May 4, 2017 By Larry Loeb 2 min read

Dr. Neal Krawetz reported on his blog, The Hacker Factor, that he identified problems in the Tor browser that may be working against the anonymity network’s stated goals. These issues cause the browser to disclose information that could potentially allow threat actors to profile Tor users.

One Size Doesn’t Fit All

Krawetz looked beyond the user string information provided by the browser in routine communications. While this string information is the same in all Tor browsers to enhance privacy, he looked at other parameters that the browser shared with a site, including screen size, window size and scrollbar thickness. These factors can vary depending on the OS, but it’s possible to ascertain user patterns by observing them.

For example, a normal browser setting has a window size that is less than the size of the screen; but Tor sets them equal to each other as part of its security stratagem. If a browser communicant notes that the two parameters have equal value, it are more likely to infer that it is dealing with a Tor setup. Krawetz also noted that the macOS Tor browser miscalculates the window size because of the dock menu on the screen.

Additionally, the scrollbar size value is unique for each version of Tor. Bleeping Computer reported that there is a default scrollbar thickness in macOS of 15 pixels, while scrollbars are 17 pixels thick in Windows 7, 8 and 10. Linux can vary between 10 and 16 pixels.

Is the Tor Browser Really Anonymous?

In 1883, Auguste Kerckhoffs formulated six principles for his military cryptography theory. One aspect states that a system “must not rely upon secrecy, and it must be able to fall into the enemy’s hands without disadvantage.”

The principle has been widened in use throughout the security field and remains as relevant as ever. In cybersecurity parlance, making some part of a system obscure will not, in turn, make it secure. If just finding something can defeat the system, you have already lost, and your system is not as secure as you believed.

Krawetz identified patterns that could tell an attacker that Tor is being used for communication. Kerckhoff would likely say, “So what? I’m using Tor and you still can’t identify me.”

While Krawetz’s threat model can be productive, Tor was never truly designed to hide the fact that it was being used. Rather, it was developed to conceal individuals’ use patterns.

Even with these parameters invoked, each OS variant of the Tor browser should look like any other. Ultimately, the Tor browser will still function the way it is supposed to.

More from

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Can memory-safe programming languages kill 70% of security bugs?

3 min read - The Office of the National Cyber Director (ONCD) recently released a new report, “Back to the Building Blocks: A Path Toward Secure and Measurable Software." The report is one of the first major announcements from new ONCD director Harry Coker and makes a strong case for adopting memory-safe programming languages. This new focus stems from the goal of rebalancing the responsibility of cybersecurity and realigning incentives in favor of long-term cybersecurity investments. Memory-safe programming languages were also included as a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today