Skip to content
This repository has been archived by the owner on Feb 20, 2020. It is now read-only.

Change External File Advice Using Tor #179

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Change External File Advice Using Tor #179

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions encryption_works.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,8 +256,7 @@ Here are some further tips to enhance your security and privacy while using the

- Use Tor's new [Security Slider](https://blog.torproject.org/blog/tor-browser-45-released) feature. This allows you some control over your Tor experience based on your threat model. Generally speaking, we recommend setting it to "Medium-High."
- Be careful of unencrypted sites, ones which begin with "HTTP" rather than "HTTPS." Tor anonymizes your Internet traffic but unencrypted connections can still be eavesdropped on between the final node and the Internet server.
- Try to avoid downloading files such as PDFs or Microsoft Word
documents (which end in .doc or .docx), as they can be vehicles for malware that can be used by an attacker to de-anonymize your web browsing.
- Avoid downloading any files that you need an external app to open, as these can be vehicles for malware or can de-anonymize you. Tor Browser uses pdf.js, so you can anonymously view PDFs.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agree with @harlo - anonymously isn't the right word to use here. You're more concerned about potential malware (including malware that could de-anonymize you, yes, but really any kind of malware) so I'd say "securely" view PDF's would be a better word choice. Although given recent events, we should probably not tout pdf.js as a secure solution for viewing PDF's.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, "securely" is better phrasing, but I agree that PDF.js has had a rough summer. If we don't recommend PDF.js, however, we'll need to remove the recommendation not to use external apps.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should say "be careful" or "think twice" about downloads that require external apps. I'm not sure if it's realistic to say "don't open them", since that's kind of a big part of what the Internet is for. You should only download files like that from sites you trust that use HTTPS (to avoid exit node tampering).


These limitations are designed to keep Tor as secure as possible. They can get in the way of your regular browsing habits, and so you should keep another web browser around (with add-ons such as [HTTPS Everywhere](https://www.eff.org/https-everywhere)) for other browsing.

Expand Down