-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ringo Kamens wrote: > 1. If I have multiple Firefox profiles, one of which is exclusively for > Tor use, if I use another profile with javascript later on, is that a > threat to the data stored in the other profiles? Can add-ons see > information in other profiles? I think that mozilla policies for accepting addons should not allow an extension to tamper with information stored in other profiles but I've to admit that I didn't read all of them :-P Generally speaking, if your javascript enabled profile is being exploited by a malicious site, well, there's nothing which will prevent the browser from reading any other files or directories on your disk.
> 2. If I'm doing my Tor browsing in one browser (say, Firefox) and open > up another one (say Ephiphany) that has javascript enabled, what risks > do I face? AFAIK javascript can see what's in your clipboard, which > would be bad if I'm using the clipboard with Torified content Is that it? yup, see above. > 3. One of the common criticisms of NoScript+Tor is that a malicious exit > node can pretend to be any site it wishes. What about enabling js on > file:// urls? If I understand them correctly, the browser won't make any > external requests and then there would be no threat of an attack. The only real threat scenario I could see is that a user donwloads a compressed file with html and js via Tor, unpacks it and browses its contents. Enabling file:// could allow any plugins/script/whatever to do nasty things(tm) but, frankly, it's quite absurd. In the past there were virus spreading via password protected zip attachments with the password written down in the mail, so the victim had to consciously open the file and run the executables, but I've still some hope in the average Tor user ;-) > 4. TorButton (wisely) disabled updates. Aside from the risk of an exit > node making you download it's own module, what other risks are there? > Does firefox submit any information that could identify you aside from > what plugins you use? AFAIK, only the download of crafted addons. But I'm also interested in the question. hope this helps, ciao - -- Marco Bonetti BT3 EeePC 70x enhancing module: http://sid77.slackware.it/bt3/ Slackintosh Linux Project Developer: http://workaround.ch/ Linux-live for powerpc: http://workaround.ch/pub/rsync/mb/linux-live/ My webstuff: http://sidbox.homelinux.org/ My GnuPG key id: 0x86A91047 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJX0+ayPKw+YapEEcRAs5qAJ4t7fSsIPe//qnjWNB+NPfsSHiYqwCglCUQ j2+vdWSR4DYjb+bv0K5t9jQ= =ObFM -----END PGP SIGNATURE-----
