6 ms·

Are there any privacy concerns if ublock origin extension is used with the Tor browser?

by subliminalpanda 10y ago

driverdan 10y ago
Not necessary if you disable JS, which you absolutely should do if you care about privacy while using Tor.
- bjacobel 10y ago
  Anything you do like this to "customize" the default Tor Browser install can reduce your privacy instead, as it provides a factor by which you can be fingerprinted and differentiated from the larger base of users using the Tor Browser as-is. Source: see the Tor Browser docs on why they enable JS by default (though NoScript is installed and can be configured to block all JS, if you know the risks) https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
  - animeweedlord 10y ago
    There are any number of ways to deanonymize users once javascript is running, not to mention the greater possibility of escaping the sandbox. It's a damned if you do, damned if you don't scenario. I know they're trying to serve users that can't be expected to play the whitelisting game, but they really should be stricter here. It's already trivial to differentiate a Tor user from a regular one, they might as well set the most secure defaults possible.
omginternets 10y ago
I'm not an expert in the field, but my understanding is that you can be (partially?) fingerprinted based on the ads you (fail to) download. I also believe such partially discriminating information can be combined with other patterns (time at which you connect, sites visited, etc) to compromise your privacy. I have no idea if this is problematic in practice, though.
- Santosh83 10y ago
  Considering that Tor Browser users would also on the whole want to probably filter ads to improve their already slow latency, I'm hoping the Tor and µBlock devs can get together and standardise µBlock on all Tor Browsers with a preselected list of filters, which should reduce the ability to fingerprint by analysing the downloads of ads, at least within the set of all Tor Browser users.
  - Jarwain 10y ago
    There's actually a ticket up currently to do exactly that, integrate uBlock on the default Tor install. https://trac.torproject.org/projects/tor/ticket/17569 https://trac.torproject.org/projects/tor/ticket/17569
  - Freak_NL 10y ago
    > µBlock Just 'uBlock Origin'. You are probably mixing up the names of µTorrent and uBlock Origin.
    - jdeibele 10y ago
      I, like Santosh83, remember seeing uBlock or uBlock Origin written with the µ. Can't find it on either of their Github sites now, though.
    - Santosh83 10y ago
      Nope. But I did mean uBlock Origin and instead hastily left out the "Origin" part of its name, which can lead to confusion with the uBlock extension maintained by another developer. Most people though seem to prefer uBlock Origin and that's what I use too. The spellings uBlock and µBlock seem to be used interchangeably on different pages and sites although undeniably uBlock seems by far the commoner variant.
    - Sephr 10y ago
      The u in uBlock stands for micro (µ).
- 10y ago
_0ffh 10y ago
It's explained in "design philosophy" under point #5: https://www.torproject.org/projects/torbrowser/design/#philosophy https://www.torproject.org/projects/torbrowser/design/#philo...
nikcub 10y ago
Along with a number of other people I've been advocating bundling uBlock Origin by default in Tor Browser[1]. There were some fingerprinting and upstream support issues but most of these have been resolved, and some were philosophically opposed to including an ad blocker or breaking sites. The main concern with adding uBlock Origin would be flipping bits that make your browser unique and stand out in the crowd. You can evaluate that risk based on your own operational profile. [1] https://mailman.boum.org/pipermail/tails-dev/2016-January/010146.html https://mailman.boum.org/pipermail/tails-dev/2016-January/01...
- Zikes 10y ago
  If fingerprinting is the primary concern then bundling should solve that, right?
  - nikcub 10y ago
    Yep - get more people using the same setup and have a larger crowd to hide in. Altho I think the new security slider in Tor Browser effectively breaks that crowd out into those groups plus any individual whitelisting the user allows I think it should just default the settings to the highest security level, but understand the design requirement that many users use Tor as their primary browser so need video, JAR's etc.

Are there any privacy concerns if ublock origin extension is used with the Tor browser?

driverdan 10y ago

Not necessary if you disable JS, which you absolutely should do if you care about privacy while using Tor.

bjacobel 10y ago
Anything you do like this to "customize" the default Tor Browser install can reduce your privacy instead, as it provides a factor by which you can be fingerprinted and differentiated from the larger base of users using the Tor Browser as-is. Source: see the Tor Browser docs on why they enable JS by default (though NoScript is installed and can be configured to block all JS, if you know the risks) https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
- animeweedlord 10y ago
  There are any number of ways to deanonymize users once javascript is running, not to mention the greater possibility of escaping the sandbox. It's a damned if you do, damned if you don't scenario. I know they're trying to serve users that can't be expected to play the whitelisting game, but they really should be stricter here. It's already trivial to differentiate a Tor user from a regular one, they might as well set the most secure defaults possible.

omginternets 10y ago

I'm not an expert in the field, but my understanding is that you can be (partially?) fingerprinted based on the ads you (fail to) download. I also believe such partially discriminating information can be combined with other patterns (time at which you connect, sites visited, etc) to compromise your privacy. I have no idea if this is problematic in practice, though.

Santosh83 10y ago
Considering that Tor Browser users would also on the whole want to probably filter ads to improve their already slow latency, I'm hoping the Tor and µBlock devs can get together and standardise µBlock on all Tor Browsers with a preselected list of filters, which should reduce the ability to fingerprint by analysing the downloads of ads, at least within the set of all Tor Browser users.
- Jarwain 10y ago
  There's actually a ticket up currently to do exactly that, integrate uBlock on the default Tor install. https://trac.torproject.org/projects/tor/ticket/17569 https://trac.torproject.org/projects/tor/ticket/17569
- Freak_NL 10y ago
  > µBlock Just 'uBlock Origin'. You are probably mixing up the names of µTorrent and uBlock Origin.
  - jdeibele 10y ago
    I, like Santosh83, remember seeing uBlock or uBlock Origin written with the µ. Can't find it on either of their Github sites now, though.
  - Santosh83 10y ago
    Nope. But I did mean uBlock Origin and instead hastily left out the "Origin" part of its name, which can lead to confusion with the uBlock extension maintained by another developer. Most people though seem to prefer uBlock Origin and that's what I use too. The spellings uBlock and µBlock seem to be used interchangeably on different pages and sites although undeniably uBlock seems by far the commoner variant.
  - Sephr 10y ago
    The u in uBlock stands for micro (µ).
10y ago

_0ffh 10y ago

It's explained in "design philosophy" under point #5: https://www.torproject.org/projects/torbrowser/design/#philosophy https://www.torproject.org/projects/torbrowser/design/#philo...

nikcub 10y ago

Along with a number of other people I've been advocating bundling uBlock Origin by default in Tor Browser[1]. There were some fingerprinting and upstream support issues but most of these have been resolved, and some were philosophically opposed to including an ad blocker or breaking sites. The main concern with adding uBlock Origin would be flipping bits that make your browser unique and stand out in the crowd. You can evaluate that risk based on your own operational profile. [1] https://mailman.boum.org/pipermail/tails-dev/2016-January/010146.html https://mailman.boum.org/pipermail/tails-dev/2016-January/01...

Zikes 10y ago
If fingerprinting is the primary concern then bundling should solve that, right?
- nikcub 10y ago
  Yep - get more people using the same setup and have a larger crowd to hide in. Altho I think the new security slider in Tor Browser effectively breaks that crowd out into those groups plus any individual whitelisting the user allows I think it should just default the settings to the highest security level, but understand the design requirement that many users use Tor as their primary browser so need video, JAR's etc.