tor-tb-manual.git

1) <page xmlns="http://projectmallard.org/1.0/"
2)   type="topic"
3)   id="plugins">
4) 
5) <info>
6)   <desc>How Tor Browser handles browser plugins and add-ons</desc>
7)   <link type="guide" xref="index" group="#last" />
8) </info>
9) 
10) <title>Flash, JavaScript, and other add-ons</title>
11) 
12) <section id="flash">
13) <title>Flash Player</title>
14)  <p>
15)  Video websites, such as YouTube and Vimeo, make use of the
16)  Flash Player plugin to display video content. Unfortunately, this
17)  software operates independently of Tor Browser and cannot easily be
18)  made to obey Tor Browser’s proxy settings. It can therefore reveal your
19)  real location and IP address to the website operators, or to an outside
20)  observer. For this reason, Flash is disabled by default in Tor Browser,
21)  and enabling it is not recommended.
22)  </p>
23)  <p>
24)  Some video websites offer alternative video delivery methods that do
25)  not use Flash. These methods may be compatible with Tor Browser.
26)  </p>
27) </section>
28) 
29) <section id="javascript">
30) <title>JavaScript</title>
31) <p>
32) JavaScript is a programming language that websites use to offer
33) interactive elements such as video, animation, audio, and status
34) timelines. Unfortunately, JavaScript can also enable attacks on the
35) security of the browser, which might lead to deanonymization.
36) </p>
37)  
38) <p>
39) Tor Browser includes an add-on called NoScript, accessed through the
40) “S” icon at the top-left of the window, which allows you to control the
41) JavaScript that runs on individual web pages, or to block it entirely.
42) </p>

43) <p>
44) <media type="image" width="400" src="media/plugins/noscript_menu.png" />
45) </p>

46) <p>
47) Users who require a high degree of security in their web browsing should

48) set Tor Browser’s <link xref='security-slider'>Security Slider</link> to
49) “Medium-High” (which disables JavaScript for non-HTTPS websites) or “High”
50) (which does so for all websites). However, disabling JavaScript will
51) prevent many websites from displaying correctly, so Tor Browser’s default
52) setting is to allow all websites to run scripts.