Hacker News Reader

Comment by subliminalpanda | Hacker News Reader

Are there any privacy concerns if ublock origin extension is used with the Tor browser?

Along with a number of other people I've been advocating bundling uBlock Origin by default in Tor Browser[1]. There were some fingerprinting and upstream support issues but most of these have been resolved, and some were philosophically opposed to including an ad blocker or breaking sites.

The main concern with adding uBlock Origin would be flipping bits that make your browser unique and stand out in the crowd. You can evaluate that risk based on your own operational profile.

[1] https://mailman.boum.org/pipermail/tails-dev/2016-January/01...

If fingerprinting is the primary concern then bundling should solve that, right?

Yep - get more people using the same setup and have a larger crowd to hide in.

Altho I think the new security slider in Tor Browser effectively breaks that crowd out into those groups plus any individual whitelisting the user allows

I think it should just default the settings to the highest security level, but understand the design requirement that many users use Tor as their primary browser so need video, JAR's etc.

I'm not an expert in the field, but my understanding is that you can be (partially?) fingerprinted based on the ads you (fail to) download. I also believe such partially discriminating information can be combined with other patterns (time at which you connect, sites visited, etc) to compromise your privacy.

I have no idea if this is problematic in practice, though.

Considering that Tor Browser users would also on the whole want to probably filter ads to improve their already slow latency, I'm hoping the Tor and µBlock devs can get together and standardise µBlock on all Tor Browsers with a preselected list of filters, which should reduce the ability to fingerprint by analysing the downloads of ads, at least within the set of all Tor Browser users.

There's actually a ticket up currently to do exactly that, integrate uBlock on the default Tor install.

https://trac.torproject.org/projects/tor/ticket/17569

> µBlock

Just 'uBlock Origin'. You are probably mixing up the names of µTorrent and uBlock Origin.

I, like Santosh83, remember seeing uBlock or uBlock Origin written with the µ. Can't find it on either of their Github sites now, though.

Nope. But I did mean uBlock Origin and instead hastily left out the "Origin" part of its name, which can lead to confusion with the uBlock extension maintained by another developer. Most people though seem to prefer uBlock Origin and that's what I use too. The spellings uBlock and µBlock seem to be used interchangeably on different pages and sites although undeniably uBlock seems by far the commoner variant.

The u in uBlock stands for micro (µ).

That makes logical sense, thanks.

How can anybody track which ads you failed to download? TOR browser has Noscript on by default, as far as I remember.

It's very easy to correlate UUID-stamped page load with no matching ad load on the backend, no script/flash support needed. If you have the most basic cookie support its even easier to correlate multiple ad blocks across numerous page loads, across sites.

Your traffic to websites goes trough a fixed "circuit" (that changes every few minutes). Within a circuit, the exit node sees all outbound connections you make, or don't make.

It's explained in "design philosophy" under point #5: https://www.torproject.org/projects/torbrowser/design/#philo...

Not necessary if you disable JS, which you absolutely should do if you care about privacy while using Tor.

Anything you do like this to "customize" the default Tor Browser install can reduce your privacy instead, as it provides a factor by which you can be fingerprinted and differentiated from the larger base of users using the Tor Browser as-is.

Source: see the Tor Browser docs on why they enable JS by default (though NoScript is installed and can be configured to block all JS, if you know the risks) https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...

There are any number of ways to deanonymize users once javascript is running, not to mention the greater possibility of escaping the sandbox. It's a damned if you do, damned if you don't scenario.

I know they're trying to serve users that can't be expected to play the whitelisting game, but they really should be stricter here. It's already trivial to differentiate a Tor user from a regular one, they might as well set the most secure defaults possible.

Reply on news.ycombinator.com