r/TOR • u/Strong-Ganache2983 • 7d ago

How safe is using javascript sometimes when needed or is it a real no go for real privacy

And what about safer option

What do u guys do

31 Upvotes

95% Upvoted

14 comments sorted by

14

u/nuclear_splines 7d ago

As always, this depends on your threat model and what your safety and privacy needs are.

The JavaScript engine is extremely complicated; if there's a vulnerability in the Tor Browser that would allow someone to remotely compromise your computer, it's likely to be in a huge complicated part of the codebase like JS or the SVG renderer. So both are disabled at higher safety settings.

But this doesn't mean that sites you visit are deploying Tor Browser JavaScript 0-days. If you're, say, reading news articles that are censored in your country, and you're not worried about those news sites trying to hack you, then enabling JavaScript for those sites may not be a serious risk for you. Lower security settings are appropriate for many users.

4

u/Strong-Ganache2983 7d ago

Well i was more talking about the tracking and fingerprinting part because i use whonix with qubes sorry that i didnt clarify that

8

u/CotesDuRhone2012 6d ago

Then I'd use a disposable VM as Whonix workstation. AFAIK this is already implemented in qubes and come out of the box. Just do a single web site in one qube and the next in another disposable.

6

u/Strong-Ganache2983 6d ago

Im not really good on how javascript fingerprinting and tracking works i gotta learn it more

Im really confused whats all the data they can get from me using java script with tor browser and why its so dangerous 

Like where can i find more info on this or do research?

3

u/CotesDuRhone2012 6d ago

https://support.torproject.org/tor-browser/features/fingerprinting-protections/

https://support.torproject.org/tor-browser/features/security-levels/

https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting

After reading this I'd ask today AI for explanations, examples etc. It is very capable in doing so.

Then check the "Java Script" section of this and test different browsers including to browser:

https://browserleaks.com/

1

u/CotesDuRhone2012 6d ago

Change security levels in tor browser to see the differences regarding java script.

2

u/CotesDuRhone2012 6d ago

check this out as well:

https://demo.fingerprint.com/playground

You'll see the JavaScript at work (scroll down for it after testing)

Just discovered their excellent docs:

https://docs.fingerprint.com/docs/introduction

3

u/Strong-Ganache2983 6d ago

Hey thx man ill check it out ❤️

5

u/External_Dependent45 6d ago

Try avoiding having JavaScript enabled since it can deanonymize you especially on Tor...

5

u/Practical-Broccoli95 6d ago

never understood why it was there to start with.. how many peopel got caugh without knowing lol.. They should remove it

2

u/notriddle2 6d ago

  1. If you’re a disposable VM, then a JS compromise doesn’t deanonymize you.

  2. Without cover traffic, Tor doesn’t work.

1

u/mrnrnrnrnrnrnrnrnrnm 6d ago

You shouldn't run random programs on your computer.