8 ms·

The thing is, most of these exploits also affect Tor browser, because it's built upon Firefox. Other than using a VM or a live distro like Tails , is there any

The thing is, most of these exploits also affect Tor browser, because it's built upon Firefox. Other than using a VM or a live distro like Tails , is there any other way for OR users to be safer when running the regular Tor browser bundle, such as by utilising third-party sandbox software?

deleted 7y ago
[deleted]
spacephysics 7y ago
Most likely not, because then the user is dependent on the sandboxing capabilities of the software. Having a VM-level sandbox, although still technically possible to escape, would be far more difficult for an adversary.
- skrebbel 7y ago
  Wouldn't running it in eg Sandboxie address the biggest risk? I mean, sure, probably Sandboxie can be escaped, but what malicious script that's busy adding my computer to it's botnet is going to assume that my Firefox running in a sandbox?
stiray 7y ago
While still on windows I was using this, for browser, software installs,... sandboxie.com/ It wont prevent execution but will prevent escaping to the real os.
rashkov 7y ago
It’s a bit of a leap to assume that TOR is vulnerable here, considering it disables JavaScript which is necessary for this exploit to work. Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance.
- vbezhenar 7y ago
  TOR Browser does not disable JavaScript. It would be pretty useless with disabled JavaScript to be honest, a lot of the websites nowadays require JavaScript to work.
- deleted 7y ago
  [deleted]
- tyingq 7y ago
  " Why is NoScript configured to allow JavaScript by default in Tor Browser? Isn't that unsafe? We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled." https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
- chefandy 7y ago
  Tor Browser Bundle does not outright disable JS at the settings level— it comes bundled with NoScript installed (and enabled by default,) but it can purposefully be wholly or partially disabled by the user with a couple of toolbar clicks. "Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance." You seem to be jumping to the opposite conclusion with your comment, which I'd argue is an even worse idea with security software. Considering that TBB is based on the vulnerable software package and the vulnerability could directly circumvent what TBB is attempting to accomplish, assuming there isn't a reasonable attack vector seems imprudent, rather than an appropriately measured response. If I had a serious privacy concern such as reporting on the activity of a government known for murdering its critics, I certainly would think twice if the only thing preventing remote attack code from executing in a vulnerable envrionment on my machine was a browser plugin.
willvarfar 7y ago
You can use whonix, which runs the browser in a VM that can only connect to the tor proxy in a second VM. It’s not claiming to be truly secure, but it is several extra layers that an attacker would have to get through
ErikCorry 7y ago
Most likely you are _less safe_ using Tor than using a regular Firefox or Chrome with no VPN, because using Tor automatically means nation state attackers are going to target you. So you have to do extra work just to break even. Google EgotisticalGiraffe for details.
- rahuldottech 7y ago
  There's no way this is true. Even if nation state actors _are_ more likely to target you just for using Tor, even if it's for completely regular browsing, Tor provides a lot of additional protection and anonymity.
  - DyslexicAtheist 7y ago
    I initially got hung up on the GP assertion that users are most likely better off with Firefox. It depends on the threat model. But after thinking about it for a while, I agree with GP. Those people thinking about such topics constantly might not be the average user. I would not feel safe installing Tor on my parents computer and telling them it is safer to do all their browsing now with Tor. Threat models matter otherwise we'll end up applying wrong security tools: *"use Signal. use tor." when the right thing would have been to meet in person wearing a fake mustache, and keep a pebble in your shoe to change your walk. GP's advise makes sense for anyone who does not know what Tor is (most people). They are off better if we symlink their "Internet Button" from the desktop to Firefox, install uBlock and NanoDefender for them. If they're still adventurous teach them about creating/editing "multitab containers" (though I bet we've lost most of them by now).
    - dmos62 7y ago
      > GP's advise makes sense for anyone who does not know what Tor is Whether or not someone knows of Tor doesn't influence her threat model or privacy requirements, and therefore doesn't influence what measures can help. Other than that, I agree that you have to be aware of the threat model and what given tools provide.
  - deleted 7y ago
stefan_ 7y ago
Since the goal of many Tor Browser exploits is deanonymization, your first measure should be to not have the browser machine connected to a real network at all. Get a Raspberry or similar to proxy all traffic through Tor.
- gruez 7y ago
  This is not necessary because the tor browser bundle is already designed not to leak its traffic.
  - stefan_ 7y ago
    Which, of course, is entirely worthless if you exploited the browser bundle.
bepvte 7y ago
Tor disables Ion last I checked, so this comment is not true
kevingadd 7y ago
Disable javascript, for starters

deleted 7y ago

[deleted]

spacephysics 7y ago

Most likely not, because then the user is dependent on the sandboxing capabilities of the software. Having a VM-level sandbox, although still technically possible to escape, would be far more difficult for an adversary.

