poorly configured browser can break anonymity without being technically vulnerable.
    – Esa Jokinen
    Commented Feb 12, 2019 at 5:56
  • Those are disabled in Tor Browser, so the point is moot. And Tor Project has always recommended against using alternative browsers with Tor specifically because of the leaks.
    – forest
    Commented Feb 12, 2019 at 6:03
  • 1
    That's why the answer suggests 1) using pre-configured Tor Browser instead of trying to configure one by yourself and 2) not messing up the configuration as Tor Browser doesn't lock the parameters. Disabling JavaScript in addition helps a lot against browser fingerprinting, as demonstrated.
    – Esa Jokinen
    Commented Feb 12, 2019 at 6:10
  • Looking at the page he linked, I think it's coincidence that the location was correct. It did not actually reveal his location and as such, there is no need to "prevent" it.
    – forest
    Commented Feb 12, 2019 at 6:57
-3

When you use Tor for browsing, your system creates a socket which is listening for any connections on a certain port. You can use that socket with any internet application configured trough Tor as a proxy.

When you configure a browser to use that socket, every page is forwarded to that socket, so the traffic is encrypted with Tor before the browser renders the page, but pay attention of the fact that only the browser has control over the socket, not the content of the rendered page.

If a page contains an object which needs to connect to the internet, it will use the system library to achieve the goal, not Tor.

That's why you should use Tor only for text services, not for the ones which contain images, canvas, advertisings or objects like media players or google maps.

If you stay inside the darknet, you should be torified, but the question is how secure are the nodes the darknet is composed of?

If you configure your system to use Tor as a proxy, all the connections to the internet will be redirected to the proxy and will be torified.

Take a look at Tails (you can find .iso to download), for example.

If you don't want to torify all your connections, you can use more than a plugin as the mentioned noscript.

Improve this answer
3
  • Hi. Thanks for answering. All the above mentioned activities were performed in TAILS so I think almost all, if not all of that, is already a given. You mentioned If a page contains an object which needs to connect to the internet, it will use the system library to achieve the goal, not Tor. That's why you should use Tor only for text services, not for the ones which contain images, canvas, advertisings or objects like media players or google maps.. Is that a certainty? Would visiting sites that load these break the anonimity Tor provides?
    – user942937
    Commented Feb 11, 2019 at 16:10
  • If that is the case, how do you browse websites like these anonymously? If not, how do you identify which websites have that capability and what can be done about it?
    – user942937
    Commented Feb 11, 2019 at 16:11
  • This answer isn't correct. Tor Browser will not allow anything to bypass it.
    – forest
    Commented Feb 12, 2019 at 4:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .