News for hackers. Stuff that matters.
Re:Tor 0day: Finding IP Addresses by stealthbot on Thursday September 17, 2020 @01:05AM (#24501371)
https://fingerprintjs.com/demo shows that Tor can still be fingerprinted and uniquely identified across IP addresses. Your Javascript (navigator) user-agent and timezone are some of the dead giveaways as they leak the true values.
Re:Tor 0day: Finding IP Addresses by derefr on Thursday September 17, 2020 @01:27AM (#24501488)
Tor will hide/obscure your true identity (i.e. the one that gets fingerprinted when you use a non-Tor-proxied browser) behind a separate, distinct "Tor identity"; but Tor makes no claim to be fit-for-purpose for obscuring/garbling the persistent aspects of said "Tor identity." (The Tor Project has this as a long-term goal, but they're nowhere near there yet.)

There's a "new Tor circuit for this site" button in the Tor Browser, but it's for circumventing dumb WAFs who've blacklisted a Tor exit node's IP. It's not for OPSEC.

> Javascript

Nobody who cares about doing anything secretive is using Tor with Javascript enabled. (Fun fact: most of the "dark web" stuff operates using early-2000s-era phpBB forum tech, which works perfectly fine without JS.)

Re:Tor 0day: Finding IP Addresses by aaron695 on Thursday September 17, 2020 @06:53AM (#24503094)
5 minute exercise to try -

Download Tor https://www.torproject.org/download/

Go to your site, and see if you think it works - https://fingerprintjs.com/demo

(Also notice how Tor changes the screen size everytime you open it)

Re:Tor 0day: Finding IP Addresses by c-c-c-c-c on Thursday September 17, 2020 @01:18AM (#24501447)
And javascript is disabled, the rest spoofed
Re:Tor 0day: Finding IP Addresses by aj3 on Thursday September 17, 2020 @01:50AM (#24501619)
TOR brosser != TOR
Re:Tor 0day: Finding IP Addresses by stealthbot on Thursday September 17, 2020 @03:35AM (#24502077)
yes the network is different than the browser, but the point is that IP based anonymity is already obsolete