Can javascript be crippled so it cannot leak IP?

Ulysses_ · 03-29-2010, 08:10 AM

When using TOR it is recommended that you disable javascript and all other scripts because they can be used to detect your IP, defeating the purpose of TOR.

But there are some sites that simply do not work without javascript.

Is it possible to keep all javascript functionality but disable just the functionality that is used to leak your IP?

frieza · 03-29-2010, 11:41 AM

unfortunately javascript has nothing to do with identifying your ip, that information is sent with HTTP host headers otherwise the web server wouldn't have a clue as to where to send the reply, in short completely hiding your ip would make it impossible for the webserver to send a reply with the requested information, javascripts that use/show this information are simply getting the info from the HTTP host headers

http://www.php.net/manual/en/reserve...les.server.php
this information might be helpful

Ulysses_ · 03-29-2010, 12:25 PM

Then why does the TOR homepage strongly recommend disabling javascript among others?

unSpawn · 03-29-2010, 12:26 PM

Quote:

Originally Posted by frieza

javascripts that use/show this information are simply getting the info from the HTTP host headers

While not exactly Javascript check out the explanation in the implementation section of http://decloak.net/. There's more than just HTTP host headers.

unixfool · 03-29-2010, 01:23 PM

Quote:

Originally Posted by Ulysses_

Then why does the TOR homepage strongly recommend disabling javascript among others?

Because some aspects of javascript can be abused (in general), as any tool can be. I don't think javascript is your issue, though. You want to be hidden. You can only hide so much, IMO, but TOR or any proxy should provide the results you want. It won't hide IPs but will utilize an IP that makes it difficult to track YOU.

But, if you're afraid of javascript, use noscript.

Ulysses_ · 03-29-2010, 03:38 PM

I have noscript already. What if your ADSL router is at http://192.168.2.1 and javascript from a web page attempts to load that page up guessing the name and password, and log in to the router to look up the status page where the adsl ip is shown?

win32sux · 03-29-2010, 06:25 PM

Quote:

Originally Posted by Ulysses_

I have noscript already. What if your ADSL router is at http://192.168.2.1 and javascript from a web page attempts to load that page up guessing the name and password, and log in to the router to look up the status page where the adsl ip is shown?

FWIW, I would agree that it's completely insane to allow JavaScript (or any kind of executable content) when using Tor. The only exception would be if it's delivered via SSL (HTTPS) from a trusted site, which NoScript lets you specify. As for the attack scenario you've provided here as an example, the ABE component of NoScript would protect against that.

frieza · 03-29-2010, 06:51 PM

if you really wanna hide your IP of course there are various proxy sites out there that will allow you to browse websites via their internet connection to mask your ip address, not sure this is what you are looking for but its one way of remaining anonymous

win32sux · 03-29-2010, 07:54 PM

Quote:

Originally Posted by frieza

if you really wanna hide your IP of course there are various proxy sites out there that will allow you to browse websites via their internet connection to mask your ip address, not sure this is what you are looking for but its one way of remaining anonymous

frieza, he's already using Tor. The question he's asking is with regards to keeping the IP from being revealed by specially-crafted JavaScript, which resides on a completely different OSI layer.

win32sux · 03-29-2010, 10:18 PM

What are you guys' thoughts on filtering this sort of JavaScript on the Privoxy server itself? Could one isolate and strip out the specific JavaScript functions used to grab IP address info?

EDIT: Nevermind, this approach would suck because it wouldn't work when HTTPS is used.

This needs to be done in the browser itself to work right, AFAICT.

win32sux · 03-29-2010, 10:48 PM

If you run your browser in an virtual machine, wouldn't that automatically eliminate the IP address information available to any JavaScript, Java, Flash, etc. code regardless of their technique? It would seem to me like it should limit them to the IP address information of the VM guest, which you could make whatever you want. My bloodstream is running low on caffeine so please don't hesitate to smack me upside the head if there's something totally obvious which I've missed.

Ulysses_ · 03-30-2010, 06:30 PM

I am already using vmware virtual machines and have disabled all networking on the host, the virtual machine gets connected to the internet through a usb port to the adsl router. So it's just simulating a real computer connected to the adsl router with NAT. Even if javascript gets the ip as if it called ifconfig, it would still be the local ip, not the external ip, right?

unSpawn · 03-31-2010, 05:23 AM

Quote:

Originally Posted by Ulysses_

Even if javascript gets the ip as if it called ifconfig, it would still be the local ip, not the external ip, right?

Feel free to test it yourself and report back?

Ulysses_ · 03-31-2010, 02:26 PM

I do not know how to do that.

www.decloak.net does see my external IP as expected, presumably by means other than javascript.

www.decloak.net fails if you go through a free VPN like https://proxify.co.uk.