skrebbel 7y ago
Wouldn't running it in eg Sandboxie address the biggest risk? I mean, sure, probably Sandboxie can be escaped, but what malicious script that's busy adding my computer to it's botnet is going to assume that my Firefox running in a sandbox?

stiray 7y ago

While still on windows I was using this, for browser, software installs,... sandboxie.com/ It wont prevent execution but will prevent escaping to the real os.

rashkov 7y ago

It’s a bit of a leap to assume that TOR is vulnerable here, considering it disables JavaScript which is necessary for this exploit to work. Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance.

vbezhenar 7y ago
TOR Browser does not disable JavaScript. It would be pretty useless with disabled JavaScript to be honest, a lot of the websites nowadays require JavaScript to work.
deleted 7y ago
[deleted]
tyingq 7y ago
" Why is NoScript configured to allow JavaScript by default in Tor Browser? Isn't that unsafe? We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled." https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
chefandy 7y ago
Tor Browser Bundle does not outright disable JS at the settings level— it comes bundled with NoScript installed (and enabled by default,) but it can purposefully be wholly or partially disabled by the user with a couple of toolbar clicks. "Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance." You seem to be jumping to the opposite conclusion with your comment, which I'd argue is an even worse idea with security software. Considering that TBB is based on the vulnerable software package and the vulnerability could directly circumvent what TBB is attempting to accomplish, assuming there isn't a reasonable attack vector seems imprudent, rather than an appropriately measured response. If I had a serious privacy concern such as reporting on the activity of a government known for murdering its critics, I certainly would think twice if the only thing preventing remote attack code from executing in a vulnerable envrionment on my machine was a browser plugin.

willvarfar 7y ago

You can use whonix, which runs the browser in a VM that can only connect to the tor proxy in a second VM. It’s not claiming to be truly secure, but it is several extra layers that an attacker would have to get through

ErikCorry 7y ago

Most likely you are _less safe_ using Tor than using a regular Firefox or Chrome with no VPN, because using Tor automatically means nation state attackers are going to target you. So you have to do extra work just to break even. Google EgotisticalGiraffe for details.

rahuldottech 7y ago
There's no way this is true. Even if nation state actors _are_ more likely to target you just for using Tor, even if it's for completely regular browsing, Tor provides a lot of additional protection and anonymity.
- DyslexicAtheist 7y ago
  I initially got hung up on the GP assertion that users are most likely better off with Firefox. It depends on the threat model. But after thinking about it for a while, I agree with GP. Those people thinking about such topics constantly might not be the average user. I would not feel safe installing Tor on my parents computer and telling them it is safer to do all their browsing now with Tor. Threat models matter otherwise we'll end up applying wrong security tools: *"use Signal. use tor." when the right thing would have been to meet in person wearing a fake mustache, and keep a pebble in your shoe to change your walk. GP's advise makes sense for anyone who does not know what Tor is (most people). They are off better if we symlink their "Internet Button" from the desktop to Firefox, install uBlock and NanoDefender for them. If they're still adventurous teach them about creating/editing "multitab containers" (though I bet we've lost most of them by now).
  - dmos62 7y ago
    > GP's advise makes sense for anyone who does not know what Tor is Whether or not someone knows of Tor doesn't influence her threat model or privacy requirements, and therefore doesn't influence what measures can help. Other than that, I agree that you have to be aware of the threat model and what given tools provide.
- deleted 7y ago

stefan_ 7y ago

Since the goal of many Tor Browser exploits is deanonymization, your first measure should be to not have the browser machine connected to a real network at all. Get a Raspberry or similar to proxy all traffic through Tor.

gruez 7y ago
This is not necessary because the tor browser bundle is already designed not to leak its traffic.
- stefan_ 7y ago
  Which, of course, is entirely worthless if you exploited the browser bundle.

bepvte 7y ago

Tor disables Ion last I checked, so this comment is not true

kevingadd 7y ago

Disable javascript, for starters