Having JavaScript enabled on the dark web is suicide, but what should one do if a site displays a big poster saying "JavaScript needs to be enabled to access this site"?
-
3Don't do it, unless you know its safe or dedicate a computer to shady sites if you have to go to them.– VitMar 29, 2019 at 18:59
-
1See also: security.stackexchange.com/questions/40620/…– PolynomialMar 29, 2019 at 19:49
Add a comment
|
3 Answers
JavaScript on its own shouldn't be a problem in the context of a darkweb browser such as Tor. The browser is configured to use a proxy and JavaScript can't magically get around that in order to reveal your real IP.
The problem is that JavaScript can be used as part of exploits. If there's a vulnerability in your browser, a malicious page might be able to exploit it in order to get code execution on your box, or otherwise perform operations that deanonymise you.
If you trust the site and you're accessing it over HTTPS, feel free to run JavaScript on it. Shouldn't be a problem. If you're accessing over plain HTTP then I would be more concerned, because a malicious exit node could inject malicious JavaScript.
answered Mar 29, 2019 at 19:49
-
-
1@hf4KlwoP2fm2 the OS doesn't matter if the threat is browser exploits– schroeder ♦Mar 29, 2019 at 20:06
-
2@hf4KlwoP2fm2 I generally do not recommend using both a VPN and Tor unless you have problems with connecting to Tor directly because of government interference. Mar 29, 2019 at 21:13
-
2No. VPNs are not a privacy tool, despite the marketing. Stick to Tor on its own. Mar 29, 2019 at 22:57
-
1@hf4KlwoP2fm2 I think you need to work on your threat model a bit. If the government wants to come after you specifically they'll get to you some way or another. Compromising entry nodes will reveal your IP but only the fact that you're using Tor; the entry node can't see the destination or the content you send. Compromising exit nodes only reveals the target and content (which may be encrypted if you use HTTPS) but doesn't reveal your IP. They generally need to compromise many nodes to deanonymise your activities. Mar 29, 2019 at 23:40
What's a great way to get someone to run your malicious JavaScript? Tell them they need to enable JavaScript to continue.
If you absolutely must continue and you believe the site to be potentially hostile, treat it as such. That means taking steps such as using a VM, perhaps on a machine that you will wipe afterwards to counter risks of something escaping.
If it is a suspicious site that you absolutely have to go to, you should use a computer that you would not care about if it was infected.
You could also try a VM, but technically that is hackable. https://en.wikipedia.org/wiki/Virtual_machine_escape
