Torhoo onion mirror : torhoocc3yugradvhrppml2fin4xob7kgg7uf42s4xk7p6r5vzy62ead.onion

Public reminder to spoof your tor browser's userAgent and set javascript off : OpSec | Torhoo darknet markets

With the recent updates to the 14.0 tor browser some system information can now be leaked to sites. You can read about the changes made here: https://torhoo.cc/go.php?u=YUhSMGNITTZMeTlpYkc5bkxuUnZjbkJ5YjJwbFkzUXViM0puTDI1bGR5MWhiSEJvWVMxeVpXeGxZWE5sTFhSdmNpMWljbTkzYzJWeUxURTBNR0UwTHc9PQ==#

While it makes sense if you are using tor to browse the internet with javascript on for compatibility sake, that isn't really the kind of crowd we have here. For privacy you want to make yourself look more like everyone else. Specifically if you are running more rare Oses. Thankfully they make it easy to change to how it worked before.

Open up a new tab. At the URL bar type in about:config. If a warning shows up accept it. Then at the top search for privacy.resistFingerprinting.spoofOsInUserAgentHeader and set it to true. You can check that it's working by going to https://torhoo.cc/go.php?u=YUhSMGNITTZMeTkzZDNjdWQyaGhkR2x6YlhsaWNtOTNjMlZ5TG1OdmJTOD0=# and seeing it say you are on windows 10.

At the same time in the about:config type in javascript.enabled and set it to false. This will disable javascript directly on your browser. Not only will it make it run faster but in the event that the noscript extention fails, you would still be protected.

If you have yet to do these two things, do them now. Harden your privacy and make your browsing just that little more private.

/u/HeadJanitor ۩ 𝓜𝓘𝓐 ۩

4 points

8 months ago

14.0 brought about MAJOR changes. Over 200 bugzilla issues.

Users of Windows 7, 8 and 8.1 and macOS 10.12, 10.13 and 10.14 will remain on Tor Browser 13.5 and not be able to implement 14.0

A lot of privacy, fingerprinting, spoofing and canvas issues went into this. I knew 14.0 was going to be big, I just didn't have the time to pinpoint out all it affects.

I had warned someone to warn someone else about drop for an old OS -- /u/newbieforever2018

/u/fohshizzle2

2 points

8 months ago

Since you are far more on the technical side than I am - any input from you regarding CVE-2024-9680 ?

/u/newbieforever2018 P "You've got ★bail★"

1 points

8 months ago

Yeah, he decided to just stay on telegram.

/u/DrCola111

1 points

8 months ago

Are you sure? I use the devices you mentioned and my tor browser shows 14.0 and the browser spoofing to windows 10 works..

/u/HeadJanitor ۩ 𝓜𝓘𝓐 ۩

1 points

8 months ago

The only possible ways your MAC address would ever make it out of your computer:

1) You go to your manufacturer's website and have their software auto-detect the drivers you need.
2) Connect to a public router where the router in-built switch communicates with it.

/u/BostonGeorge33

1 points

6 months ago

does it work the same if im using kali linux os? or is there another way i can do the about:config and Then at the top search for privacy.resistFingerprinting.spoofOsInUserAgentHeader and set it to true?
;

/u/BostonGeorge33

1 points

6 months ago

bc even with my tor browser privacy settings set to safest it still keeps popping up
Warning!

You have JavaScript enabled, you are putting yourself at risk!

Please disable it immediately!

and it just started doing this like day before yesterday

/u/Scrapple

3 points

8 months ago

Everybody say "THANK YOU PARIS"

Great job class

/u/0verdosed

2 points

8 months ago

weee weee thank you parieee

/u/cheshtor

2 points

8 months ago

[removed]

/u/Paris 📢 A ⎝⎝✧GͥOͣDͫ✧⎠⎠

2 points

8 months ago

If you turn it on, it uses the default tor browser userAgent. Without javascript it is near impossible to know which OS you are running except for this userAgent field. You will stick out more if you don't turn it on.

/u/snowonthabluff420

1 points

6 months ago

we're supposed to turn on 'userAgent field' in the about:config ? sorry the original comment was removed. thank you for this post btw. i hadn't done that yet and it was super cool seeing them guess my location and it being wrong. thank you.

