19

Can I use a Tor browser session and a regular Firefox session side by side without corrupting the security of the Tor session?

E.g. when I download a new Eclipse version or when I'm searching for code snippets I think the NSA won't find out more than if I'm a mediocre programmer or not. But for more sensitive searches like insurances, I don't want my surfing as unsecured. So it would be nice if I could keep both programs open and switch when needed.

0

5 Answers 5

13

Yes, you can use both a browser with a direct connection to the internet and a browser that uses the Tor proxy to access the internet (such as the Tor Browser Bundle), and still have the anonymity benefits of Tor when using the right browser.

There are two risks I am aware of. First and most significantly: modification of pages you are viewing to expose your identity if your sensitive browser holds identifying cookies. Secondly you need to be careful to avoid helping passive attackers carry out timing attacks.

Cookie Extraction

Schneier believes the NSA's QUANTUMCOOKIE program may modify a (sensitive) page you are viewing over Tor, to inject a part of another website that will trigger your browser to send identifying cookies:

My guess is that the NSA uses frame injection to surreptitiously force anonymous users to visit common sites like Google and Facebook and reveal their identifying cookies.

They could do this through compromising / owning the exit node, or one of their other internet-scale programs to modify traffic between the exit node and the intended server.

Of course, this highlights a generic attack that isn't limited to the NSA.

It's not completely clear from the question whether you would be exposed to this, but the best mitigation would be to never use your sensitive browser for purposes that could identify you, and ensure it doesn't store cookies over sessions. To be specific: use a unique browser profile (or TBB install) for each identity you wish to have, and don't mix them. In the simple case of sensitive vs unsensitive, use a single browser for sensitive use only, and another for unsensitive, potentially identifying use. Both browsers can be used at the same time, provided you don't mix what you use them for.

Timing Attacks

If your browsing on the directly connected browser is related to your browsing over Tor, that could assist an adversary in carrying out timing-based confirmation attacks.

For example, you're at an internet cafe with your Tails distro, and busy chatting anonymously over Tor to a reporter at the Guardian, whilst at the same time browsing outside of Tor the Guardian's coverage of your previous story and researching asylum in Ecuador... the government agency notices your interesting non-private browsing and the fact that you are using Tor, and can make some intelligent deductions about what end points you might be communicating with.

Having dramatically narrowed down the possible end points you might be communicating with from "the internet" to "places of interest to people with a reason to flee to Ecuador and interest in The Guardian", their confirmation job becomes quite a lot simpler.

Of course, if you're looking at something with wider appeal over a direct connection whilst doing your sensitive browsing over Tor, then whilst you arouse suspicion for using Tor, your well-resourced adversary doesn't have a lot more to go on, so carrying out confirmation attacks will be a lot more expensive for them.

Summary

Have a unique browser per identity you want to be kept separate, keep anything remotely related to an identity within the right browser. Oh, and don't accidentally copy and paste a URL / search term / email into the wrong browser.

Lucas' answer rightly points out that if the NSA or equivalently well funded adversary is specifically trying to track your activities as a high priority target, and not just blanket monitoring all Tor users, for example, then this question is fairly moot.

Update: added cookie extraction via frame injection

4
  • Good answer. I think I saw somewhere on the Tor website that using two browsers, one normal and one Tor-enabled is actually encouraged.
    – rath
    Aug 4, 2013 at 11:44
  • @Michael, What if third party cookies has been disabled on your browser? Even if NSA owns the exit node, it couldn't force your browser to send the 3rd party cookies.
    – Pacerier
    Feb 16, 2015 at 9:41
  • @Pacerier I don't think this setting will affect it - your browser will still include your existing saved cookies in the request to the injected site.
    – Michael
    Feb 17, 2015 at 19:48
  • I believe the cookie injection attack only applied to when Torbutton was still offered as a stand-alone plugin for Mozilla Firefox, not when using Tor though Tor Browser. Unless, of course, you're logged in to e.g. your Facebook profile in Tor Browser Aug 9, 2019 at 13:28
20

Yes you can run them side by side and not corrupt the security. This is because your Tor browser will send everything through a Tor proxy (including DNS requests) and your normal browser won't. Do mind that:

Actual actual reality: nobody cares about his secrets.  (Also, I would be hard-pressed to find that wrench for $5.)

If the NSA really would like to know what you are doing then they will find a way, bug your house, target your computer with malware, ... .

5
  • 2
    But you should encrypt anyway.
    – bahamat
    Jul 2, 2013 at 22:59
  • 5
    The only thing that anyone should learn from that XKCD comic is that you should improve your physical security as well in the face of a serious adversary. Jul 2, 2013 at 23:10
  • @Lucas-Kauffmann Perfect answer, but I have to admit that the cartoon was the thing that tipped off my +1. #SoTrue
    – e-sushi
    Jul 3, 2013 at 17:17
  • Re the XKCD comic, you could create "nuke.sh" containing "head -c 1052672 /dev/urandom > /dev/sdb1; sync". Always have a terminal open. Run "./nuke.sh" and hit Ctrl-Alt-Del, and there would be no password to tell. If you were very paranoid, and had a solid UPS, you could nuke the LUKS header right after bootup. But then you'd need to have a hidden backup, and remember to restore before shutting down.
    – mirimir
    Dec 16, 2013 at 4:37
  • In certain law enforcement scenarios, you're better off letting them have the data. While you might have done "this," you had absolutely no part of "that."
    – Russ
    Aug 8, 2019 at 13:28
3

Using a Tor-optimized browser and a regular browser simultaneously on the same machine is extremely unwise. Michael notes two risks: 1) "modification of pages you are viewing to expose your identity if your sensitive browser holds identifying cookies"; and 2) "passive attackers [who] carry out timing attacks".

There are at least two additional risks: 1) human error; and 2) browser exploits and malware. Let's say that you've installed the latest Tor Browser Bundle. Using the TBB browser, you're accessing the Internet via Tor's SOCKS5 proxy at 127.0.0.1:9050. You can open Firefox, and access the Internet directly, with no proxy. If you accidentally use Firefox for something that's associated with your "anonymous" activity using the TBB browser, you're potentially hosed.

In one of the NSA presentations leaked by Edward Snowden, Tor is characterized as the “king of high-secure, low-latency anonymity”. According to a Washington Post FAQ: "So while hacking the core Tor network has proven difficult, hacking a Tor user's browser is easier." In other leaked documents, the NSA claims to have many browser zero-days. I'm sure that other players, some far more hostile, have their own. Maybe they trade ;)

If you're compromised while using the TBB, an adversary may compromise the Tor client, and so determine your ISP-assigned IP address. A less-skilled adversary might just drop malware that "phones home" when it sees that Tor isn't running.

In light of such threats, it is unwise to run both the Tor software and user applications on the same machine. Best practice is running Tor on dedicated router/firewall hardware, and the TBB browser on an attached workstation. If that's unworkable, networking and apps should at least be isolated on separate virtual machines (VMs). Whonix is a very user-friendly implementation. Qubes is undoubtedly more secure, but requires dedicated hardware.

3
  • yet one more threat: if a user enables flash plugin, then he can be identified via flash cookies. I have not ever tried to enable flash in a tor browser, but it seems that there is such a possibility
    – d.k
    Nov 4, 2014 at 16:00
  • 1
    @user907860, Whoever enables flash while browsing securely?
    – Pacerier
    Feb 16, 2015 at 9:44
  • 1
    How would one browser find the "identifying cookies" stored by the other?
    – WGroleau
    Sep 20, 2015 at 21:05
2

There is one risk that hasn't been mentioned here yet: when you're having both Tor Browser and a different browser open, you may accidentally confuse them and either enter identifying information in Tor Browser or perform activities which you wanted not to have tracked back to you in the other browser.

There is no great technical risk, but you'll have to keep your actities over Tor and your regular browsing completely separated. If you do both at the time, you increase the chance you'll make a mistake one day. Remember, it takes just one error on your side to get caught.

(Of course, if you're not a dissident in a country with an oppresive regime or some kind of criminal, but simply a law-obeying citizen who thinks his browsing habits are none of the government's business, this is less of a concern.)

2

Mouse-track and keys pressed can potentially reveal you are the same user.

Simply by moving your mouse from one browser into the other or switching through hotkeys like ALT-TAB can link your (real) IP from your non-Tor browser to your Tor IP (and activity).

enter image description here

Here's the actual result: Mouse tracking graphs

Summarily, when your mouse stops moving in Tor it starts moving in your non-Tor browser. The location of the mouse plus your computer's time can be recorded through JavaScript. There is usually about 0-120ms delay between the registered time (due to time granulation imposed on Tor and mouse-location registering intricacies).

Note that registering keys pressed isn't even necessary, although they are useful. (Tor Browser hides ALT if I recall correctly)

Necessary prerequisites

  1. JavaScript must be enabled.

  2. Both websites must share mouse-movement data. To what extend this happens I don't know. GIFCT is already sharing data between big tech. Also, if 3rd parties that track mouse events, like Google Tag Manager, do gather x, y, time then any websites that have Google Tag manager can be used to match your two activities by whoever has access to that data. That is, about 18 million websites.

7
  • The question to answer to understand the scope of the problem is, how many sites share mouse-tracking data? If you are browsing the same site on both browsers at the same time, then you've impacted your ability to unlink both sessions in all kinds of ways. So, I think this requires some research to determine what level of risk this actually is.
    – schroeder
    Dec 22, 2021 at 12:38
  • @schroeder I agree. But it is a valid attack, correct? (I am no expert on the topic, i'm a physicist)
    – user
    Dec 22, 2021 at 12:40
  • It requires some very specific pre-conditions, so, it's a valid attack. The question is about the risk assessment.
    – schroeder
    Dec 22, 2021 at 12:41
  • Would it be easy to determine the risk? If so, how should I do it?
    – user
    Dec 22, 2021 at 12:42
  • My first comment describes the first questions.
    – schroeder
    Dec 22, 2021 at 12:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .