It was at the Securedrop website. How did I end up there ? I read something about Sequoia and encryption and then wanted to see what Securedrop entailed.

Meanwhile I’ve raised the security settings. Still, today someone in this community (?) mentioned that Tor browser does not protect the remote to check for the OS, and now this. Color me surprised.

  • lemmyreader@lemmy.mlOP
    link
    fedilink
    English
    arrow-up
    2
    ·
    6 months ago

    Per default tor has a linux useragent. And I can’t seem to change it with the useragent switcher or with about config override. So yeah… even better.

    As far as I know Tor browser defaults to a Windows useragent string since years. Just double-checked by visiting a website I maintain and checked its web-server log files :

    “Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0”

    My results with LibreWolf are the same : also Windows. Plain Firefox shows the correct real OS Linux as useragent string.

    • Deckweiss@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      6 months ago

      How comes my useragent is Linux then? I just installed it fresh trom the arch official repos for the first time to test. Creepjs shows the useragent further down (not in this screenshot) and I visited other test sites as well.

      I’ll test it tomorrow by downloading it from the website.

      • lemmyreader@lemmy.mlOP
        link
        fedilink
        English
        arrow-up
        2
        ·
        6 months ago

        Here some proof of my claim that Tor browser useragent string is Windows : https://wiki.archlinux.org/title/Firefox/Privacy#Change_user_agent_and_platform

        Tip:

        The value Mozilla/5.0 (Windows NT 10.0; rv:102.0) Gecko/20100101 Firefox/102.0 is used as the user agent for the Tor browser, thus being very common.

        From five years ago, afaik suggesting Windows is the default : https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26146

        • Syn_Attck@lemmy.today
          link
          fedilink
          arrow-up
          1
          ·
          edit-2
          6 months ago

          Tor browser from the arch repos is not stock torbrowser. Add repos for torproject/guardian project/whatever it’s called now, or use the torproject.org installer.

          • lemmyreader@lemmy.mlOP
            link
            fedilink
            English
            arrow-up
            1
            ·
            6 months ago

            Are you saying that Arch Linux is providing Tor browser with a different useragent string ?

            • Syn_Attck@lemmy.today
              link
              fedilink
              arrow-up
              2
              ·
              edit-2
              6 months ago

              I believe that is the case, if you inspected the HTTP headers and found if to show Linux instead of Windows. my last experience with that would have been years ago. Arch does like to compile things from source instead of using binary blobs, and compilers and configs can undo a lot of the work the torproject has done to combat fingerprinting, which is why it’s recommended to run the pre-built binary and install no plugins. However it’s important to note that it ALSO gives you a unique JavaScript fingerprint every time, when tools use as much information as possible to generate a fingerprint, because it generates new information on every reload. That’s why OPSEC is important and for can’t help you if you use it wrong. If you login to 2 different unlinked sites in the same session, and you don’t want them to be linked, too bad now they’re linked via JS fingerprinting. JavaScript is more or less a programming language within the browser, and you’ll never escape JavaScript fingerprinting. Which is why it’s important to learn how to use tor properly, and leave JS disabled as much as you can.

              One thing you can do with your arch build is use the fingerprinting tool to see how unique you are, then get a new identity, then go back and do it again. Does it now say you’re one of 2 people who have used the tool, or does it show you’re (again) unique? If the latter, then it’s working (at least enough) properly.

              • lemmyreader@lemmy.mlOP
                link
                fedilink
                English
                arrow-up
                1
                ·
                6 months ago

                One thing you can do with your arch build is use the fingerprinting tool to see how unique you are, then get a new identity, then go back and do it again. Does it now say you’re one of 2 people who have used the tool, or does it show you’re (again) unique? If the latter, then it’s working (at least enough) properly.

                Interesting. I would have expected the useragent string to be part of the user configuration files that are automatically created in the browser profile directory. I’ve not used Tor browser package from Arch yet but curious to do some testing.

      • lemmyreader@lemmy.mlOP
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        6 months ago

        Edit. I see what you mean now. CreepJS indeed shows userAgent Linux. Weird. It got the amount of cores wrong btw.