Hacker News Reader

Comment by brymaster | Hacker News Reader

This wouldn't work at all for mainline Firefox, or at least wouldn't be 'secure' as users might be thinking.

One at least needs to have JavaScript disabled when on Tor or you'll easily be compromised and Firefox 23 now ships with JavaScript always-on.

http://boingboing.net/2013/08/04/anonymous-web-host-shut-dow...

View on HN

This was patched if you were using the latest Tor Browser Bundle at the time this exploit was attempted [1] . Vulnerabilities will always be disclosed, developers will always have to patch them. Automatic updating and deterministic builds [2] are the way to go.

[1] The version numbers are here https://blog.torproject.org/blog/new-tor-browser-bundles-and... Note: these version numbers were not vulnerable to the exploit, patched in June & note the day the exploitation took place (August)

[2] Background on deterministic builds and binary verification http://lwn.net/SubscriberLink/564263/1ab0ab93a900ecea/

Why is JavaScript an issue? In private mode no traces (like cookies) are permanent, so how can JavaScript be used against anonymity?

Of course, it increases the surface area of attack for exploits, but is there something else I'm missing?

It adds a great amount of fingerprintability.

Disabling javascript would probably add about the same amount of fingerprintability. Panopticlick says that 1 in 24000 browsers have the same fingerprint as TorBrowser.

There was a recent attack against TorBrowser that utilized a vulnerability in older versions of the Firefox Javascript engine. These sorts of vulnerabilities are not uncommon, so turning off JS significantly decreases the attack surface.

Here's a good example: https://news.ycombinator.com/item?id=6154246

Firefox 23 doesn't ship with JavaScript "always on".

It's on by default, as it always has been. And the option to turn it off was removed from the main options dialog. This is for sensible reasons -- many users turn it off either accidentally, or without understanding what it means ("this must be that insecure Java thing I keep hearing about") which breaks many websites.

But the 0.01% of people who like to browse without JS enabled can still do so via about:config -- look for "javascript.enabled". Or they can use an add-on. Or they can wait a version or two (I'm not sure the exact timeline) whereupon you'll be able to disable it via the developer tools UI.

> Firefox 23 doesn't ship with JavaScript "always on".

> It's on by default, as it always has been.

You're being overly pedantic and I'm sure you knew what I meant when I said it ships always-on.

Pedantry never hurt anybody. He's a Firefox developer, the clarifications are interesting.

> Pedantry never hurt anybody

Disagree.

> He's a Firefox developer, the clarifications are interesting

That's good. Then he ought to recall what's in the release notes for Firefox 23: http://www.mozilla.org/en-US/firefox/23.0/releasenotes/

> "Enable JavaScript" preference checkbox has been removed and user-set values will be reset to the default

How does pedantry hurt people?

TorBrowser ships with JavaScript on by default too.

Which in itself is ridiculous.

Would it be possible to make a subset of javascript that would maintain anonymity?

Reply on news.ycombinator.com