0

Having JavaScript enabled on the dark web is suicide, but what should one do if a site displays a big poster saying "JavaScript needs to be enabled to access this site"?

4

JavaScript on its own shouldn't be a problem in the context of a darkweb browser such as Tor. The browser is configured to use a proxy and JavaScript can't magically get around that in order to reveal your real IP.

The problem is that JavaScript can be used as part of exploits. If there's a vulnerability in your browser, a malicious page might be able to exploit it in order to get code execution on your box, or otherwise perform operations that deanonymise you.

If you trust the site and you're accessing it over HTTPS, feel free to run JavaScript on it. Shouldn't be a problem. If you're accessing over plain HTTP then I would be more concerned, because a malicious exit node could inject malicious JavaScript.

  • Thanks. What if I use Qubes with Whonix? Is it safe then? – hf4KlwoP2fm2 Mar 29 at 19:52
  • 1
    @hf4KlwoP2fm2 the OS doesn't matter if the threat is browser exploits – schroeder Mar 29 at 20:06
  • 2
    @hf4KlwoP2fm2 I generally do not recommend using both a VPN and Tor unless you have problems with connecting to Tor directly because of government interference. – Polynomial Mar 29 at 21:13
  • 2
    No. VPNs are not a privacy tool, despite the marketing. Stick to Tor on its own. – Polynomial Mar 29 at 22:57
  • 1
    @hf4KlwoP2fm2 I think you need to work on your threat model a bit. If the government wants to come after you specifically they'll get to you some way or another. Compromising entry nodes will reveal your IP but only the fact that you're using Tor; the entry node can't see the destination or the content you send. Compromising exit nodes only reveals the target and content (which may be encrypted if you use HTTPS) but doesn't reveal your IP. They generally need to compromise many nodes to deanonymise your activities. – Polynomial Mar 29 at 23:40
1

What's a great way to get someone to run your malicious JavaScript? Tell them they need to enable JavaScript to continue.

If you absolutely must continue and you believe the site to be potentially hostile, treat it as such. That means taking steps such as using a VM, perhaps on a machine that you will wipe afterwards to counter risks of something escaping.

0

If it is a suspicious site that you absolutely have to go to, you should use a computer that you would not care about if it was infected.

You could also try a VM, but technically that is hackable. https://en.wikipedia.org/wiki/Virtual_machine_escape

  • Thanks. What if I use Qubes with Whonix? Is it safe then? – hf4KlwoP2fm2 Mar 29 at 19:52
  • Not 100%. No VM is going to be. – Vit Mar 29 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.