tor-webwml.git

1) ## translation metadata
2) # Revision: $Revision$
3) # Translation-Priority: 3-low
4) 
5) #include "head.wmi" TITLE="Torbutton FAQ"
6) 
7) <div class="main-column">
8) 
9) <!-- PUT CONTENT AFTER THIS TAG -->
10) 
11) <h2>Torbutton FAQ</h2>
12) <hr />
13) 

14) <strong>When I toggle Tor, my sites that use javascript stop working. Why?</strong>
15) 
16) <p>
17) Javascript can do things like wait until you have disabled Tor before trying
18) to contact its source site, thus revealing your IP address. As such, Torbutton
19) must disable Javascript, Meta-Refresh tags, and certain CSS behavior when Tor
20) state changes from the state that was used to load a given page. These features 
21) are re-enabled when Torbutton goes back into the state that was used to load
22) the page, but in some cases (particularly with Javascript and CSS) it is
23) sometimes not possible to fully recover from the resulting errors, and the
24) page is broken. Unfortunately, the only thing you can do (and still remain
25) safe from having your IP address leak) is to reload the page when you toggle
26) Tor, or just ensure you do all your work in a page before switching tor state.
27) </p>
28) 

29) <strong>I can't click on links or hit reload after I toggle Tor! Why?</strong>
30) 
31) <p>
32) Due to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737">Firefox
33) Bug 409737</a>, pages can still open popups and perform Javascript redirects
34) and history access after Tor has been toggled. These popups and redirects can
35) be blocked, but unfortunately they are indistinguishable from normal user
36) interactions with the page (such as clicking on links, opening them in new
37) tabs/windows, or using the history buttons), and so those are blocked as a
38) side effect. Once that Firefox bug is fixed, this degree of isolation will
39) become optional (for people who do not want to accidentally click on links and
40) give away information via referrers). A workaround is to right click on the
41) link, and open it in a new tab or window. The tab or window won't load
42) automatically, but you can hit enter in the URL bar, and it will begin
43) loading. Hitting enter in the URL bar will also reload the page without
44) clicking the reload button.
45) </p>
46) 

47) 

48) <strong>I can't view videos on YouTube and other flash-based sites. Why?</strong>

49) 
50) <p>
51) 

52) Plugins are binary blobs that get inserted into Firefox and can perform

53) arbitrary activity on your computer. This includes but is not limited to: <a
54) href="http://www.metasploit.com/research/projects/decloak/">completely
55) disregarding proxy settings</a>, querying your <a

56) href="http://forums.sun.com/thread.jspa?threadID=5162138&messageID=9618376">local

57) IP address</a>, and <a
58) href="http://epic.org/privacy/cookies/flash.html">storing their own
59) cookies</a>. It is possible to use a LiveCD or VMWare-based solution such as
60) <a href="http://anonymityanywhere.com/incognito/">Incognito</a> that creates a
61) secure, transparent proxy to protect you from proxy bypass, however issues
62) with local IP address discovery and Flash cookies potentially remain.
63) 
64) </p>
65) 
66) <strong>Torbutton sure seems to do a lot of things, some of which I find
67) annoying. Can't I just use the old version?</strong>
68) 
69) <p> 
70) 
71) <b>No.</b> Use of the old version, or any other vanilla proxy changer

72) (including FoxyProxy -- see below) without Torbutton is actively discouraged.
73) Seriously. Using a vanilla proxy switcher by itself is so insecure that you
74) are not only just wasting your time, you are also actually endangering
75) yourself. Simply do not use Tor and you will have the same (and in some cases,
76) better) security.  For more information on the types of attacks you are
77) exposed to with a "homegrown" solution, please see <a

78) href="https://www.torproject.org/torbutton/design/#adversary">The Torbutton

79) Adversary Model</a>, in particular the 
80) <a href="https://www.torproject.org/torbutton/design/#attacks">Adversary
81) Capabilities - Attacks</a> subsection. If there are any specific Torbutton
82) behaviors that you do not like, please file a bug on <a

83) href="https://bugs.torproject.org/flyspray/index.php?tasks=all&project=5">the
84) bug tracker.</a> Most of Torbutton's security features can also be disabled
85) via its preferences, if you think you have your own protection for those
86) specific cases.
87) 
88) </p>
89) 
90) 

91) <strong>My browser is in some weird state where nothing works right!</strong>
92) 
93) <p>
94) Try to disable Tor by clicking on the button, and then open a new window. If
95) that doesn't fix the issue, go to the preferences page and hit 'Restore
96) Defaults'. This should reset the extension and Firefox to a known good
97) configuration.  If you can manage to reproduce whatever issue gets your
98) Firefox wedged, please file details at <a
99) href="https://bugs.torproject.org/flyspray/index.php?tasks=all&amp;project=5">the
100) bug tracker</a>.
101) </p>
102) 
103) 
104) <strong>When I use Tor, Firefox is no longer filling in logins/search boxes
105) for me. Why?</strong>
106) 
107) <p>
108) Currently, this is tied to the "<b>Block history writes during Tor</b>"
109) setting. If you have enabled that setting, all formfill functionality (both
110) saving and reading) is disabled. If this bothers you, you can uncheck that
111) option, but both history and forms will be saved. To prevent history
112) disclosure attacks via Non-Tor usage, it is recommended you disable Non-Tor
113) history reads if you allow history writing during Tor.
114) </p>
115) 

116) <strong>What about Thunderbird support? I see a page, but it is the wrong
117) version?</strong>
118) 
119) <p>
120) Torbutton used to support basic proxy switching on Thunderbird back in the 1.0
121) days, but that support has been removed because it has not been analyzed for
122) security. My developer tools page on addons.mozilla.org clearly lists Firefox
123) support only, so I don't know why they didn't delete that Thunderbird listing.
124) I am not a Thunderbird user and unfortunately, I don't have time to analyze
125) the security issues involved with toggling proxy settings in that app. It
126) likely suffers from similar (but not identical) state and proxy leak issues
127) with html mail, embedded images, javascript, plugins and automatic network
128) access. My recommendation is to create a completely separate Thunderbird
129) profile for your Tor accounts and use that instead of trying to toggle proxy
130) settings. But if you really like to roll fast and loose with your IP, you
131) could try another proxy switcher like ProxyButton, SwitchProxy or FoxyProxy
132) (if any of those happen to support thunderbird).
133) </p>
134) 

135) <strong>Which Firefox extensions should I avoid using?</strong>
136) 
137) <p>
138) This is a tough one. There are thousands of Firefox extensions: making a
139) complete list of ones that are bad for anonymity is near impossible. However,
140) here are a few examples that should get you started as to what sorts of
141) behavior are dangerous.
142) </p>
143) 
144) <ol>

145)  <li>StumbleUpon, et al
146) 	<p>

147)  These extensions will send all sorts of information about the websites you
148)  visit to the stumbleupon servers, and correlate this information with a
149)  unique identifier. This is obviously terrible for your anonymity.
150)  More generally, any sort of extension that requires registration, or even
151)  extensions that provide information about websites you visit should be
152)  suspect.

153)  </p></li>

154)  <li>FoxyProxy
155) <p>

156) While FoxyProxy is a nice idea in theory, in practice it is impossible to
157) configure securely for Tor usage without Torbutton. Like all vanilla third
158) party proxy plugins, the main risks are <a
159) href="http://www.metasploit.com/research/projects/decloak/">plugin leakage</a>
160) and <a href="http://ha.ckers.org/weird/CSS-history.cgi">history
161) disclosure</a>, followed closely by cookie theft by exit nodes and tracking by
162) adservers (see the <a href="design/index.html#adversary">Torbutton Adversary

163) Model</a> for more information). However, with Torbutton installed in tandem
164) and always enabled, it is possible to configure FoxyProxy securely (though it
165) is tricky). Since FoxyProxy's 'Patterns' mode only applies to specific urls,
166) and not to an entire tab, setting FoxyProxy to only send specific sites
167) through Tor will still allow adservers (whose hosts don't match your filters) to learn your real IP. Worse, when
168) sites use offsite logging services such as Google Analytics, you will
169) still end up in their logs with your real IP. Malicious exit nodes can also
170) cooperate with sites to inject images into pages that bypass your filters.
171) Setting FoxyProxy to only send certain URLs via Non-Tor is much more secure in

172) this regard, but be very careful with the filters you allow. For example, 
173) something as simple as allowing *google* to go via Non-Tor will still cause you to end up

174) in all the logs of all websites that use Google Analytics!  See <a
175) href="http://foxyproxy.mozdev.org/faq.html#privacy-01">this question</a> on
176) the FoxyProxy FAQ for more information.

177)  </p></li>

178)  <li>NoScript
179)  <p>

180)  Torbutton currently mitigates all known anonymity issues with Javascript.
181)  While it may be tempting to get better security by disabling Javascript for
182)  certain sites, you are far better off with an all-or-nothing approach.
183)  NoScript is exceedingly complicated, and has many subtleties that can surprise
184)  even advanced users. For example, addons.mozilla.org verifies extension
185)  integrity via Javascript over https, but downloads them in the clear. Not 
186)  adding it to your whitelist effectively
187)  means you are pulling down unverified extensions. Worse still, using NoScript
188)  can actually disable protections that Torbutton itself provides via
189)  Javascript, yet still allow malicious exit nodes to compromise your
190)  anonymity via the default whitelist (which they can spoof to inject any script  they want). 

191) </p></li>

192) </ol>
193) 
194) <strong>Which Firefox extensions do you recommend?</strong>
195) <ol>

196)  <li><a href="https://crypto.stanford.edu/forcehttps/">ForceHTTPS</a>
197) 	<p>

198) Many sites on the Internet are <a
199) href="http://www.defcon.org/html/defcon-16/dc-16-speakers.html#Perry">sloppy
200) about their use of HTTPS</a> and secure
201) cookies. This addon can help you ensure that you always use HTTPS for sites
202) that support it, and reduces the chances of your cookies being stolen for

203) sites that do not secure them.</p></li>

204)  <li><a href="https://addons.mozilla.org/firefox/addon/953">RefControl</a>
205) 	<p>
206) Mentioned above, this extension allows more fine-grained referrer spoofing

207) than Torbutton currently provides. It should break less sites than Torbutton's

208) referrer spoofing option.</p></li>

209)  <li><a href="https://addons.mozilla.org/firefox/addon/1474">SafeCache</a>
210) 	<p>
211) If you use Tor excessively, and rarely disable it, you probably want to

212) install this extension to minimize the ability of sites to store long term
213) identifiers in your cache. This extension applies same origin policy to the
214) cache, so that elements are retrieved from the cache only if they are fetched
215) from a document in the same origin domain as the cached element. 

216) </p></li>

217) </ol>
218) 
219) <strong>Are there any other issues I should be concerned about?</strong>
220) 
221) <p>

222) There are a few known security issues with Torbutton (all of which are due to
223) <a href="https://www.torproject.org/torbutton/design/#FirefoxBugs">unfixed
224) Firefox security bugs</a>). The most important for anonymity is that it is