5 ms·
Indeed, it's common advice that users of Darknet markets should not have Javascript turned on at all, since it increases their attack surface. (e.g. https://dar
by vilhelm_s 9y ago
Indeed, it's common advice that users of Darknet markets should not have Javascript turned on at all, since it increases their attack surface. (e.g. https://darknetmarkets.org/agora-comments-on-recent-bitcoin-stealing-private-message-javascript-attack/ https://darknetmarkets.org/agora-comments-on-recent-bitcoin-...)
- stingraycharles 9y agoIsnt that the default of the Tor browser as well ?
- 4ad 9y agoNo, it isn't, which is insane.
- dmix 9y agoYes it is. It wasn't for the first couple years but they turned it on a few yrs back. Last time I used Tor browser JS was disabled by default... I'd be surprised if that wasn't the case.
- 4ad 9y agoNo, it isn't. I just downloaded the latest version of the Tor Browser, 7.5, and while it comes with NoScript installed, it's turned off by default: https://i.imgur.com/7pb7nvI.png https://i.imgur.com/7pb7nvI.png
- mirimir 9y agoThat's been a contentious point for years. The dominant faction of Tor devs fears that Javascript blocking will confuse and frustrate too many users. In the kindest interpretation, that's to protect the most users, notwithstanding that it will get some users pwned. Less kindly, one could argue that Tor devs want to increase the anonymity set, in order to better hide US government users. That was, after all, one reason why Tor's initial Navy funders agreed with open release of the software. There are similar issues around other Tor vulnerabilities. Such as how easy it is for apps to bypass Tor. Which has allowed the FBI's phone-home malware to pwn users.
- TomMarius 9y agoCould you please tell me more about the other Tor vulnerabilities?
- mirimir 9y agoI'm not aware of known vulnerabilities in Tor itself that devs haven't mitigated, out of usability concerns or whatever. Generally, I consider the focus on Windows users, and the reliance on tweaking Firefox for security, to be vulnerabilities. Also the refusal to compartmentalize the Tor process from userland, either in VMs or in separate hardware. I mean, Whonix has been around for years, and it's not featured (or even mentioned, unless you dig into the wiki) on the Tor Project website. And what about Qubes? Or Tor routers? I mean, they go after people for calling them that, citing their copyright.
- crtasm 9y agohttps://blog.torproject.org/tor-heart-qubes-os https://blog.torproject.org/tor-heart-qubes-os https://blog.torproject.org/tor-heart-whonix https://blog.torproject.org/tor-heart-whonix https://blog.torproject.org/tails-36-out https://blog.torproject.org/tails-36-out But I fully agree the main site should make the risks of TBB clearer and promote Whonix/similar.
- crtasm 9y agoAre you claiming that running an app in an environment where it can access the internet directly counts as a vulnerability in Tor?
- mirimir 9y agoYes, of course it is. Whether it's the Tor Project's fault or the user's fault is a contentious issue.
- crtasm 9y agoI disagree, Tor isn't a sandbox or firewall for your apps. If they make undesired network traffic then the vulnerability is in the app (and arguably, the environment it's running in).
- roystonvassey 9y agoI think it imports any JS blocker you might be using on Firefox. For instance, in my case, I installed Tor and when I started it the first time, I saw the 'NoScript' tab enabled.
- s73v3r_ 9y agoI like how that's a .org. They really do just want to get the information out there.