Security Vulnerability in Tor Browser

Re:Security Vulnerability in Tor Browser by jraby3 on Wednesday May 25, 2022 @04:26PM (#31510064)

What about the Brave browser in a private window? That used Tor but theoretically also has some added protection because of the browser. I’d love to hear your thoughts.

[ Parent | on HN ]

Re:Security Vulnerability in Tor Browser by gzer0 on Wednesday May 25, 2022 @06:17PM (#31511407)

Brave browser has a notoriously bad history with their tor implementation. Would not trust [1].

Brave’s Tor mode, introduced in 2018, was sending requests for .onion domains to DNS resolvers, rather than private Tor nodes. A DNS resolver is a server that converts domain names into IP addresses. This means the .onion sites people searched for, with the understanding those searches would be private, were not. In fact, they could be observed by centralized internet service providers (ISPs).

[1] https://www.coindesk.com/tech/2021/02/22/brave-browser-was-e...

[ Parent | on HN ]

Re:Security Vulnerability in Tor Browser by encryptluks2 on Wednesday May 25, 2022 @04:30PM (#31510120)

Anything with JavaScript leaks. You can fingerprint a computer just based on Canvas.

[ Parent | on HN ]

Re:Security Vulnerability in Tor Browser by lucb1e on Wednesday May 25, 2022 @05:42PM (#31510975)

https://en.wikipedia.org/wiki/Canvas_fingerprinting#Mitigati...

> Tor Browser notifies the user of canvas read attempts and provides the option to return blank image data to prevent fingerprinting.

> Canvas Defender, a browser add-on, spoofs Canvas fingerprints.

> The LibreWolf browser project includes technology to block access to the HTML5 canvas by default

It doesn't seem to be the case that anything with javascript must leak canvas fingerprints.

Are you saying that Brave is unsafe because it has JS like every other browser on the planet or because it doesn't resist canvas fingerprinting specifically?

[ Parent | on HN ]

Re:Security Vulnerability in Tor Browser by encryptluks2 on Wednesday May 25, 2022 @11:20PM (#31514050)

I'm saying Brave doesn't do anything as far as I'm aware to stop fingerprinting, and since it is Chromium-based I'm guess also leaks Client Hints.

[ Parent | on HN ]

Re:Security Vulnerability in Tor Browser by lucb1e on Wednesday May 25, 2022 @05:47PM (#31511054)

Can't tell why this was downvoted, it sounds like a legitimate question and on-topic given that this is an alternative to the TBB which GP was recommending to avoid.

[ Parent | on HN ]

Re:Security Vulnerability in Tor Browser by goodpoint on Wednesday May 25, 2022 @07:10PM (#31512054)

Brave provides far less protection than Tor Browser

[ Parent | on HN ]