tor-webwml.git

@@ -63,38 +63,43 @@ clicking the reload button.

 </p>

 <a id="noflash"></a>

-<strong><a class="anchor" href="#noflash">I can't view videos on YouTube and other flash-based sites. Why?</a></strong>

+<strong><a class="anchor" href="#noflash">I can't view videos on YouTube and

+other Flash-based sites. Why?</a></strong>

 <p>

-Plugins are binary blobs that get inserted into Firefox and can perform

-arbitrary activity on your computer. This includes but is not limited to: <a

-href="http://www.metasploit.com/research/projects/decloak/">completely

-disregarding proxy settings</a>, querying your <a

+YouTube and similar sites require third party browser plugins such as Flash.

+Plugins operate independently from Firefox and can perform

+activity on your computer that ruins your anonymity. This includes

+but is not limited to: <a href="http://decloak.net">completely disregarding

+proxy settings</a>, querying your <a

 href="http://forums.sun.com/thread.jspa?threadID=5162138&messageID=9618376">local

 IP address</a>, and <a

 href="http://epic.org/privacy/cookies/flash.html">storing their own

 cookies</a>. It is possible to use a LiveCD or VMWare-based solution such as

-<a href="<page torvm/index>">Tor VM</a> or

-<a href="http://anonymityanywhere.com/incognito/">Incognito</a> that creates a

+<a href="<page torvm/index>">Tor VM</a> or <a

+href="http://anonymityanywhere.com/incognito/">Incognito</a> that creates a

 secure, transparent proxy to protect you from proxy bypass, however issues

-with local IP address discovery and Flash cookies potentially remain.

-</p>

+with local IP address discovery and Flash cookies still remain.  </p>

+

 <p>

-If you are not concerned about being tracked by these sites (and others that

+If you are not concerned about being tracked by these sites (and sites that

 try to unmask you by pretending to be them), and are unconcerned about your

-local censors noticing you visit them, you can enable plugins by going into

-the Torbutton Preferences->Security Settings->Dynamic Content tab and

-unchecking "Disable plugins during Tor usage" box. If you do this without

-Tor VM, Incognito or appropriate firewall rules, we strongly suggest you at

-least use <a

-href="https://addons.mozilla.org/en-US/firefox/addon/433">FlashBlock</a> or <a

-href="https://addons.mozilla.org/en-US/firefox/addon/722">NoScript</a> along

-with <a href="https://addons.mozilla.org/en-US/firefox/addon/6623">Better

-Privacy</a> to block unwanted plugins and their cookies. Neither of these are

-foolproof protection against proxy bypass and

-<a href="http://decloak.net/">unmasking</a>, but you will at least be better off.

+local censors potentially noticing you visit them, you can enable plugins by

+going into the Torbutton Preferences->Security Settings->Dynamic Content

+tab and unchecking "Disable plugins during Tor usage" box. If you do this

+without Tor VM, Incognito or appropriate firewall rules, we strongly suggest

+you at least use <a

+href="https://addons.mozilla.org/en-US/firefox/addon/722">NoScript</a> to <a

+href="http://noscript.net/features#contentblocking">block plugins</a>. You do

+not need to use the NoScript per-domain permissions if you check the <b>Apply

+these restrictions to trusted sites too</b> option under the NoScript Plugins

+preference tab. In fact, with this setting you can even have NoScript allow

+Javascript globally, but still block all plugins until you click on their

+placeholders in a page. We also recommend <a

+href="https://addons.mozilla.org/en-US/firefox/addon/6623">Better Privacy</a>

+in this case to help you clear your Flash cookies.

 </p>