Torbutton 1.2.0 adds several new security features to protect your anonymity from all the major threats we know about. The defaults should be fine (and safest!) for most people, but in case you are the tweaker type, or if you prefer to try to outsource some options to more flexible extensions, here is the complete list. (In an ideal world, these descriptions should all be tooltips in the extension itself, but Firefox bugs 45375 and 218223 currently prevent this.)
- Disable plugins on Tor Usage (crucial)
This option is key to Tor security. Plugins perform their own networking independent of the browser, and many plugins only partially obey even their own proxy settings.
- Isolate Dynamic Content to Tor State (crucial)
- Resize window dimensions to multiples of 50px on toggle (recommended)
To cut down on the amount of state available to fingerprint users uniquely, this pref causes windows to be resized to a multiple of 50 pixels on each side when Tor is enabled and pages are loaded.
- Disable Updates During Tor (recommended)
Under Firefox 2, many extension authors did not update their extensions from SSL-enabled websites. It is possible for malicious Tor nodes to hijack these extensions and replace them with malicious ones, or add malicious code to existing extensions. Since Firefox 3 now enforces encrypted and/or authenticated updates, this setting is no longer as important as it once was (though updates do leak information about which extensions you have, it is fairly infrequent).
- Disable Search Suggestions during Tor (optional)
This optional setting governs if you get Google search suggestions during Tor usage. Since no cookie is transmitted during search suggestions, this is a relatively benign behavior.
- Block Livemarks updates during Tor usage (recommended)
This setting causes Torbutton to disable your Live bookmark updates. Since most people use Live bookmarks for RSS feeds from their blog, their friends' blogs, the wikipedia page they edit, and other such things, these updates probably should not happen over Tor. This feature takes effect in Firefox 3.5 and above only.
- Block Tor/Non-Tor access to network from file:// urls (recommended)
These settings prevent local html documents from transmitting local files to arbitrary websites under Firefox 2. Since exit nodes can insert headers that force the browser to save arbitrary pages locally (and also inject script into arbitrary html files you save to disk via Tor), it is probably a good idea to leave this setting on.
- Close all Non-Tor/Tor windows and tabs on toggle (optional)
These two settings allow you to obtain a greater degree of assurance that after you toggle out of Tor, the pages are really gone and can't perform any extra network activity. Currently, there is no known way that pages can still perform activity after toggle, but these options exist as a backup measure just in case a flaw is discovered. They can also serve as a handy 'Boss Button' feature for clearing all Tor browsing off your screen in a hurry.
- Isolate access to history navigation to Tor state (crucial)
- Block History Reads during Tor (crucial)
Based on code contributed by Collin Jackson, when enabled and Tor is enabled, this setting prevents the rendering engine from knowing if certain links were visited. This mechanism defeats all document-based history disclosure attacks, including CSS-only attacks.
- Block History Reads during Non-Tor (recommended)
This setting accomplishes the same but for your Non-Tor activity.
- Block History Writes during Tor (recommended)
This setting prevents the rendering engine from recording visited URLs, and also disables download manager history. Note that if you allow writing of Tor history, it is recommended that you disable non-Tor history reads, since malicious websites you visit without Tor can query your history for .onion sites and other history recorded during Tor usage (such as Google queries).
- Block History Writes during Non-Tor (optional)
This setting also disables recording any history information during Non-Tor usage.
- Clear History During Tor Toggle (optional)
This is an alternate setting to use instead of (or in addition to) blocking history reads or writes.
- Block Password+Form saving during Tor/Non-Tor
These options govern if the browser writes your passwords and search submissions to disk for the given state.
- Block Tor disk cache and clear all cache on Tor Toggle
Since the browser cache can be leveraged to store unique identifiers, cache must not persist across Tor sessions. This option keeps the memory cache active during Tor usage for performance, but blocks disk access for caching.
- Block disk and memory cache during Tor
This setting entirely blocks the cache during Tor, but preserves it for Non-Tor usage.
- Clear Cookies on Tor Toggle
Fully clears all cookies on Tor toggle.
- Store Non-Tor cookies in a protected jar
This option stores your persistent Non-Tor cookies in a special cookie jar file, in case you wish to preserve some cookies. Based on code contributed by Collin Jackson. It is compatible with third party extensions that you use to manage your Non-Tor cookies. Your Tor cookies will be cleared on toggle, of course.
- Store both Non-Tor and Tor cookies in a protected jar (dangerous)
This option stores your persistent Tor and Non-Tor cookies separate cookie jar files. Note that it is a bad idea to keep Tor cookies around for any length of time, as they can be retrieved by exit nodes that inject spoofed forms into plaintext pages you fetch.
- Manage My Own Cookies (dangerous)
This setting allows you to manage your own cookies with an alternate extension, such as CookieCuller. Note that this is particularly dangerous, since malicious exit nodes can spoof document elements that appear to be from sites you have preserved cookies for (and can then do things like fetch your entire gmail inbox, even if you were not using gmail or visiting any google pages at the time!).
- Do not write Tor/Non-Tor cookies to disk
These settings prevent Firefox from writing any cookies to disk during the corresponding Tor state. If cookie jars are enabled, those jars will exist in memory only, and will be cleared when Firefox exits.
- Disable DOM Storage during Tor usage (crucial)
Firefox has recently added the ability to store additional state and identifiers in persistent tables, called DOM Storage. Obviously this can compromise your anonymity if stored content can be fetched across Tor-state.
- Clear HTTP auth sessions (recommended)
HTTP authentication credentials can be probed by exit nodes and used to both confirm that you visit a certain site that uses HTTP auth, and also impersonate you on this site.
- Clear cookies on Tor/Non-Tor shutdown
These settings install a shutdown handler to clear cookies on Tor and/or Non-Tor browser shutdown. It is independent of your Clear Private Data settings, and does in fact clear the corresponding cookie jars.
- Prevent session store from saving Tor-loaded tabs (recommended)
This option augments the session store to prevent it from writing out Tor-loaded tabs to disk. Unfortunately, this also disables your ability to undo closed tabs. The reason why this setting is recommended is because after a session crash, your browser will be in an undefined Tor state, and can potentially load a bunch of Tor tabs without Tor. The following option is another alternative to protect against this.
- On normal startup, set state to: Tor, Non-Tor, Shutdown State
This setting allows you to choose which Tor state you want the browser to start in normally: Tor, Non-Tor, or whatever state the browser shut down in.
- On crash recovery or session restored startup, restore via: Tor, Non-Tor
When Firefox crashes, the Tor state upon restart usually is completely random, and depending on your choice for the above option, may load a bunch of tabs in the wrong state. This setting allows you to choose which state the crashed session should always be restored in to.
- Prevent session store from saving Non-Tor/Tor-loaded tabs
These two settings allow you to control what the Firefox Session Store writes to disk. Since the session store state is used to automatically load websites after a crash or upgrade, it is advisable not to allow Tor tabs to be written to disk, or they may get loaded in Non-Tor after a crash (or the reverse, depending upon the crash recovery setting, of course).
- Set user agent during Tor usage (crucial)
- Spoof US English Browser
This option causes Firefox to send http headers as if it were an English browser. Useful for internationalized users.
- Don't send referrer during Tor Usage
This option disables the referrer header, preventing sites from determining where you came from to visit them. This can break some sites, however. Digg in particular seemed to be broken by this. A more streamlined, less intrusive version of this option should be available eventually. In the meantime, RefControl can provide this functionality via a default option of Forge.