/u/Paris 📢 A ⎝⎝✧GͥOͣDͫ✧⎠⎠

2 points

6 months ago

You want privacy.resistFingerprinting.spoofOsInUserAgentHeader to be set to true. So you look like the majority of the user base. Specifically if you are on linux based operating systems.

/u/snowonthabluff420

1 points

6 months ago

perfect! i did that. thank you so much!

/u/snowonthabluff420

1 points

6 months ago

do you know if we can save those settings? or is this something we do manually everytime? thanks for all your help!

/u/Paris 📢 A ⎝⎝✧GͥOͣDͫ✧⎠⎠

2 points

6 months ago

Depends on the OS. If you are using Tails you will need to set it every time but if you are using other stateful OSes you can just set it and forget it.

/u/snowonthabluff420

1 points

6 months ago*

thank you so much! I had legit just made my first purchase, my computer died, i log back in and come on dread with the 'safest' setting enabled and then dread is giving me that 'java script is enabled, you are putting yourself at risk' warning and i was like wtf??? lol what did i do wrong? but i went to about:config and saw java script was turned on even though i had safest setting enabled. i had never gotten that message before while having safest setting enabed on tor browser(hadn't done about:config javascript.enabled false ever before) only used safest setting on tails. but i saw this post, manually disabled it and spoofed my user agent, and then made my purchase. after my computer died and i turned it back on, for some reason it's telling me that java script is enabled and im putting myself at risk. I wonder if it's bc i had manually turned it off for the first time before? then when i turned my computer back on, i got on dread without manually disabling it and maybe thats why i was getting the java script warning? idk. but had never gotten that warning w only safest setting enabled. then i manually disable it, and next time i boot up, it's saying its enabled. so i go to about:config and sure enough, it's enabled and my spoof is off. so that makes sense since tails is an amnesiac. i'm just wondering why of all times aka right after i made my first purchase, i get the message about java script lol im hoping it was a way dread was letting me know that it was still enabled even tho safest setting was on. hopefully im all good. sorry for the long message, just got a lil anxiety and trying to explain best i can. but i am glad i saw this post before making my first purchase. bc it would have only been made with safe setting enabled. but i turned off java script as a whole and spoofed my user agent just in time before i did thanks to this post! :) you're awesome!

/u/GothamAdmin

2 points

8 months ago

Thanks for the updated warning and info.This would help a lot.

/u/KyleKlemons54

2 points

8 months ago

I already have done that with my browser, keep the Javascript and WebGl off pretty much permanently and consistently.

/u/DrCola111

2 points

8 months ago

privacy.resistFingerprinting.spoofOsInUserAgentHeader - is amazing, why it's not True on default? Before it showed Tor? Cool update. Great post Paris.

/u/fohshizzle2

1 points

8 months ago*

Do not listen to that man.

This is the Darknet.

The Wild West of our era.

The second after we start our TOR-horse we maximize that window (YOU BOUGHT THAT GPU/CPU FOR A REASON AND GOD FORBID THOSE COMMIES TAKE THAT AWAY FROM YOU) and pay for those contract killings in good old Bitcoin.

/u/ASTRALFOX

2 points

8 months ago

[removed]

/u/b1ankface P 🌿🚬(. 人 .)🍹

1 points

8 months ago

im niggas

/u/Exoduz P

2 points

8 months ago

me niggas

/u/Kwik-go

1 points

8 months ago

Who's that peeking in my window......POW nobody now!!

/u/miner21 P

1 points

8 months ago

I did this. I am still getting an error to the hidden answers website (IDK who is all familiar with it) I cant figure out why that one site thinks I have JS on

/u/Therealsaint

1 points

8 months ago

That site is a scam along with every single site promoted on it, dont buy from astaricon, bnw, ccppshop, or any other site that you see people posting good reviews about they are all fake

/u/miner21 P

1 points

8 months ago

I thought hidden answers was only a forum type site?

