tor-webwml.git

projects/en/torbutton-faq.wml    1) ## translation metadata

torbutton/en/torbutton-faq.wml   2) # Revision: $Revision$

projects/en/torbutton-faq.wml    3) # Translation-Priority: 3-low
projects/en/torbutton-faq.wml    4) 

torbutton/en/torbutton-faq.wml   5) #include "head.wmi" TITLE="Tor Project: Torbutton FAQ" CHARSET="UTF-8"

projects/en/torbutton-faq.wml    6) <div id="content" class="clearfix">
projects/en/torbutton-faq.wml    7) 	<div id="breadcrumbs">

projects/en/torbutton-faq.wml    8)     <a href="<page index>">Home &raquo; </a>

torbutton/en/torbutton-faq.wml   9)     <a href="<page torbutton/index>">Torbutton &raquo; </a>
torbutton/en/torbutton-faq.wml  10)     <a href="<page torbutton/torbutton-faq>">Torbutton FAQ</a>

projects/en/torbutton-faq.wml   11)   </div>
projects/en/torbutton-faq.wml   12) 	<div id="maincol">  
projects/en/torbutton-faq.wml   13)     <!-- PUT CONTENT AFTER THIS TAG -->
projects/en/torbutton-faq.wml   14)     
projects/en/torbutton-faq.wml   15)     <h2>Torbutton FAQ</h2>

torbutton/en/torbutton-faq.wml  16)     <hr>

projects/en/torbutton-faq.wml   17)     
projects/en/torbutton-faq.wml   18)     <h3>Questions</h3>

torbutton/en/torbutton-faq.wml  19)     <br>

projects/en/torbutton-faq.wml   20)     <ul>

torbutton/en/torbutton-faq.wml  21)     <li><a href="<page torbutton/torbutton-faq>#noflash">I can't view videos on YouTube and other flash-based sites. Why?</a></li>
torbutton/en/torbutton-faq.wml  22)     <li><a href="<page torbutton/torbutton-faq>#oldtorbutton">Torbutton sure seems to do a lot of things, some of which I find annoying. Can't I just use the old version?</a></li>
torbutton/en/torbutton-faq.wml  23)     <li><a href="<page torbutton/torbutton-faq>#noautocomplete">When I use Tor, Firefox is no longer filling in logins/search boxes for me. Why?</a></li>
torbutton/en/torbutton-faq.wml  24)     <li><a href="<page torbutton/torbutton-faq>#thunderbird">What about Thunderbird support? I see a page, but it is the wrong version?</a></li>
torbutton/en/torbutton-faq.wml  25)     <li><a href="<page torbutton/torbutton-faq>#extensionconflicts">Which Firefox extensions should I avoid using?</a></li>
torbutton/en/torbutton-faq.wml  26)     <li><a href="<page torbutton/torbutton-faq>#recommendedextensions">Which Firefox extensions do you recommend?</a></li>
torbutton/en/torbutton-faq.wml  27)     <li><a href="<page torbutton/torbutton-faq>#securityissues">Are there any other issues I should be concerned about?</a></li>

projects/en/torbutton-faq.wml   28)     </ul>

torbutton/en/torbutton-faq.wml  29)     <br>

projects/en/torbutton-faq.wml   30)     
projects/en/torbutton-faq.wml   31)     <a id="noflash"></a>
projects/en/torbutton-faq.wml   32)     <strong><a class="anchor" href="#noflash">I can't view videos on YouTube and
projects/en/torbutton-faq.wml   33)     other Flash-based sites. Why?</a></strong>
projects/en/torbutton-faq.wml   34)     
projects/en/torbutton-faq.wml   35)     <p>
projects/en/torbutton-faq.wml   36)     YouTube and similar sites require third party browser plugins such as Flash.
projects/en/torbutton-faq.wml   37)     Plugins operate independently from Firefox and can perform
projects/en/torbutton-faq.wml   38)     activity on your computer that ruins your anonymity. This includes
projects/en/torbutton-faq.wml   39)     but is not limited to: <a href="http://decloak.net">completely disregarding
projects/en/torbutton-faq.wml   40)     proxy settings</a>, querying your <a
projects/en/torbutton-faq.wml   41)     href="http://forums.sun.com/thread.jspa?threadID=5162138&amp;messageID=9618376">local
projects/en/torbutton-faq.wml   42)     IP address</a>, and <a
projects/en/torbutton-faq.wml   43)     href="http://epic.org/privacy/cookies/flash.html">storing their own

