[tor-talk] Tor Browser disabling Javascript anonymity set reduction [WAS: Basic questions ...]

[<proper@xxxxxxxxxxxxxxx>]

https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled
The FAQ entry is very questionable.
"Disabling JavaScript by default, then allowing a few websites to run scripts, is especially bad for your anonymity: the set of websites which you allow to run scripts is very likely to uniquely identify your browser."

I have to agree, that *theoretically* disabling Javascript is a anonymity set reduction, because probable most TBB users don't leave it enabled.

The problem is, it makes the false assumption, that the Javascript anonymisation in Torbutton is next to perfect. It's far from perfect. There are severe bugs open. If you go on ip-check.info you'll see, that with Javascript enabled, the site can still read how many and which fonts you have installed.
https://trac.torproject.org/projects/tor/ticket/2187
https://trac.torproject.org/projects/tor/ticket/2872
https://trac.torproject.org/projects/tor/ticket/4797
That's one bug I understand. I don't know if there are any other bugs open with such severe implications for browser fingerprinting.
https://trac.torproject.org/projects/tor/query?status=accepted&status=assigned&status=needs_information&status=needs_review&status=needs_revision&status=new&status=reopened&component=Torbutton&order=priority&col=id&col=summary&col=component&col=type&col=status&col=priority&col=milestone

That's way more severe than turning off Javascript at all.

Torproject probable also doesn't know, how many people turn off Javascript. How many people do use TBB? Or are they still using the mainline Firefox and torify like it was proclaimed years ago? Also if you look through some public forums, which discuss Tor, they also often still proclaim to turn off Javascript.

______________________________________________________
powered by Secure-Mail.biz - anonymous and secure e-mail accounts.

_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk