On privacytests.org I noticed that in the “Tracking query parameter tests” and “Tracker content blocking tests” sections, Tor Browser does not offer protection against the following threats:
I guess due to Tor Browser having no form of ad blocker and I’m not sure if it blocks trackers either, it would probably be a risk of unnecessary censorship also as whoever they mark as a tracking service would be automatically blocked regardless of whether they actually are a tracking service. This gives some random people the ability to control what you do and don’t see.
No as they’re never truly tracking you but just your browsing session based off spoofed information which will have no association with your actual device or network. There is talk of Tor Browser getting uBlock Origin added in the future which will heavily reduce ads and trackers, plus they can audit what is and isn’t blocked.
TAILS OS already comes with uBlock Origin added so that could be a quick(ish) fix if you’re super uncomfortable about it though. Tails - Home
Following this, I think that the administrator of the PrivacyTests site should add a clarification, since it is very disconcerting to see that Tor, which is supposed to be the most secure anonymous browser, is displaced by Brave, LibreWolf and Mullvad in those sections about tracking services.
Site-specific or filter-based addons such as AdBlock Plus, Request Policy, Ghostery, Priv3, and Sharemenot are to be avoided. We believe that these addons do not add any real privacy to a proper implementation of the above privacy requirements, and that development efforts should be focused on general solutions that prevent tracking by all third parties, rather than a list of specific URLs or hosts.
Implementing filter-based blocking directly into the browser, such as done with Firefox’ Tracking Protection, does not alleviate the concerns mentioned in the previous paragraph. There is still just a list containing specific URLs and hosts which, in this case, are assembled by Disconnect and adapted by Mozilla.
Trying to resort to filter methods based on machine learning does not solve the problem either: they don’t provide a general solution to the tracking problem as they are working probabilistically. Even with a precision rate at 99% and a false positive rate at 0.1% trackers would be missed and sites would be wrongly blocked.
Filter-based solutions in general can also introduce strange breakage and cause usability nightmares. For instance, there is a trend to observe that websites start detecting filer extensions and block access to content on them. Coping with this fallout easily leads to just whitelisting the affected domains, hoping that this helps, defeating the purpose of the filter in the first place. Filters will also fail to do their job if an adversary simply registers a new domain or creates a new URL path. Worse still, the unique filter sets that each user creates or installs will provide a wealth of fingerprinting targets.
As a general matter, we are also generally opposed to shipping an always-on Ad blocker with Tor Browser. We feel that this would damage our credibility in terms of demonstrating that we are providing privacy through a sound design alone, as well as damage the acceptance of Tor users by sites that support themselves through advertising revenue.
Users are free to install these addons if they wish, but doing so is not recommended, as it will alter the browser request fingerprint.
They can try and track all they like, everything is isolated by first party and we sanitize everything on close (or it’s never written to disk to start with).
That said, there are benefits to uBO, as a content blocker not an “ad blocker”. The fastest code is no code. Less requests, faster page loads, less attack surface, etc (all a bit hand wavy with the tor network)
Tails ships with uBO, so does Mullvad Browser. We are looking at how to tighten up uBO in MB (fingerprinting: e.g. locking lists and maybe updates, and perhaps making changes session only - we haven’t decided yet), and then also add it to TB desktop. These things take time
No: recommending installation of browser extensions will change the browser fingerprint and reduce anonymity for Tor Browser users. The best approach is addressing the Mullvad Browser issue mentioned above, so that the hardened uBlock Origin can be easily ported to Tor Browser and allow Tails OS to utilize it as well, instead of maintaining their own uBlock Origin implementation.