torbutton/en/torbutton-faq.wml  44)     cookies</a>. It is possible to use a LiveCD solution such as

torbutton/en/torbutton-faq.wml  45)     or <a href="https://tails.boum.org/">The Amnesic Incognito Live System</a> that creates a

projects/en/torbutton-faq.wml   46)     secure, transparent proxy to protect you from proxy bypass, however issues
projects/en/torbutton-faq.wml   47)     with local IP address discovery and Flash cookies still remain.  </p>
projects/en/torbutton-faq.wml   48)     
projects/en/torbutton-faq.wml   49)     <p>
projects/en/torbutton-faq.wml   50)     If you are not concerned about being tracked by these sites (and sites that
projects/en/torbutton-faq.wml   51)     try to unmask you by pretending to be them), and are unconcerned about your
projects/en/torbutton-faq.wml   52)     local censors potentially noticing you visit them, you can enable plugins by

torbutton/en/torbutton-faq.wml  53)     going into the Torbutton Preferences->Security Settings
torbutton/en/torbutton-faq.wml  54)     tab and unchecking "Disable browser plugins (such as Flash)" box. If you do this

torbutton/en/torbutton-faq.wml  55)     without The Amnesic Incognito Live System or appropriate firewall

torbutton/en/torbutton-faq.wml  56)     rules, we strongly suggest you at least use <a

projects/en/torbutton-faq.wml   57)     href="https://addons.mozilla.org/en-US/firefox/addon/722">NoScript</a> to <a
projects/en/torbutton-faq.wml   58)     href="http://noscript.net/features#contentblocking">block plugins</a>. You do
projects/en/torbutton-faq.wml   59)     not need to use the NoScript per-domain permissions if you check the <b>Apply
projects/en/torbutton-faq.wml   60)     these restrictions to trusted sites too</b> option under the NoScript Plugins
projects/en/torbutton-faq.wml   61)     preference tab. In fact, with this setting you can even have NoScript allow
projects/en/torbutton-faq.wml   62)     Javascript globally, but still block all plugins until you click on their
projects/en/torbutton-faq.wml   63)     placeholders in a page. We also recommend <a
projects/en/torbutton-faq.wml   64)     href="https://addons.mozilla.org/en-US/firefox/addon/6623">Better Privacy</a>
projects/en/torbutton-faq.wml   65)     in this case to help you clear your Flash cookies.
projects/en/torbutton-faq.wml   66)     </p>
projects/en/torbutton-faq.wml   67)     
projects/en/torbutton-faq.wml   68)     <a id="oldtorbutton"></a>
projects/en/torbutton-faq.wml   69)     <strong><a class="anchor" href="#oldtorbutton">Torbutton sure seems to do a lot of things, some of which I find
projects/en/torbutton-faq.wml   70)     annoying. Can't I just use the old version?</a></strong>
projects/en/torbutton-faq.wml   71)     
projects/en/torbutton-faq.wml   72)     <p>
projects/en/torbutton-faq.wml   73)     
projects/en/torbutton-faq.wml   74)     <b>No.</b> Use of the old version, or any other vanilla proxy changer
projects/en/torbutton-faq.wml   75)     (including FoxyProxy -- see below) without Torbutton is actively discouraged.
projects/en/torbutton-faq.wml   76)     Seriously. Using a vanilla proxy switcher by itself is so insecure that you are
projects/en/torbutton-faq.wml   77)     not only just wasting your time, you are also actually endangering yourself.
projects/en/torbutton-faq.wml   78)     <b>Simply do not use Tor</b> and you will have the same (and in some cases,
projects/en/torbutton-faq.wml   79)     better) security.  For more information on the types of attacks you are exposed
projects/en/torbutton-faq.wml   80)     to with a "homegrown" solution, please see <a

