The rating for protecting such systems is called High Robustness state-side. I’ll add that Tor is one of those applications where the main group trying to break it is nation states. I don’t know if EPICFAIL was an inside the NSA joke or a specific keyword/description. Compare this with standard web browsers, which, thanks to Flash, are trivial to rip apart. The NSA was justifiably proud to have a zero-day against it a couple years ago, while the FBI had to make do with an old vulnerability.

Tor Browser Bundle, by excluding everything but JavaScript, is a rather tough target.

Then there is tracking: it is trivial to extract a lot of information about “who is this person” if they fail to clear cookies: either just passively (by picking up advertising identifiers) or actively by injecting content which would cause the browser to spit out all traffic cookies to the exit node.įinally, there is exploitation. Thus its critical to use a browser configuration that includes HTTPS-everywhere, so that at least a lot of sites can’t be tampered with. To begin with, a significant fraction of Tor exit nodes are hostile: not just monitoring but actively modifying content. Everything else in NSA parlance is EPICFAIL. This is just a bad idea period: Tor for web browsing MUST only be done through the Tor Browser Bundle.

Tor browser for windows rt