6 ms·

You absolutely should use Tor for regular non-logged in browsing if you can bear the slowness. Exit bandwidth is limited, but I'd say being a needle in the hays

by apecat 7y ago

You absolutely should use Tor for regular non-logged in browsing if you can bear the slowness. Exit bandwidth is limited, but I'd say being a needle in the haystack of people who actually need the privacy is a net benefit. I'd just really advise against touching Tor with a regular browser. For starters, you shouldn't browse Tor without blocking JavaScript by default. Hogging the bandwidth needed for video is also where 'normal use' turns problematic for the people who actually rely on Tor for personal safety. Tor Browser is painstakingly maintained to make it suitable for Tor. Even Brave's Tor mode is more fit for purpose than proxying Tor manually. I'd also argue that it's better for the anonymity of all to use a browser prepared to avoid fingerprinting.

jandrese 7y ago
Seems like you are being the haystack instead of the needle in this case.
- mandelbrotwurst 7y ago
  Well, that or he is a rare strand of hay in a stack made mostly of needles. (I'm stretching the analogy to point out that you are correct that he is providing cover [the hay], but that most of the traffic currently is of the type that the surveilling entity is looking for [the needles]).
  - deleted 7y ago
    [deleted]
bogomipz 7y ago
>"For starters, you shouldn't browse Tor without blocking JavaScript by default." Could you say why this is recommended?
- tomcooks 7y ago
  Because JS might be used to leverage technology that can give clues on your browser and connection, it's in general one less open hole to think about when trying to stay as anonymous as possible
  - apecat 7y ago
    Not only that, but JavaScript can get you owned, and any code loaded over a non-https connection could be rewritten in transfer. Remember: all Tor exit IPs are publicly known. Tor users are easy to target. If you use .onion services for anything... interesting, you should also be aware that the first step an advanced attacker might do with a compromised site is to try and completely own all browsers visiting. If you run JavaScript, you're just waiting for someone to poke a hole in whatever sandbox protections the Firefox base of Tor Browser can provide. Example: https://threatpost.com/tor-browser-update-critical-flaw/145857/ https://threatpost.com/tor-browser-update-critical-flaw/1458...
    - bogomipz 7y ago
      Interesting point. Thanks. I have a related question. I'm assuming Tor browsers don't include any javascript engine then? And also likely include some self-contained resolver library? Are there other things that differences between a standard browser and a Tor browser worth mentioning?
      - cyphar 7y ago
        The Tor Browser enables JavaScript by default -- it would be impossible to use for most web browsing otherwise. In fact there is an argument to be made that you should not disable JavaScript because it makes your fingerprint more unique to the sites you visit (you're a Tor user with JavaScript disabled). It depends on whether you value your anonymity more than the risk of potentially being attacked by bad JavaScript. Tor Browser is based on Firefox, and has a bunch of anti-fingerprinting measures built in to it which have been slowly upstreamed to Firefox (as well as ensuring the Firefox doesn't send anything without going through Tor -- something which historically has been hard to do as a Firefox user).

by apecat 7y ago

jandrese 7y ago

Seems like you are being the haystack instead of the needle in this case.

mandelbrotwurst 7y ago
Well, that or he is a rare strand of hay in a stack made mostly of needles. (I'm stretching the analogy to point out that you are correct that he is providing cover [the hay], but that most of the traffic currently is of the type that the surveilling entity is looking for [the needles]).
- deleted 7y ago
  [deleted]

bogomipz 7y ago

>"For starters, you shouldn't browse Tor without blocking JavaScript by default." Could you say why this is recommended?

tomcooks 7y ago
Because JS might be used to leverage technology that can give clues on your browser and connection, it's in general one less open hole to think about when trying to stay as anonymous as possible
- apecat 7y ago
  Not only that, but JavaScript can get you owned, and any code loaded over a non-https connection could be rewritten in transfer. Remember: all Tor exit IPs are publicly known. Tor users are easy to target. If you use .onion services for anything... interesting, you should also be aware that the first step an advanced attacker might do with a compromised site is to try and completely own all browsers visiting. If you run JavaScript, you're just waiting for someone to poke a hole in whatever sandbox protections the Firefox base of Tor Browser can provide. Example: https://threatpost.com/tor-browser-update-critical-flaw/145857/ https://threatpost.com/tor-browser-update-critical-flaw/1458...
  - bogomipz 7y ago
    Interesting point. Thanks. I have a related question. I'm assuming Tor browsers don't include any javascript engine then? And also likely include some self-contained resolver library? Are there other things that differences between a standard browser and a Tor browser worth mentioning?
    - cyphar 7y ago
      The Tor Browser enables JavaScript by default -- it would be impossible to use for most web browsing otherwise. In fact there is an argument to be made that you should not disable JavaScript because it makes your fingerprint more unique to the sites you visit (you're a Tor user with JavaScript disabled). It depends on whether you value your anonymity more than the risk of potentially being attacked by bad JavaScript. Tor Browser is based on Firefox, and has a bunch of anti-fingerprinting measures built in to it which have been slowly upstreamed to Firefox (as well as ensuring the Firefox doesn't send anything without going through Tor -- something which historically has been hard to do as a Firefox user).