torbutton/en/torbutton-faq.wml  81)     href="design/index.html.en#adversary">The Torbutton

projects/en/torbutton-faq.wml   82)     Adversary Model</a>, in particular the <a

torbutton/en/torbutton-faq.wml  83)     href="design/index.html.en#attacks">Adversary

projects/en/torbutton-faq.wml   84)     Capabilities - Attacks</a> subsection. If there are any specific Torbutton
projects/en/torbutton-faq.wml   85)     behaviors that you do not like, please file a bug on <a

torbutton/en/torbutton-faq.wml  86)     href="https://trac.torproject.org/projects/tor/report/14">the

projects/en/torbutton-faq.wml   87)     bug tracker.</a> Most of Torbutton's security features can also be disabled via
projects/en/torbutton-faq.wml   88)     its preferences, if you think you have your own protection for those specific
projects/en/torbutton-faq.wml   89)     cases.
projects/en/torbutton-faq.wml   90)     
projects/en/torbutton-faq.wml   91)     </p>
projects/en/torbutton-faq.wml   92)     
projects/en/torbutton-faq.wml   93)     <a id="noautocomplete"></a>
projects/en/torbutton-faq.wml   94)     <strong><a class="anchor" href="#noautocomplete">When I use Tor, Firefox is no longer filling in logins/search boxes
projects/en/torbutton-faq.wml   95)     for me. Why?</a></strong>
projects/en/torbutton-faq.wml   96)     
projects/en/torbutton-faq.wml   97)     <p>
projects/en/torbutton-faq.wml   98)     Currently, this is tied to the "<b>Block history writes during Tor</b>"
projects/en/torbutton-faq.wml   99)     setting. If you have enabled that setting, all formfill functionality (both
projects/en/torbutton-faq.wml  100)     saving and reading) is disabled. If this bothers you, you can uncheck that
projects/en/torbutton-faq.wml  101)     option, but both history and forms will be saved. To prevent history
projects/en/torbutton-faq.wml  102)     disclosure attacks via Non-Tor usage, it is recommended you disable Non-Tor
projects/en/torbutton-faq.wml  103)     history reads if you allow history writing during Tor.
projects/en/torbutton-faq.wml  104)     </p>
projects/en/torbutton-faq.wml  105)     
projects/en/torbutton-faq.wml  106)     <a id="thunderbird"></a>
projects/en/torbutton-faq.wml  107)     <strong><a class="anchor" href="#thunderbird">What about Thunderbird support? I see a page, but it is the wrong
projects/en/torbutton-faq.wml  108)     version?</a></strong>
projects/en/torbutton-faq.wml  109)     
projects/en/torbutton-faq.wml  110)     <p>

torbutton/en/torbutton-faq.wml 111)     The Tor plugin for Thunderbird is called <a href="https://trac.torproject.org/projects/tor/wiki/torbirdy">
torbutton/en/torbutton-faq.wml 112)     TorBirdy</a>.

