Re: [tor-talk] Risk of selectively enabling JavaScript

[Luther Blissett <lblissett@xxxxxxxxxxxxx>]

On Tue, 2014-01-07 at 12:48 +0100, Gerardus Hendricks wrote:
> > TBB enables JavaScript by default, presumably because many websites need
> > JavaScript.  NoScript can be used to selectively allow JavaScript from
> > certain domains, but doing so could make it possible to fingerprint your
> > Tor use.
> Let us try to define what "fingerprinting Tor use" means exactly. It 
> clearly does not mean "detect if you are using Tor". It probably has 
> more to do with detecting that a certain single TorBrowser installation, 
> including all its settings and plugins, is communicating with a certain 
> server. An adversary could detect this at the side of the exit node 
> (possibly even in the case of encrypted traffic), but more importantly 
> it can be detected at the side of the server.
> 
> When does the fingerprinting attack matter? Does it only apply when a 
> user is using the same TorBrowser installation for identities or 
> behaviors that the user wishes to keep separate? It is already 
> recommended to restart the TorBrowser to disconnect behaviors. Wouldn't 
> it be also recommendable to use different TorBrowser installation for 
> different behaviors, or is this going too far?

This is probably the best course of action in lack of further studies
(no I did not read the freehaven yet) on the feasibility of such
attacks. Suppose they are somehow able, what can you ado to add fuzz on
the data they get. Using different browsers for different kinds of
commitments at least make them need to account for this kind of behavior
on a growing percentage of telco users. Worst case scenario is if
everyone is using TBB same version full time except you, but from what I
experience people on tor are doing all kinds of stuff, not just one. So
I'd say keep experimenting and ping here if you find something weird in
it's normality. 

-- 
010
001
111

-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk