a great post that was published a few years ago on Matt Traudt’s blog with some tips for people using Tor and the Tor Browser.
it also addresses common misconceptions like disabling JS and using fingerprinting tests, which unfortunately I see floating around every other day on the internet.
@k_o_t@lemmy.ml @TheAnonymouseJoker@lemmy.ml can we get this thread pinned? i didn’t read it all but it looks like decent advice and the question about what’s tor and how to use it best comes up frequently
deleted by creator
I will start by saying that the author of the article was a tor researcher and dev so this gives some context on the content and me posting this.
may I ask why? I generally agree with the sentiment of the article but I don’t have a very strong opinion on this and maybe I’m missing something.
PS I don’t think the usual “I will end up in a list of people who use Tor” argument is a valid one.
I disagree with this, it’s simply overkill for 99% of the people with arguably no benefit at all. what’s there to gain?
deleted by creator
ironic how this is posted below an article that says that testing websites are not reliable and that you should not read into the results unless you understand them. I don’t think this is the case, sorry about being painfully honest but I don’t want people to freak out over tests instead of reading a well written article:
that’s simply not true. TB has further enhancement and code changes, it is based on ESR plus it’s not the same as a private window at all since private mode does not write to disk for example. most importantly tho: TB has crowd and the Tor network, that’s vital and a huge difference. a traffic analysis would also probably identify Firefox + uBO in medium mode vs TB. also, arkenfox does not try to make Firefox turn into TB, that’s clearly stated in the wiki and I would know as I am a repo admin :-)
usability, a browser with JS disabled by default is not a good everyday browser for most. the more people use Tor Browser daily and have a good experience with it, the larger the crowd gets.
I mean once you are subscribed, why would they want to fingerprint you? they already know who you are. when facebook operates as third party it will be isolated plus on a different circuit and with fingerprinting protection, plus (from arkenfox’s wiki):
if a fingerprinting script should run, it would need to be universal or widespread (i.e it uses the exact same canvas, audio and webgl tests among others - most aren’t), shared by a data broker (most aren’t), not be naive (most are) and not be just first party or used solely for bot detection and fraud prevention (most probably are)
I also don’t get what the difference between typing private stuff on facebook on tor or behind a vpn or on your ISP’s network is. however I must say that I still understand why from a “peace of mind” perspective it makes sense to keep stuff isolated, so as I said above mine is not really a strong opinion here.
sorry about typing a lot, but I figured this was valuable information to share, despite being nothing new.
deleted by creator
other than websites that return a score I argue that websites that return values are not of much value if you do not know how much entropy they carry (eg. are they the same for all the people on the same OS?) or how they are handled in the browser with various mitigations. it’s one thing to read a value, but it’s a whole different thing to understand if and how it can be used, leave alone against a specific tool.
everything is documented on TB’s official gitlab btw, people working on it know their stuff.
Firefox does not have the crowd that Tor Browser has, it does not have the Tor network, RFP is not enabled by default and users will make changes to their settings. even if Firefox has the larger user base there’s no argument for Firefox having a better crowd, sadly there’s no linear correlation in this case.
yes, you can harden it, but the crowd is so small that you will not defeat advanced scripts, nor you should expect to. hardened setups are also not equal as projects like arkenfox and librewolf are going to be tweaked by users post hardening (as they very much should).
this is opsec and it does not strictly apply to the tool you’re using so I don’t think it’s a valid argument for any of the points explained above.
as for the list you wrote:
“TB should cover all metrics” (I know you haven’t said it, I just didn’t know how to phrase it better lol) is not a safe assumption: not all metrics are equal, they do not all carry entropy nor they are all valuable fping methods. this brings us back to the initial part of this comment.
the rest of the stuff you discussed, like typing in the wrong tab etc, is mostly opsec and as I said I also value the added peace of mind, but it doesn’t make logins on Tor bad per-se. keyloggers are also a bit out of scope for this discussion imo.
tldr: TB covers enough metrics for most threat models even with JS on - naive scripts swallow the pill, advanced ones are defeated by the crowd, and don’t forget the network -, and the benefits of disabling JS are not that big.
ps thanks for getting back despite the lengthy comments, I added some edits for completeness on both sides of the discussion :-)
Sorry if way too OT, :( What torrent i2p client are you using? I don’t like the idea of vuze with a plugin, neither biglybt. I’m more inclined to something like rtorrent (ncurses, and if used with detached screen, then on any ssh session you can remotely monitor, without needing additional remote accesses or web publishing)…
deleted by creator
ohh, so I can use any torrent client (rtorrent for example), as long as I only use i2p sort of trackers, or so I understand from your post, and also from the wiki, perhaps specifying the binding address and port, or something like that…