projects/en/torbutton-faq.wml  113)     </p>
projects/en/torbutton-faq.wml  114)     
projects/en/torbutton-faq.wml  115)     <a id="extensionconflicts"></a>
projects/en/torbutton-faq.wml  116)     <strong><a class="anchor" href="#extensionconflicts">Which Firefox extensions should I avoid using?</a></strong>
projects/en/torbutton-faq.wml  117)     
projects/en/torbutton-faq.wml  118)     <p>
projects/en/torbutton-faq.wml  119)     This is a tough one. There are thousands of Firefox extensions: making a
projects/en/torbutton-faq.wml  120)     complete list of ones that are bad for anonymity is near impossible. However,
projects/en/torbutton-faq.wml  121)     here are a few examples that should get you started as to what sorts of
projects/en/torbutton-faq.wml  122)     behavior are dangerous.
projects/en/torbutton-faq.wml  123)     </p>
projects/en/torbutton-faq.wml  124)     
projects/en/torbutton-faq.wml  125)     <ol>
projects/en/torbutton-faq.wml  126)      <li>StumbleUpon, et al
projects/en/torbutton-faq.wml  127)      <p>
projects/en/torbutton-faq.wml  128)      These extensions will send all sorts of information about the websites you
projects/en/torbutton-faq.wml  129)      visit to the stumbleupon servers, and correlate this information with a
projects/en/torbutton-faq.wml  130)      unique identifier. This is obviously terrible for your anonymity.
projects/en/torbutton-faq.wml  131)      More generally, any sort of extension that requires registration, or even
projects/en/torbutton-faq.wml  132)      extensions that provide information about websites you visit should be
projects/en/torbutton-faq.wml  133)      suspect.
projects/en/torbutton-faq.wml  134)      </p></li>
projects/en/torbutton-faq.wml  135)      <li>FoxyProxy
projects/en/torbutton-faq.wml  136)     <p>
projects/en/torbutton-faq.wml  137)     While FoxyProxy is a nice idea in theory, in practice it is impossible to
projects/en/torbutton-faq.wml  138)     configure securely for Tor usage without Torbutton. Like all vanilla third
projects/en/torbutton-faq.wml  139)     party proxy plugins, the main risks are <a

torbutton/en/torbutton-faq.wml 140)     href="http://www.decloak.net/">plugin leakage</a>

projects/en/torbutton-faq.wml  141)     and <a href="http://ha.ckers.org/weird/CSS-history.cgi">history
projects/en/torbutton-faq.wml  142)     disclosure</a>, followed closely by cookie theft by exit nodes and tracking by

torbutton/en/torbutton-faq.wml 143)     adservers (see the <a href="design/index.html.en#adversary">Torbutton Adversary

projects/en/torbutton-faq.wml  144)     Model</a> for more information). However, with Torbutton installed in tandem
projects/en/torbutton-faq.wml  145)     and always enabled, it is possible to configure FoxyProxy securely (though it
projects/en/torbutton-faq.wml  146)     is tricky). Since FoxyProxy's 'Patterns' mode only applies to specific urls,
projects/en/torbutton-faq.wml  147)     and not to an entire tab, setting FoxyProxy to only send specific sites
projects/en/torbutton-faq.wml  148)     through Tor will still allow adservers (whose hosts don't match your filters) to learn your real IP. Worse, when
projects/en/torbutton-faq.wml  149)     sites use offsite logging services such as Google Analytics, you will
projects/en/torbutton-faq.wml  150)     still end up in their logs with your real IP. Malicious exit nodes can also
projects/en/torbutton-faq.wml  151)     cooperate with sites to inject images into pages that bypass your filters.
projects/en/torbutton-faq.wml  152)     Setting FoxyProxy to only send certain URLs via Non-Tor is much more secure in
projects/en/torbutton-faq.wml  153)     this regard, but be very careful with the filters you allow. For example,
projects/en/torbutton-faq.wml  154)     something as simple as allowing *google* to go via Non-Tor will still cause you to end up
projects/en/torbutton-faq.wml  155)     in all the logs of all websites that use Google Analytics!  See
projects/en/torbutton-faq.wml  156)     <a href="http://foxyproxy.mozdev.org/faq.html#privacy-01">this question</a> on
projects/en/torbutton-faq.wml  157)     the FoxyProxy FAQ for more information.
projects/en/torbutton-faq.wml  158)      </p></li>
projects/en/torbutton-faq.wml  159)     </ol>
projects/en/torbutton-faq.wml  160)     
projects/en/torbutton-faq.wml  161)     <a id="recommendedextensions"></a>
projects/en/torbutton-faq.wml  162)     <strong><a class="anchor" href="#recommendedextensions">Which Firefox extensions do you recommend?</a></strong>
projects/en/torbutton-faq.wml  163)     <ol>
projects/en/torbutton-faq.wml  164)      <li><a href="https://addons.mozilla.org/firefox/addon/953">RefControl</a>
projects/en/torbutton-faq.wml  165)     	<p>
projects/en/torbutton-faq.wml  166)     Mentioned above, this extension allows more fine-grained referrer spoofing
projects/en/torbutton-faq.wml  167)     than Torbutton currently provides. It should break less sites than Torbutton's
projects/en/torbutton-faq.wml  168)     referrer spoofing option.</p></li>
projects/en/torbutton-faq.wml  169)     
projects/en/torbutton-faq.wml  170)      <li><a href="https://addons.mozilla.org/firefox/addon/1474">SafeCache</a>
projects/en/torbutton-faq.wml  171)     <p>
projects/en/torbutton-faq.wml  172)     If you use Tor excessively, and rarely disable it, you probably want to
projects/en/torbutton-faq.wml  173)     install this extension to minimize the ability of sites to store long term
projects/en/torbutton-faq.wml  174)     identifiers in your cache. This extension applies same origin policy to the
projects/en/torbutton-faq.wml  175)     cache, so that elements are retrieved from the cache only if they are fetched
projects/en/torbutton-faq.wml  176)     from a document in the same origin domain as the cached element.
projects/en/torbutton-faq.wml  177)     </p></li>
projects/en/torbutton-faq.wml  178)     
projects/en/torbutton-faq.wml  179)      <li><a href="https://addons.mozilla.org/en-US/firefox/addon/6623">Better
projects/en/torbutton-faq.wml  180)     Privacy</a>
projects/en/torbutton-faq.wml  181)      <p>
projects/en/torbutton-faq.wml  182)     
projects/en/torbutton-faq.wml  183)     Better Privacy is an excellent extension that protects you from cookies used
projects/en/torbutton-faq.wml  184)     by Flash applications, which often persist forever and are not clearable via
projects/en/torbutton-faq.wml  185)     normal Firefox "Private Data" clearing. Flash and all other plugins are
projects/en/torbutton-faq.wml  186)     disabled by Torbutton by default, but if you are interested in privacy, you
projects/en/torbutton-faq.wml  187)     may want this extension to allow you to inspect and automatically clear your
projects/en/torbutton-faq.wml  188)     Flash cookies for your Non-Tor usage.
projects/en/torbutton-faq.wml  189)     
projects/en/torbutton-faq.wml  190)      </p>
projects/en/torbutton-faq.wml  191)      </li>
projects/en/torbutton-faq.wml  192)      <li><a href="https://addons.mozilla.org/firefox/addon/1865">AdBlock Plus</a>
projects/en/torbutton-faq.wml  193)      <p>
projects/en/torbutton-faq.wml  194)     
projects/en/torbutton-faq.wml  195)     AdBlock Plus is an excellent addon for removing annoying, privacy-invading,
projects/en/torbutton-faq.wml  196)     and <a
projects/en/torbutton-faq.wml  197)     href="http://www.wired.com/techbiz/media/news/2007/11/doubleclick">malware-distributing</a>
projects/en/torbutton-faq.wml  198)     advertisements from the web. It provides
projects/en/torbutton-faq.wml  199)     <a href="http://adblockplus.org/en/subscriptions">subscriptions</a> that are
projects/en/torbutton-faq.wml  200)     continually updated to catch the latest efforts of ad networks to circumvent
projects/en/torbutton-faq.wml  201)     these filters. I recommend the EasyPrivacy+EasyList combination filter
projects/en/torbutton-faq.wml  202)     subscription in the Miscellaneous section of the subscriptions page.
projects/en/torbutton-faq.wml  203)     
projects/en/torbutton-faq.wml  204)      </p>
projects/en/torbutton-faq.wml  205)     </li> 
projects/en/torbutton-faq.wml  206)     <li><a href="https://addons.mozilla.org/firefox/addon/82">Cookie Culler</a>
projects/en/torbutton-faq.wml  207)      <p>
projects/en/torbutton-faq.wml  208)     
projects/en/torbutton-faq.wml  209)     Cookie Culler is a handy extension to give quick access to the cookie manager
projects/en/torbutton-faq.wml  210)     in Firefox. It also provides the ability to protect certain cookies from

torbutton/en/torbutton-faq.wml 211)     deletion, but unfortunately, this behavior does not integrate well with Torbutton.

