Tor Browser Default Settings

Today I had to reinstall Tor Browser due to an issue with updating, as such the settings are now default. I noticed a couple strange things in the settings, and I believe these settings previously had different defaults. The option "check your spelling as you type" was checked. Noscript was configured to allow scripts and other things by default. See attached screenshot. Any clue on when these settings changed, and why? Can anyone confirm if Noscript's default settings have changed?

>>5923 >The option "check your spelling as you type" was checked. That sounds like a good idea to me, spelling errors could easily be used to single you out, especially if you're ESL.

>>5924 I suppose that's true. Spelling errors certainly are not the full extent of writing-style based de-anonymization, however. I've heard others express concern about spell-checkers being botnets, but I've never looked into the details.

I don't know off the top of my head about spellcheck, but I don't think Noscript has ever been active by default. TBB is supposed to be a drop in browser replacement that requires no research or training and Noscript beaks too many sites for that.

>>5925 spell checkers don't usually use the internet at all, they're just a database of words and a word-distance algorithm.

>>5923 I removed noscript and replaced it with umatrix installed ublock origin and user agent spoofer

>>5942 Does User Agent Spoofer still work on the current version? I thought it was a legacy extension.

>>5923 Mozilla's spell checker is offline and uses a small built-in dictionary. >Noscript was configured to allow scripts This is and always was a default, move security slider on highest position. You must have updated browser in non-traditional way, or it just bugged, version 60 ESR is extremely bugged as of lately.

Nigga, I installed umatrix, because NoScript is soykaf. If they want my fingerprint I'll stick it up their ass.

>>5944 i'm using Rndom Agent Switcher, which works on the new version of tor

>>5942 Your useragent is irrelevant when JavaScript can detect your OS and Browser without using it. Changing your UA would actually make you more unique because your JS "agent" and the Useragent wouldn't match. Unless the plugin you used takes that into account. https://www.w3schools.com/jsref/prop_nav_useragent.asp Click the "try it" to see that your UA is probably different to the other navigator properties. When using qutebrowser and a randomised UA (hardly secure, I know) the page showed my UA as "Windows" but the other navigator properties showed my actual OS and browser.

>>5975 >Your useragent is irrelevant when JavaScript can detect your OS and Browser without using it. You have a point but it's not completely irrelevant. Useragent is part of the http protocol, you need to send something, and whatever you send ends up in log files and packet traces. So it's important to look as normal as possible, which means pretending to be Windows. Javascript is at your discretion to run. I take you point about differences between say v8 and gecko, it would be pretty easy for javascript to figure out you put the wrong browser into useragent. Not sure about javascript detecting your OS though. Your other navigator properties example showed up all Windows/win32 for me even though I'm Tor Browser, Linux amd64.

>>5979 You don't need to send a useragent. Javascript can be used to portscan localhost among other things; if I'm not mistaken, some AV company got called out for that recently. So you could do some OS guesswork with it easily enough.

>>5983 Hacking the useragent header out of your http traffic is fine but turning off javascript or firewalling your browser is hard? >some AV company got called out for that recently What's an AV company doing running javascript in browsers?

>>5983 no user agent is extremely rare for web requests

>5991 It's an AV company, they do whatever the fuarrrk they want and call it security.

>>6026 AV is native code running at high privileges. It doesn't make sense that they need to play tricks with javascript. >>5983 >Javascript can be used to portscan localhost noscript prevents exactly that https://noscript.net/abe/ >among other things Such as?

>>6027 Companies do retarded soykaf all the time, maybe they bundled it as a browser extension or some soykaf to make it seem more kosher.

>>6027 inb4 kaspersky inb4 COMODO(Elaborate on your posts rather than just spilling the soykaf.)

Would someone maybe be so kind and consider helping my on a little problem I'm having? How do I set the default inner window size of the Tor browser? I have an unusual screen configuration and the tor browser has a ration I don't like.

https://lainchan.org/sec/src/1538567129251.png I'm using these add ons. If you want to join me, we will be less tracable. Already just a few people using this can make it very hard for people to track your traffic.

>>6115 that's basically what i'm using already. i suspect firefox+ublock origin+umatrix is becoming the new firefox+noscript+adblock plus. correct me if i'm wrong, but do the exact extensions really matter? from the server side, doesn't it just look like "javascript blocked" and "ads blocked"? do, for example, abp and ublock behave differently enough for hosts to be able to tell the difference between them?

>>6115 >Users should be using Tor Browser, not installing Torbutton themselves. https://www.torproject.org/docs/torbutton/

>>6217 I'm an idiot and didn't realize that these add-ons are included in TBB. Ignore me.

>>5926 I believe that years ago TBB had Noscript block all javascript by default, but it changed after the userbase of TBB changed to include more people. >We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if a website they want to use requires JavaScript, because they would not know how to allow a website to use JavaScript (or that enabling JavaScript might make a website work) https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled There is also a blurb about how whitelisting JS only from certain sites can be used to fingerprint you, although i think that the chance of that happening is much smaller than the chance that you'll come across malicious javascript.

To pay homage to this almost dead thread, I'll ask a question regarding the TBB. I've been using the TBB for a good amount of time and never had anything like this. I tried looking up what's going on, but I found no information about the removal of NoScript. After a few minutes it tried downloading NoScript and the message changed to the yellow-orange one. Could anyone explain to me what's going on? I've disabled Javascript in about:config, but NoScript and UBlock origin have a lot of additional security features.

>>7807 Here is the first screenshot

>>7807 I've found the issue

>>7809 about:config xpinstall.signatures.required - double click & set to false. May need to restart. Some plugins MAY need to be reenabled or reinstalled.

>>7810 That fixed it thx.

Bumping for update. The workaround with xpinstall.signatures.required in about:config is not necessary anymore, the tor project has issued an updated browser. As well, disabling xpinstall.signatures.required is NOT safe and should not be used as a workaround.

>>7818 Is the Tor project run by morons then? Why would they recommend something that isn't safe?

>>7823 are the users morons, why would they do something that isn't safe? if the tor project suggested this, i think it was mostly as a quick half-fix to get it running again till they patched the issue. that's a quite common operation

So long as you weren't installing add-ons while you had this disabled I think you'd be fine.

>>6217