Tor and cookie banners choices

Now that I’m using Tor should I keep paying attention to selecting the “Reject All” choice in most cookie banners (or “Only Essential Cookies”) or using Tor makes so hard tracking me that I can select something like “Accept All”?

I’m asking this because sometimes there are sites where you can just choose between paying a fare or accepting cookies, the “Reject All” or “Only Essential Cookies” don’t exist.

Ciao,
Max

Yes. You should keep paying attention to anything you do when using Tor. It is not a magical cloak of invisibility. :wink:

Tor provides networking anonymity - meaning it hides your IP-address. The browser contains things like browser fingerprinting resistance, ability to request a new identity, automatic cookie clearing when closing the browser,…) but won’t protect against OpSec mistakes like accepting tracking-cookies which could cross-identify sessions.

1 Like

What do you mean by “session”?

Tor Browser clears all your cookies when you restart it, so even if you click “Accept” on some GDPR compliance popup, restarting the browser will prevent them from identifying you as the same person across both sessions.

If you mean some other sort of session, like logging into a site with the same username and password, then, of course, they can tell you’re (probably) the same person both times.

2 Likes

This is the answer I was hoping for :slight_smile:

If Tor is able to protect you against tracking cookies why not in this circumstance too?

Let’s wait for NielD to expand on his/her reply as I’d like to understand his/her point too.

Ciao,
Max

Hi

I have the habit to by default reply “Yes” when a user asks if he should still be cautious and considerate when using the Tor Browser, to avoid creating a false sense of invincible anonymity - This resulted in my reply being incomplete, thanks for pointing this out.

Tor Browser clears all your cookies when you restart it

This is correct. Restarting Tor should result in a new identity, meaning that indeed all cookies are cleared.

What do you mean by “session”?

I did not mean a Tor Browser running “session” to clear the confusion. What I meant with “…like accepting tracking-cookies which could cross-identify sessions.” is that when you accept third-party cookies your session on Site A might be cross-linked with your session on Site B if both sites use the same tracker.

Here my reply lacked some completeness. The Tor Browser does block these kind of trackers by default, and includes mechanisms to protect against these cross-identifying attacks. So yes, by default it can be considered “safe” to accept all cookies in the Tor browser.

BUT the user could still reconfigure the browser to allow or whitelist tracking cookies - and that is still NOT safe even when using the Tor Browser.

My reply was technically not correct or complete (again, thanks for pointing this out). But I still firmly stand with my standpoint that any user should keep paying attention and apply the best OpSec habits as possible when using Tor - so being considerate and attentive about the general consequences of accepting all cookies, regardless in which browser, is still the way to go IMO.

The cookie banner that I have in mind is a part of the website, below the line of death. This means that nothing within Tor or the Browser itself knows about or enforces website authors to keep the promises made in those cookie banners. I can’t think of any harm in rejecting them, but I recommend planning for them to do nothing.

In other words, since we don’t trust the website author to protect our privacy (otherwise, why use Tor at all?), cookie banners are placebos.

This is an interesting PoV I didn’t consider, and I agree with you. Thanks!