projects/en/torbutton-faq.wml  212)     
projects/en/torbutton-faq.wml  213)      </p>
projects/en/torbutton-faq.wml  214)      </li>
projects/en/torbutton-faq.wml  215)     
projects/en/torbutton-faq.wml  216)      <li><a href="https://addons.mozilla.org/en-US/firefox/addon/722">NoScript</a>
projects/en/torbutton-faq.wml  217)      <p>
projects/en/torbutton-faq.wml  218)      Torbutton currently mitigates all known anonymity issues with Javascript.
projects/en/torbutton-faq.wml  219)      However, if you are concerned about Javascript exploits against your browser
projects/en/torbutton-faq.wml  220)      or against websites you are logged in to, you may want to use NoScript. It
projects/en/torbutton-faq.wml  221)      provides the ability to allow Javascript only for particular websites
projects/en/torbutton-faq.wml  222)      and also provides mechanisms to force HTTPS urls for sites with
projects/en/torbutton-faq.wml  223)     <a href="http://fscked.org/category/tags/insecurecookies">insecure
projects/en/torbutton-faq.wml  224)      cookies</a>.<br>
projects/en/torbutton-faq.wml  225)     
projects/en/torbutton-faq.wml  226)      It can be difficult to configure such that the most sites will work
projects/en/torbutton-faq.wml  227)      properly though. In particular, you want to make sure you do not remove
projects/en/torbutton-faq.wml  228)      the Javascript whitelist for
projects/en/torbutton-faq.wml  229)      addons.mozilla.org, as extensions are downloaded via http and verified by
projects/en/torbutton-faq.wml  230)      javascript from the https page.
projects/en/torbutton-faq.wml  231)     
projects/en/torbutton-faq.wml  232)      </p></li>
projects/en/torbutton-faq.wml  233)      <li><a href="https://addons.mozilla.org/en-US/firefox/addon/9727/">Request
projects/en/torbutton-faq.wml  234)     Policy</a>
projects/en/torbutton-faq.wml  235)      <p>
projects/en/torbutton-faq.wml  236)     
projects/en/torbutton-faq.wml  237)     Request Policy is similar to NoScript in that it requires that you configure
projects/en/torbutton-faq.wml  238)     which sites are allowed to load content from other domains. It can be very
projects/en/torbutton-faq.wml  239)     difficult for novice users to configure properly, but it does provide a good
projects/en/torbutton-faq.wml  240)     deal of protection against ads, injected content, and cross-site request
projects/en/torbutton-faq.wml  241)     forgery attacks.
projects/en/torbutton-faq.wml  242)     
projects/en/torbutton-faq.wml  243)      </p>
projects/en/torbutton-faq.wml  244)      </li>
projects/en/torbutton-faq.wml  245)     
projects/en/torbutton-faq.wml  246)     </ol>
projects/en/torbutton-faq.wml  247)     
projects/en/torbutton-faq.wml  248)     <a id="securityissues"></a>
projects/en/torbutton-faq.wml  249)     <strong><a class="anchor" href="#securityissues">Are there any other issues I should be concerned about?</a></strong>
projects/en/torbutton-faq.wml  250)     
projects/en/torbutton-faq.wml  251)     <p>
projects/en/torbutton-faq.wml  252)     There are a few known security issues with Torbutton (all of which are due to

torbutton/en/torbutton-faq.wml 253)     <a href="design/index.html.en#FirefoxBugs">unfixed