/u/Therealsaint

1 points

8 months ago

I mean it is but im sure you see all the bs reviews and links to sites on there

/u/miner21 P

1 points

8 months ago

Yeah thats true. Oh well. Its gone for me

/u/lleon

1 points

8 months ago

good to know, thanks paris

/u/Don_Morpheus

1 points

8 months ago

Thank you. Really helpful information :)

/u/Netwerk P

1 points

8 months ago*

[removed]

/u/Paris 📢 A ⎝⎝✧GͥOͣDͫ✧⎠⎠

1 points

8 months ago

It's for JavaScript compatibility sake as different OSes have different feature-sets and limitations. Some sites change that depending on the user agent. Being that nobody here should be using javascript this change hurts our privacy as it makes individual's userAgent's correspond to their specific OS.

/u/duracelltheta

1 points

8 months ago

Thank you /u/Paris. This is a useful reminder.

/u/terrynutkins

1 points

8 months ago

privacy.resistFingerprinting.spoofOsInUserAgentHeader and set it to true - The Tor site states that this is the default config for 14.0, are you suggesting we should be using it for version prior to 14.0?

/u/Paris 📢 A ⎝⎝✧GͥOͣDͫ✧⎠⎠

1 points

8 months ago

They only made the changes on the 14.0 branch so no you don't need to do so. The default behavior was always to spoof the user agent they changed it in the latest version for JavaScript compatibility sake.

/u/FCP

1 points

8 months ago

many thx

/u/frankmurr

1 points

8 months ago

To be clear, we want whatsmybrowser to say windows 10?

/u/Paris 📢 A ⎝⎝✧GͥOͣDͫ✧⎠⎠

2 points

8 months ago

Yes. That's the current default.

/u/heavyweaponsguy

1 points

8 months ago

IF YOU NEED TO DO THIS IN QUBES WHONIX WS DVMs, see /post/fe43bc1f9409a1749a2c and add "lockPref("privacy.resistFingerprinting.spoofOsInUserAgentHeader", true);" as a tor browser default.

/u/samxaxyy

1 points

8 months ago

weeeeeee

/u/[deleted]

1 points

8 months ago

Paris is using https://torhoo.cc/go.php?u=YUhSMGNITTZMeTkzZDNjdWQyaGhkR2x6YlhsaWNtOTNjMlZ5TG1OdmJTOD0=# DOXXED

/u/MuhammahuM

1 points

8 months ago

Thank you

/u/JaM3iu

1 points

8 months ago

Tysm

But why did they disabled the OS spoofing by default?
Now I and all the other bsd users need to change it or else it's a major vuln

/u/dread1972

1 points

8 months ago

privacy.resistFingerprinting.spoofOsInUserAgentHeader setting it to true or flase showed the same results W10, FF115!

/u/omnimous

1 points

8 months ago

I understand why this configuration is preferred but that actually makes you more unique?
Isn't part of the goal consist to be part of the mass?
The recommendation to completely disable javascript and not rely only on blockscript totally makes sense.
Thank you for sharing

/u/Paris 📢 A ⎝⎝✧GͥOͣDͫ✧⎠⎠

1 points

8 months ago

It's only really valuable to people who are using non-windows systems. If you are on windows the agent is the same. As the majority of tor browser users are windows users making your browser look like them makes you less unique.

/u/omnimous

1 points

8 months ago

Thank for the clarifying and sharing these tips.

/u/harmreduction

1 points

8 months ago

not worning on anroid. Any idea?

/u/HeadJanitor ۩ 𝓜𝓘𝓐 ۩

1 points

8 months ago

I feel honored having /u/Paris post at /d/OpSec.

Because I've tried this a TON of times using both clearnet and Tor, different sites are not always accurate.

(Especially if you are behind a Virtual Machine.)

If you go to "Bibles, Guides and Tools" you will find MANY sites like this one. Try them all!

Some are accurate, some are wildly inaccurate.

P.S. The common belief is that your IP is the holy grail. Your DNS tells more about you than your IP. I can change my IP all day long.

/u/thedarknetprince27

1 points

8 months ago

Is there a way to make these settings persistent in tails?

