There is some evidence that Tor users can be de-anonymized by US law enforcement agencies and academic researchers.

This means you are at risk of surveillance or malware injection via malicious exit nodes.

Your web traffic is fully decrypted and visible at the exit node, although it is not traceable to your identity.

Tor’s exit node can see your activity but not your IP address. Tor’s guard node can see your public IP address but not your activity.

While your browsing data is anonymous, it is not private.

This hides your IP address from the websites you visit and prevents your ISP (Internet Service Provider) from monitoring your activity.

Tor routes your web traffic through a network of randomized servers and protects it with three layers of encryption.

Disabling JavaScript causes many web sites to be unusable, thus it is enabled by default.Īs a best practice, one should disable JavaScript in the Tor browser and keep NoScript enabled for all sites, unless you have an extremely compelling reason not to. Many Tor users are not technically savvy, and JavaScript is commonly used with HTML5 in modern web sites. The only reason the Tor project allows JavaScript to be on by default in the Tor browser is usability.

JavaScript), then they may be hard pressed to find a viable exploit even if they have access to zero days etc. If the vectors for these zero-days are disabled (e.g. the FBI), they have access to zero-day exploits. In the case of a serious adversary like a state-backed entity (e.g. In general, enabling JavaScript opens the surface area for many more potential attacks against a web browser. You can read more about it in Ars Technica. This caused the computers to call back to an FBI server from their real, non-anonymized IP, leading to the deanonymization of various users. The FBI kept servers online, and then installed javascript paylods which exploited a zero-day exploit in Firefox.

The first major incident where this happened was with the 'Freedom Hosting' seizure by the FBI. There are a number of known vulnerabilities, that have been used, to deanonymize Tor users via leveraging JavaScript.

How to disable javascript in tor app