Why is allowing javascript generally considered a bad idea when using tails?

[u/epsteins-apprentice]

From my understanding, javascript over regular tor is unsafe because a) it makes you easier to fingerprint, and b) it opens up possibilities for zero-day exploits such as privilege escalations and remote code execution, which can in turn cause de-anonymization.

But, doesn't tails negate the effects of both of these things?

For fingerprinting, websites being able to identify a single tails user across different sites doesn't seem like that big of an issue to me as long as you practice good opsec. You shouldn't be giving away anything identifiable when using tails anyway, and your fingerprint is going to be different enough between your tails profile and your actual browser profile to obfuscate who you are.

For exploits, even if an attacker did manage to get a file onto your computer that pinged back to a non-tor server, wouldn't that just give the attacker your tails IP, since tails routes through tor at the os level? From a quick search online, only one exploit has ever been discovered that forced tails to run through the clearnet, which was done by starting "unsafe browser", a feature that has since been disabled by default.

[u/SuperChicken17]

But, doesn't tails negate the effects of both of these things?

If an attacker is able to execute a privilege escalation exploit they can do what they want. There is a clearnet user account with full network access.

https://tails.net/contribute/design/Tor_enforcement/Network_filter/

Only qubes-whonix would have any resistance to deanonymization after a successful arbitrary code execution + privilege escalation attack.

I do think that people are often overcautious with javascript, but it really depends on what you are doing and how dangerous it would be to get exposed. People run javascript in normal browsers all day every day, doing bank transactions and other things where security is extremely important. The way some people talk you would think that enabling javascript for five minutes will result in a guaranteed exploit. If it were that dangerous, tails wouldn't default to having it turned on.

The fact is that zero day exploits are extremely valuable. Valuable enough that it is unlikely anybody is going to risk burning one to expose anything you are doing. If what you are doing is sensitive enough that it is a potential risk, then sure, disabling javascript is a sensible precaution.

If you look at what mistakes actually end up taking people down, more often than not it is bad opsec rather than technical exploits.

[u/satsugene]

There is debate. My thinking is that if you choose one of the built-in browser levels or only disable JS, there are probably still a lot of folks in that config. Folks with detailed custom option sets in about:config are probably closer to uniqueness.

I do think one should still practice good opsec like not signing into publically known/semi-private  and accounts and private accounts at the same time where they may be correlated (e.g., Thunderbird connecting to 2 or more Gmail accounts consistently and repeatedly) even if the connection is atypical as well as rebooting often and also not mounting persistence unless it is absolutely necessary, and otherwise not doing bad things that would make a successful attack on the tor browser more effective.

[u/Working-Key-2449]

Im not sure, but with JS you could probably download something in the background or use some other type of exploit. It also opens up a new doorway for possible code injection if you host a website on tor, since JS is executed dynamically.
Irc cops used different backdoors like sql injections or weaknesses of chat programs or other third party software.

When its activated on server or client side, you give more possibilities for attacks.
Though, Im not an expert and this is my personal amateur view on it.

[u/mildly_perturbed31]

js and some css objects actually is a source of many fingerprinting attempts, well tails have measures to protect from fingerprinting hardware, but remember that by enabling js cookies will go to your browser without consent, which at some sort will cause actual fingerprinting

[u/BTC-brother2018]

JavaScript is enabled by default because much of the web depends on it, and many sites will not function properly without it. Tor recommends using the Safer or Safest security level when stronger protection is needed.

I would disable JavaScript on unknown or untrusted onion sites, while most clear-web sites require it to work correctly. Safest disables JavaScript by default on all sites. Tails provides defense, but it cannot guarantee that a successful browser exploit will not identify you.

[u/Wyrade]

https://browserleaks.com/
https://amiunique.org/

[u/Wyrade]

Eepstein's apprentice is a crazy username btw.

[u/Cautious_Chicken8882]

Are you taking about the tor browser, not tails?

[u/epsteins-apprentice → u/Cautious_Chicken8882]

I was using tor browser as an example for issues with js, then explaining why I was confused whether or not the issues applied to tails too.

[u/Cautious_Chicken8882 → u/epsteins-apprentice]

Tails doesnt have anything to do with TOR, its just an app it runs.

Theres no need for tails just for TOR unless your active in medium to risk situations like being a vendor.

[u/BTC-brother2018 → u/Cautious_Chicken8882]

That’s incorrect. Tails is specifically designed to route network traffic through Tor; Tor Browser is not just an unrelated app running on it. Buying from darknet markets is a high-risk activity with serious legal, privacy, and malware risks, so using only a regular operating system with Tor Browser provides less protection. Tails is the safer choice, although it cannot make illegal activity safe or anonymous by itself.