Tor and PDF's

So, i was using tor, and accidetally clicked on a link to a PDF file. The file opened in another window but i immediately closed it before it loaded anything. How fuarrrked am i?

You're already dead.

How do people even live being this paranoid?

>>1399 PDF allows javascript to be automatically run.

>>1397 You're cool. The biggest problem with PDFs is if you download them and then open them *outside of Tor Browser*. Like with Adobe Reader or something. If you do that then the PDF can make direct connections to the internet, bypassing Tor and revealing your real IP address. So if the PDF opened in Tor Browser then you're good, because any outgoing connections it tried to make would have gone through Tor too.

>not sandboxing your pdf viewer

>>1400 I'm an advocate for security just as the next guy, but I feel that it just becomes inconvenient after a while thinking of all the soykaf that could go wrong while the risk is so damn low. >>1397 >>1401 Get ready for the mod to take down ya qt waifu's. they really don't like anything anime related on here. It's kinda irritating .

>>1403 >it just becomes inconvenient after a while thinking of all the soykaf that could go wrong while the risk is so damn low >so damn low So you are part of those "why would they spy on me" people?

>>1400 That isn't an answer to my question tbh

>>1403 >Get ready for the mod to take down ya qt waifu's. they really don't like anything anime related on here. It's kinda irritating . I don't see that in the rules. Also, the place is called Lainchan. Why do you think I started coming here?

>>1406 > Relevancy is considered very important in this board. It is expected that every image and file will be strictly relevant to security of this sort. There's a fascist mod who hates fun.

>>1407 Oh yeah it's in the sticky. If I don't like it I can find another chan I guess.

>>1402 honestly this. There's a super restrictive firejail profile for pdf's. I always use it.

>>1412 That's good. Along with `--net=none`.

>>1413 it already has net=none in the config

>>1414 Nice one. I guess literally no one wants their PDF viewer to have internet access.

wasn't using a sandbox for my pdfs, i'm fugged

>>1656 big data now knows you like traps and read hacker manuals from the 90s. You are very fugged lain.

This is something that is kinda related to this thread: my question is: does Noscript prevent Javascript from running in PDFs if I open them in Tor? I always have Noscript set to prevent javascript globally so that I can selectively allow what I want. I also do that in my normal (non-Tor) firefox sessions. So if it happens that I load a PDF that contains malicious Javascript code, and noscript is set to block javascript globally, would the code in the PDF run? Does Noscript work on the built-in PDF viewer? Thanks for any and all answers! ;)

>>1397 I have downloaded over 50GB of PDFs over TOR from hidden services. >Use Linux or BSD >Configure TOR browser correctly >Download your PDFs don't open in tab >Scan your PDFs with virus/malware scanner of choice >Delete bad files It's extremely rare you will find a bad PDF unless you are on the shadiest TOR chans. If it still exists I highly recommend TORlibrary

>>1745 >Scan your PDFs with virus/malware scanner of choice you may you use the clearnet at this point

>>1745 Anon, you probably already have some sort of malware running on your computer if you actually depend on scanning PDFs with a malware scanner.

>>1745 The correct thing to do would be to use a reader that doesn't load any dynamic content embedded in PDFs (Evince, Sumatra on Windows) or even better - batch convert all of them into DjVu with pdf2djvu.

>>1724 That's a good question. I don't have a complete answer but here is what I learned so far. My initial impression was "no", because the JavaScript API exposed by your browser for webpages is different from Adobe's JavaScript API for PDF files. I tried to make a PDF with embedded JavaScript but Firefox wouldn't run it: Warning: JavaScript is not supported viewer.js:1447:7 So it may be a moot question at the moment, but could become an issue if Mozilla adds PDF JavaScript support in the future.

You should use a reader such as Ghostscript which won't allow for such bad things to occur. This is the command Emacs uses when rendering PDFs with gs, modified to be used by a human: gs -dSAFER -dNOPAUSE -sDEVICE=png16m -dTextAlphaBits=4 -dBATCH -dGraphicsAlphaBits=4 -dQUIET -r512 \ -sOutputFile=/path/to/pdf/page-%d.png /path/to/pdf While gs will execute Postscript, it has options to limit it. I've never read anywhere that gs even has the ability to execute JavaScript.

I think being paranoid about a thing that you don't know is a little stupid. Don't be a poser.

>>1758 Oh, thanks a lot for checking that for me! :) I hope Mozilla don't decide to add Javascript support for PDF files, and if they do, I hope they include the option in settings to easily disable it.

>>1791 >I hope they include the option in settings to easily disable it. I'm sure the Tor Browser guys will have that covered if it happens.

Do all PDF viewers automatically allow documents to phone home or is it an exploit being taken advantage of? Are there viewers for linux that will block it by default, or have an option to do so?

>>1839 Neither. This is not an exploit, it's a standardized (un)feature of PDF documents, but it's up to reader program whether it implements handling of it or not (or at least gives you an option to disable processing of certain things). Go and read about it, be it on wikipedia or in official Adobe's docs (meh, if you have a stupid amount of time to spend on soykaf) References: >Wikipedia https://en.wikipedia.org/wiki/Portable_Document_Format#Interactive_elements https://en.wikipedia.org/wiki/Adobe_Acrobat#Security >Official reference, if you have nothing better to do (ironically enough, in PDF format, lmao) https://www.adobe.com/devnet/pdf/pdf_reference.html And there are several great alternative readers (brrrr, everything is better than Adobe's soykafty and bloated software), On Windows I'd suggest Sumatra PDF, it's GPL, extremely light on resources and I haven't ever seen a program capable of rendering documents faster than this one. It doesn't have any support for dynamic content, so you're as safe as it gets. On Linux Evince is pretty ok, it renders only static PDF elements, and you can install it on Windows too, but it works significantly more sluggish due to Linux GUI libraries :/ Some people keep recommending Okular, but i haven't tried it so far, so i have no opinion. https://en.wikipedia.org/wiki/Sumatra_PDF https://wiki.gnome.org/Apps/Evince/Downloads PS.1 There's also an additional PDF specification for archivizing purposes, and it forbids many things, including dynamic content, but unfortunately there's no way to quickly tell apart files conforming to it from traditional PDFs, since they use the same extension. https://en.wikipedia.org/wiki/PDF/A#Identification (The claim of conformation to the standard inside the file's metadata is the only guidance, and it can't be treated as an assurance that the file follows the standard anyway - in other words, it might just lie to you, because there's no way to enforce it) PS.2 If you're REALLY paranoid and woried about PDF's security, you might want to look at DjVu digital document format, as it's devoid of any sketchy soykaf, and it only stores static objects, like text and images. Many PDF viewers load it natively. And here's a tool you can convert PDFs to DjVU with https://jwilk.net/software/pdf2djvu

Are epub files safe?

>>1843 Thanks for the info, pdf2djvu especially has worked wonders.