Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
If not then is there any way to visit a malicious website safely?
-
1Tor secures traffic and protects identity, it is not magical general safety. What does visit mean? Are you logging in, downloading, executing code? It's especially difficult to be safe when you don't know what you don't know. You can indeed swim with sharks safely ... until you can't.– user10216038Jul 30, 2022 at 14:55
-
If there is a vulnerability in your borwser, then "no"– schroeder ♦Jul 30, 2022 at 17:25
Add a comment
|
3 Answers
The Tor "safest" setting reduces the attack surface area of your browser by disabling certain features like JavaScript, SVG, remote fonts, etc. This greatly improves security because these features are often either the source of security bugs themselves, or provide capabilities that improve the reliability of another exploit (think JIT spraying, which doesn't work without JavaScript being enabled). It does not make the browser immune to compromise. It merely raises the bar for attackers.
Note that Tor on its own only provides anonymity, privacy at the ISP-level, and censorship resistance. It does not inherently resist malware or protect you from malicious sites. That is up to the browser.
You could use Tails which includes Tor Browser and is amnesic (any data on it will be lost on reboot). This would make it more difficult for malware on a malicious website to establish persistence.
My recommended keys to visiting untrusted or known malicious websites
- know that nothing you do will perfectly protect you
- Use Tor on full safety settings
- this is for anonymity, not security
- to a lesser extent a VPN and incognito tab might do
- Use some kind of throwaway OS or hardware
- Raspberry Pie (get a virus and just toss the SD card)
- TAILS
- Virtual machine (not ideal, but can protect from a virus)
- log into nothing, remain anonymous
- download nothing (scan anything you do)
- know your local network security
- and how to wipe and refresh your router
- prepare to lose whatever device you do this with
- also the data might get copied and sent to the attacker
Yes, there are safer ways than just using tor. A possible malicious website could have RCE on your Browser, and could have access to your host by running shellcode, considering you don't share any password or cookies with the website, that is the best it can do. Make sure to not give away your ip with either tor or a vpn service, I recommend using both. It will keep your other open ports hidden for such attacks.
You can run a virtual machine with where you are running your browser on, if you can not run a seperate host completely, hence that is what I recommend. It will put a layer of VM between you and your host, giving the hackers very very low chance to reach your host, considering they need RCE on browser + RCE on your VM application.