/u/sakchaser

1 points

8 months ago

I've checked due to your reminder 5 days prior, If my java script is still set to false and it was. Today I received a warning from dread stating my java script is enabled and I'm putting myself at risk - just rechecked, still set to false.

Thought that's strange - does dread sometimes have this bug?

/u/Paris 📢 A ⎝⎝✧GͥOͣDͫ✧⎠⎠

2 points

8 months ago

/d/Dread/wiki?id=0f0519ab

Question: I have javascript off but a popup for javascript shows momentarily on page load, why is this?

Dread has no javascript code at all for good reason. Nearly all game ending exploits for firefox (which is what The Tor Browser is build upon) has used javascript to either do the attack or facilitate the logic behind the exploit. It is very important that when you are on the darknet never to turn on javascript. You never quite know what is lurking around.

The popup appears in The Tor Browser due to the way it handles noscript tags during page loading. On slower internet connections, the page may load in parts, causing a delay in processing the CSS used to hide the popup within the noscript block. This delay results in a brief javascript flash.

To fix this you can turn off javascript engine wide on The Tor Browser by going to "about:config" in your URL bar, accepting the warning, searching for javascript, and turning javascript.enabled to false. This will turn off javascript engine wide and not rely on noscript to do it's job properly (which has failed before in some cases). This no only will make you safer in the long run but cause that popup to disappear forever. Check this post for more information: /post/8406d297c71d058f1f4e

/u/decaptchamyass

1 points

8 months ago

Firefox ESR*. I wish they had chosen chromium instead. Firefox has poor sandboxing, lacks any kind of modern site isolation and exploit mitigations.

/u/sakchaser

1 points

8 months ago

Just checked, my tor browser security is set to safest. Does this might indicate noscript is currently sliently running java script?

/u/lightfox

1 points

8 months ago

@DreadfulParis hi bro its LightFox come to dark forest bro :-) want to have a chat about your chat . i think we can do a better job . chat up and running in a matter of days .

/u/catman385

1 points

8 months ago

do I need to enable a setting in my persistent storage, so that once I restart my computer those settings are still enabled?

/u/paris /u/headjanitor

/u/HeadJanitor ۩ 𝓜𝓘𝓐 ۩

1 points

8 months ago

No, /u/catman385. These settings don't have to do with your computer but with the Tor browser. Think of it like this, when the update took place, you lost the "good" settings and now you have to manually bring them back. In this case, because that was a big upgrade. Small upgrades don't impact the browser like that. And also it was a decision.

But, one thing you should get in the habit of doing after each upgrade or even casually is type in

about:config

then type java

you should visually see

JavaScript: enabled ----------------> FALSE

/u/catman385

1 points

8 months ago

Okay thanks for everything you do. i think thats what i did wrong was enable those settings, then updated to the newest tails..

/u/HeadJanitor ۩ 𝓜𝓘𝓐 ۩

1 points

8 months ago

No problem. Routine do a visual check after each update.

/u/catman385

1 points

8 months ago

/u/headjanitor I am on the newest tails (6.1) and whenever I reboot those settings go away, especially the javascript being enable again, even after settings the about:config to false... Any ideas

/u/HeadJanitor ۩ 𝓜𝓘𝓐 ۩

1 points

7 months ago

Tails does not retain Tor settings because it is an Amnesiac. It is designed to forget everything. I highly recommend you use Whonix as it is so much easier. The whole setup will take minutes.

But if you want to continue with Tails, you would have to enable persistent storage, make all the changes in Tor as you want them to be, close Tor.

Open terminal. And run this:

cd /live/persistence/TailsData_unlocked/dotfiles
mkdir .tor-browser
mkdir .tor-browser/profile.default
cp ~/.tor-browser/profile.default/prefs.js .tor-browser/profile.default/
chmod 640 .tor-browser/profile.default/prefs.js

Reboot Tails, unlock your persistent storage and start the system so we can make sure it works.

Prior to saving prefs.js, here are the steps to "Creating the Persistent Storage".
https://tails.net/doc/persistent_storage/create/index.en.html

But I very much encourage you to switch over to Whonix. I think Whonix is so much easier than Tails.

