Re:Tor 0day: Finding IP Addresses
by stealthbot on Thursday September 17, 2020 @01:05AM
(#24501371)
https://fingerprintjs.com/demo shows that Tor can still be fingerprinted and uniquely identified across IP addresses. Your Javascript (navigator) user-agent and timezone are some of the dead giveaways as they leak the true values.
[ Parent
| on HN ]
Tor will hide/obscure your true identity (i.e. the one that gets fingerprinted when you use a non-Tor-proxied browser) behind a separate, distinct "Tor identity"; but Tor makes no claim to be fit-for-purpose for obscuring/garbling the persistent aspects of said "Tor identity." (The Tor Project has this as a long-term goal, but they're nowhere near there yet.)
There's a "new Tor circuit for this site" button in the Tor Browser, but it's for circumventing dumb WAFs who've blacklisted a Tor exit node's IP. It's not for OPSEC.
> Javascript
Nobody who cares about doing anything secretive is using Tor with Javascript enabled. (Fun fact: most of the "dark web" stuff operates using early-2000s-era phpBB forum tech, which works perfectly fine without JS.)
5 minute exercise to try -
Download Tor https://www.torproject.org/download/
Go to your site, and see if you think it works - https://fingerprintjs.com/demo
(Also notice how Tor changes the screen size everytime you open it)
And javascript is disabled, the rest spoofed
TOR brosser != TOR
Re:Tor 0day: Finding IP Addresses
by stealthbot on Thursday September 17, 2020 @03:35AM
(#24502077)
yes the network is different than the browser, but the point is that IP based anonymity is already obsolete