5 ms·

This wouldn't work at all for mainline Firefox, or at least wouldn't be 'secure' as users might be thinking. One at least needs to have JavaScript disabled whe

This wouldn't work at all for mainline Firefox, or at least wouldn't be 'secure' as users might be thinking. One at least needs to have JavaScript disabled when on Tor or you'll easily be compromised and Firefox 23 now ships with JavaScript always-on. http://boingboing.net/2013/08/04/anonymous-web-host-shut-down.html http://boingboing.net/2013/08/04/anonymous-web-host-shut-dow...

bad_user 13y ago
Why is JavaScript an issue? In private mode no traces (like cookies) are permanent, so how can JavaScript be used against anonymity? Of course, it increases the surface area of attack for exploits, but is there something else I'm missing?
- Skalman 13y ago
  It adds a great amount of fingerprintability.
  - foobarqux 13y ago
    Disabling javascript would probably add about the same amount of fingerprintability. Panopticlick says that 1 in 24000 browsers have the same fingerprint as TorBrowser.
- tghw 13y ago
  There was a recent attack against TorBrowser that utilized a vulnerability in older versions of the Firefox Javascript engine. These sorts of vulnerabilities are not uncommon, so turning off JS significantly decreases the attack surface.
- brymaster 13y ago
  Here's a good example: https://news.ycombinator.com/item?id=6154246 https://news.ycombinator.com/item?id=6154246
kristofferR 13y ago
TorBrowser ships with JavaScript on by default too.
- corin_ 13y ago
  Which in itself is ridiculous.
frozenport 13y ago
Would it be possible to make a subset of javascript that would maintain anonymity?
derrida 13y ago
This was patched if you were using the latest Tor Browser Bundle at the time this exploit was attempted [1] . Vulnerabilities will always be disclosed, developers will always have to patch them. Automatic updating and deterministic builds [2] are the way to go. [1] The version numbers are here https://blog.torproject.org/blog/new-tor-browser-bundles-and-tor-02414-alpha-packages https://blog.torproject.org/blog/new-tor-browser-bundles-and... Note: these version numbers were not vulnerable to the exploit, patched in June & note the day the exploitation took place (August) [2] Background on deterministic builds and binary verification http://lwn.net/SubscriberLink/564263/1ab0ab93a900ecea/ http://lwn.net/SubscriberLink/564263/1ab0ab93a900ecea/
nnethercote 13y ago
Firefox 23 doesn't ship with JavaScript "always on". It's on by default, as it always has been. And the option to turn it off was removed from the main options dialog. This is for sensible reasons -- many users turn it off either accidentally, or without understanding what it means ("this must be that insecure Java thing I keep hearing about") which breaks many websites. But the 0.01% of people who like to browse without JS enabled can still do so via about:config -- look for "javascript.enabled". Or they can use an add-on. Or they can wait a version or two (I'm not sure the exact timeline) whereupon you'll be able to disable it via the developer tools UI.
- brymaster 13y ago
  > Firefox 23 doesn't ship with JavaScript "always on". > It's on by default, as it always has been. You're being overly pedantic and I'm sure you knew what I meant when I said it ships always-on.
  - foobarbazqux 13y ago
    Pedantry never hurt anybody. He's a Firefox developer, the clarifications are interesting.
    - brymaster 13y ago
      > Pedantry never hurt anybody Disagree. > He's a Firefox developer, the clarifications are interesting That's good. Then he ought to recall what's in the release notes for Firefox 23: http://www.mozilla.org/en-US/firefox/23.0/releasenotes/ http://www.mozilla.org/en-US/firefox/23.0/releasenotes/ > "Enable JavaScript" preference checkbox has been removed and user-set values will be reset to the default
      - foobarbazqux 13y ago
        How does pedantry hurt people?

bad_user 13y ago

Why is JavaScript an issue? In private mode no traces (like cookies) are permanent, so how can JavaScript be used against anonymity? Of course, it increases the surface area of attack for exploits, but is there something else I'm missing?

Skalman 13y ago
It adds a great amount of fingerprintability.
- foobarqux 13y ago
  Disabling javascript would probably add about the same amount of fingerprintability. Panopticlick says that 1 in 24000 browsers have the same fingerprint as TorBrowser.
tghw 13y ago
There was a recent attack against TorBrowser that utilized a vulnerability in older versions of the Firefox Javascript engine. These sorts of vulnerabilities are not uncommon, so turning off JS significantly decreases the attack surface.
brymaster 13y ago
Here's a good example: https://news.ycombinator.com/item?id=6154246 https://news.ycombinator.com/item?id=6154246

kristofferR 13y ago

TorBrowser ships with JavaScript on by default too.

corin_ 13y ago
Which in itself is ridiculous.

frozenport 13y ago

Would it be possible to make a subset of javascript that would maintain anonymity?

derrida 13y ago

This was patched if you were using the latest Tor Browser Bundle at the time this exploit was attempted [1] . Vulnerabilities will always be disclosed, developers will always have to patch them. Automatic updating and deterministic builds [2] are the way to go. [1] The version numbers are here https://blog.torproject.org/blog/new-tor-browser-bundles-and-tor-02414-alpha-packages https://blog.torproject.org/blog/new-tor-browser-bundles-and... Note: these version numbers were not vulnerable to the exploit, patched in June & note the day the exploitation took place (August) [2] Background on deterministic builds and binary verification http://lwn.net/SubscriberLink/564263/1ab0ab93a900ecea/ http://lwn.net/SubscriberLink/564263/1ab0ab93a900ecea/

nnethercote 13y ago

Firefox 23 doesn't ship with JavaScript "always on". It's on by default, as it always has been. And the option to turn it off was removed from the main options dialog. This is for sensible reasons -- many users turn it off either accidentally, or without understanding what it means ("this must be that insecure Java thing I keep hearing about") which breaks many websites. But the 0.01% of people who like to browse without JS enabled can still do so via about:config -- look for "javascript.enabled". Or they can use an add-on. Or they can wait a version or two (I'm not sure the exact timeline) whereupon you'll be able to disable it via the developer tools UI.

brymaster 13y ago
> Firefox 23 doesn't ship with JavaScript "always on". > It's on by default, as it always has been. You're being overly pedantic and I'm sure you knew what I meant when I said it ships always-on.
- foobarbazqux 13y ago
  Pedantry never hurt anybody. He's a Firefox developer, the clarifications are interesting.
  - brymaster 13y ago
    > Pedantry never hurt anybody Disagree. > He's a Firefox developer, the clarifications are interesting That's good. Then he ought to recall what's in the release notes for Firefox 23: http://www.mozilla.org/en-US/firefox/23.0/releasenotes/ http://www.mozilla.org/en-US/firefox/23.0/releasenotes/ > "Enable JavaScript" preference checkbox has been removed and user-set values will be reset to the default
    - foobarbazqux 13y ago
      How does pedantry hurt people?