/u/manyflowers122

1 points

7 months ago

interesting, but whonix is for advanced users right? is it complicated to set it up?

/u/HeadJanitor ۩ 𝓜𝓘𝓐 ۩

1 points

7 months ago

To me: if I know anything about Linux, Whonix is easier than Tails.

/u/catman385

1 points

7 months ago

thank you /u/headjanitor, I will try this out right now.

/u/HeadJanitor ۩ 𝓜𝓘𝓐 ۩

1 points

7 months ago

Translating it into Tails is more difficult for me than Whonix. You can do everything on Whonix. You are so restricted on Tails. When you are ready, let me know. I'll guide you and expect no more than 12 minutes.

/u/alwaysfire

1 points

6 months ago

I understand whonix a bit more than the basics, and I have to respectfully disagree. Whonix is more secure and flexible, but tails is easier and more user friendly. Whonix is also slower when being run on qubes.

/u/HeadJanitor ۩ 𝓜𝓘𝓐 ۩

1 points

6 months ago

I used Ubuntu for the first time in my life a couple week ago and nearly cried. Can't I just have my freedom to install and delete anything?

Ubuntu is for people age 5 or over 70.

It's not Tails. When you are an OCD, perfectionist and need to install your choice of a package and you are root kick it you can't go back to 1st grade and try to fit in.

/u/alwaysfire

1 points

6 months ago

So what setup do you primarily use and work with then?

/u/HeadJanitor ۩ 𝓜𝓘𝓐 ۩

1 points

6 months ago

I switch between 4 semi identical laptops like a monkey. No joke. Though they all have nested virtualization. I am a killer shopper. Yesterday I unnecessarily received a 3k laptop for 1k. Almost everything is Debian based or a derivative. I am terrified of Ubuntu and Tails. Ubuntu gave me PTSD. I like having the latest kernel. I treat my laptops like demolition tools and paradoxically like infants.

/u/alwaysfire

1 points

5 months ago

Holy shit!

/u/PelicanFly

1 points

5 months ago*

Thanks for the terminal commands for persisting Tor config settings, /u/HeadJanitor. I just tried to follow along, but it looks like I get the following error when trying to change directories into /dotfiles:

bash: cd: /live/persistence/TailsData_unlocked/dotfiles: No such file or directory

Has something changed in the past couple months, or am I just missing something?

/u/BostonGeorge33

1 points

6 months ago

Your web browser is:
Firefox 128 on Windows 10
✗ Your web browser is out of date

Out of date web browsers can have security problems and may cause websites to not work properly.
You have version 128, why not update to version 134?
How to update Firefox

Your web browser's unique URL:
This feature isn't available at the moment. It will return soon.

Is it supposed to look like this after I set privacy.resistFingerprinting.spoofOsInUserAgentHeader to true
I also changed java.enabled to false and webgl.disable-wgl and webgl,disabled to true.
even if i have kali linux and not windows?

/u/snowonthabluff420

1 points

6 months ago

on the whatismybrowser website, at the bottom it asks if it looks like my traffic is coming from a tor exit node. and it says no. But I didn't connect to tor over bridges (they say not to if you don't live under a repressive regime and how if you dont need it but use it anyway, it could take away resources from someone who actually does). So does spoofing my user agent, accomplish the same thing? or is it just that specific website (whatismybrowser . com) thinking im not using tor bc my user agent is spoofed? like my actual internet service provider will still probably be able to see im using tor since i didn't connect with bridges? and its just the fact that my user agent is spoofed that the website thinks im not using tor? or am i way off? lol thanks for any help.

/u/[deleted]

-2 points

8 months ago

[removed]

/u/Paris 📢 A ⎝⎝✧GͥOͣDͫ✧⎠⎠

6 points

8 months ago

While setting your security level to safest does disable javascript it uses noscript to do so. Noscript in the past has had bugs where it randomly got disabled and allowed JavaScript to sliently run. It also does not change the userAgent string.

/u/Purplemonkey239

-2 points

8 months ago

Tails hasn't updated the TOR browser to 14 yet?

/u/terrynutkins

1 points

8 months ago

Mine has just updated and TOR is now 14