[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-talk] Tor Browser Security Settings warning
On 04/08/2018 05:12 PM, Joe wrote:
On 04/05/2018 11:34 PM, Joe wrote:
On 04/05/2018 06:19 AM, Georg Koppen wrote:
A safe thing to do would be downloading a clean, new Tor Browser from
our website and start over again (mabye exporting the bookmarks from the
currently used Tor Browser and importing them in the newly downloaded one).
Georg
Georg (or anyone),
I D/L TBB 7.5.6 Linux & verified w/ GPG.
Installed to new directory as you suggested.
After the clean install, Torbutton Security didn't show a msg about
"unusual security settings."
As most know, TBB ships w/ NoScript set to allow all scripts globally
(which NoScript warns as "Dangerous").
I changed NS to deny scripts globally, as many experienced users do (in
TBB and other browsers).
Like many, I don't allow NS to "cascade top document's permissions to
3rd party scripts," under Advanced > Trusted. [for newer users, "top
document's permissions" (the target web page's permissions) means what
ever scripts or permissions you allowed for your target site, any & all
3rd parties the have the same permissions]. Which could be very
dangerous if a site is hacked with malicious scripts & NoScript says,
"Come on in!"
Under NoScript Advanced > HTTPS, I UNcheck, "Allow HTTPS scripts
globally on HTTPS documents," because there's generally no reason to
allow *ALL* 3rd party trackers' or hackers' HTTPS scripts, but plenty of
reasons not to.
Now Torbutton > Security Settings shows the "unusual security settings"
message, "for security and privacy reasons," as if these settings are
more dangerous than the defaults.
When I click Torbutton's Restore Default Settings, the only thing I find
it resets is NoScript to allow scripts globally, under the whitelist
tab. AFAIK, it doesn't change any (other) NoScript settings, or
about:config prefs & nothing under TBB Preferences > Privacy.
It appears that Torbutton thinks allowing scripts globally is a safer
way to go.
Hey Georg,
What kinds of things in NoScript is the "restore default settings"
changing? I've never seen that restoring default changed anything
there, and I've looked pretty deeply.
The only things I change in NS are things that improve anonymity &
security, not hurt them. Just like many experienced Tor users do.
Of course, anything is "possible." Tor Project has already made the
changes to Firefox that I'd be interested in changing, if they
weren't already.
You said it's adjusting important settings.
If you or others can give me typical things to look at. I'll capture
before & after lists (TBB or NS prefs in about:config, or what ever)
to find what it's objecting to.
I don't let NS allow scripts globally for any tracker & their brother
track me.
I'll be honest - I've never seen resetting to default change
anything, anywhere. If I know where to look, it'll save me some time.
I don't allow setting cookies unless necessary AND I trust the site.
The only addon I have is uBlock Origin. I'm pretty sure uBo isn't
changing Tor browser settings - to be *less* secure or private.
Maybe the reverse of that.
Still, I'd like to know what it is & maybe pursue a fix. Without some
ad blocker (that isn't itself a tracker), quite a few sites load so
slowly, it's almost not worth it.
News sites are crazy over run w/ ads that just keep coming.
No one replied (yet) on "these are the main things that clicking
_Restore Default Settings_ under TorBrowser Security Settings will
change."
I'm not sure if this data is a guarded secret or this list just has
few knowledgeable users or project employees to discuss it.
So did some comparison of before / after in NoScript and TorBrowser
settings in about:config prefs - looking at which user set prefs
changed, if any.
So far, I found resetting to default security settings (when the
security slider = Low), causes
* NoScript is reset to allow all scripts globally and
* NoScript - Advanced/HTTPS/Permissions - re-enables "Allow HTTPS
scripts globally on HTTPS documents" which is the about:config pref:
noscript.globalHttpsWhitelist; (True if checked to allow in NS).
I found no other changes. I repeated the process of disabling those 2
options and looking at TBB security settings.
Each time I unchecked the 2 NS options, TBB warned of "unusual
security settings."
"For your security and privacy reasons, we recommend you choose one of
the default security levels." Even the low security level?
I can install a clean TBB version & make the change to "remember my
browsing & download history," but not allow 1st or 3rd party cookies
and see if the same warning shows.
If TBB / Tor Button is actually coded to say that allowing 100% of all
scripts leads to better security, the message's wording probably needs
revision.
The quite old FAQ
https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled, says
"if you disable JavaScript by default but then allow a few websites to
run scripts (the way most people use NoScript), then your choice of
whitelisted websites acts as a sort of cookie that makes you
recognizable (and distinguishable), thus harming your anonymity."
First, it presumes users make *permanent* JS exceptions for some
sites, rather than temporary ones that are deleted after closing a tab
or when browser closes.
It seems to presume that users allowing some scripts don't close tabs
or clear any data before going to other sites.
The FAQ (probably 10+ yrs old) pro vs. con seems outdated. Today,
allowing "all scripts, all the time" allows sites & trackers (thus,
allowing users' national governments) to gather so much more info
about their activities & machine than temporarily white listing a few
sites in NoScript ever would. Factor in revoking script permissions
upon leaving a site and selective temporary scripts exceptions are
even less damaging.
The amount of data that sites, trackers and adversaries can and do
gather is so much greater with *all scripts allowed always,* it's
probably not a close comparison to selective, temporary whitelisting
of select scripts.
Not to mention the increased security threat of globally allowing scripts.
I personally don't permanently white list anything in TorBrowser.
--
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk