1

The context from which my question has arisen is this user script which locally removes ads from Ixquick.com, which is an anonymizing 'proxy' search engine that gives the results from Google's index while not giving any info of yours to Google at the same time.

But the script makes use of Google Hosted Libraries, with this line in the userscript code:

// @require http://ajax.googleapis.com/ajax/libs/jquery/1.6.3/jquery.min.js

Is this Google JS file, able to store or process, on Google servers, the URL of the page I'm on, ALL the content on the page (which reveals the search information I entered into Ixquick), my IP address (which reveals ME - and could it also cut through TOR's IP address obfuscation and somehow reveal my exposed IP, as well?), or even other things such as passing on my browser user agent, all to Google, thus defeating the point of using Ixquick in the first place?

Are those JS files of Google's (either now or theoretically in the future) surreptitiously able to pass your info to Google, (in other words should I modify the extension to point to my own hosted JS files or one from a trusted entity such as IXquick's servers directly if they have such accessible JS files), or is the architecture of it such that it's only possible to be locally processed and Javascript (in this context) simply cannot be coded to pass the page's info back home to Google?

Again, this is not about what Google's JS files necessarily do right now, but what the architecture is capable of, and thus what it could dynamically be updated to be able to do without our control.

Thanks.

Improve this question
0

1 Answer 1

Reset to default
0

jquery is just a library that makes using JavaScript a thousand times more easy. If google were to manipulate jquery to do some shady stuff people would notice but it is definitely possible. There's also the risk of DNS poisoning where an attacker will make your machine believe googleapis.com is at the attackers ip address and serve you their own version.

With that said, why do you need to use googles CDN at all? You could just get jQuery put it on the local machine and reference that. In the end however if you want to be anonymous with TOR turn off javascript, flash, java, shockwave and any of that other crap. They are all vectors that can be used to identify you. You can add an extra layer by using a VPN service so if they did get an IP address it wouldn't be your home IP address.

Improve this answer