How To Disable Scripts In Tor Browser

[GLover]

How To Disable Scripts In Tor Browser

Due to the downfall of FH, and the malicious script inserted into the page code, it is now even more advisable to ensure that all scripts have been disabled in Tor Browser. I cannot stress this enough, that you should never enable scripts for any site on Tor, purely because exploits are so much a danger to us and our communities. Here is how to do it.

Note: Messing with the no-scripts extension's own settings is now deprecated. Use the security slider and the browser settings instead, as described here. – Mid. (2020)

Via the Security Slider

• Click on the shield icon, to the right of the address bar.
• In the drop-down, click “Advanced Security Settings...”
• Under “Security Level,” select the “Safest” option using the radio buttons.

In Addition - Using Tor Browser's Settings

• Type about:config in the address bar (where the website address usually appears) at the top of Tor Browser, and press Enter.
  
• Click the I'll be careful, I promise! button. You can uncheck the checkbox to the left if you no longer wish to see that message.
  
• Search for javascript.enabled in the search bar which appears to the right of Search:.
  
• Double-click javascript.enabled to turn True to False OR Right-click javascript.enabled and select Toggle to turn True to False
  

Always use the first method as a matter of course, with the second method used in addition to, not instead of it. This should ensure that you are as secure as you can be in respect to malicious scripts in Tor Browser. It will break many clearnet sites, and maybe the odd function in onion sites, but security is far more important than usability when you wish to remain secure.

[Gaki]

I would recommend going one step further. 

By clicking on the TorBrowser 'Menu Dropdown' at the top (look for the little triangle pointing down next to TorBrowser at the top-left corner of the open TorBrowser window), a menu will appear.

• Click to open menu
• Hover mouse over the [/b]Options[/b] submenu item (on the right-hand side, just above Help)
• Move to the Options menu item and click to open - this will open the Options panel
• Click Content item on the top to open the Content options
• Uncheck the Enable Javascript option to disable Javascript over all

This should keep you safe even if you accidentally click Temporarily allow access for this page only on NoScript.

o.0

[GLover]

I knew i'd forgotten something! Thanks for this. I disable javascript in TB's settings every time I get a new version. Adding to my OP.

[EmsMate]

Pardon my hignorance,
I just upgraded to Tails 22.rc1 and the options have all changed.
Any idea where it lies now?

[GLover]

Pardon my hignorance,
I just upgraded to Tails 22.rc1 and the options have all changed.
Any idea where it lies now?

You could try the TAILS guide at this location - https://supportvojao2z6taveolgpvgcz5k4v7smwgjcuzz5ahs5ctnscuejyd.onion.autos/index.php?topic=1608.0 - Other than that I do not use TAILS, so cannot help any further other than to say that it's odd if the location of the options in TBB has changed. Maybe the options/settings needs to be made to appear by right-clicking the bars at the top? Surely the options for No-Script haven't moved, have they?

[Gaki]

Pardon my hignorance,
I just upgraded to Tails 22.rc1 and the options have all changed.
Any idea where it lies now?

Which options are you discussing?  I, too, have switched.  I have noticed they rearranged the top toolbar.  What are you looking for and/or what has changed?

o.0

[happydaddy]

Just a couple of minor technical points I'd like to make sure are clear...

Other than that I do not use TAILS, so cannot help any further other than to say that it's odd if the location of the options in TBB has changed.

That line seems to imply that tails uses TBB, which is not correct. Tails does impersonate TBB to make it harder to profile TBB/Tails users separately, but it is a separate thing.


And in the original post there are two methods of disabling javascript. Do NOT rely only on the second method, NoScript blocks so much more than just javascript. The second method is a nice additional thing to do, but is not very much protection on its own.

[GLover]

That line seems to imply that tails uses TBB, which is not correct. Tails does impersonate TBB to make it harder to profile TBB/Tails users separately, but it is a separate thing.

My mistake there. I thought it did use TBB, not just impersonate it. If there is a different way of doing so in TAILS, i'd love to add it to the OP to cover all eventualities. Anyone care to provide the info?

And in the original post there are two methods of disabling javascript. Do NOT rely only on the second method, NoScript blocks so much more than just javascript. The second method is a nice additional thing to do, but is not very much protection on its own.

This was my intention, but I did not clarify when I first added the addendum. I've hopefully made it much clearer for everyone now. Thanks for the nudge.

[liasiangirllvr]

Hello!

I asked this question in another topic here on PSC, but sadly it was ignored.

I followed your steps, but now for example the Quote function here does not work for me.

So do I have to enable the scripts temporarily for PSC as a trusted site to get these functions to work again?

Would be grateful for a little help/clarification.

[GLover]

Hello!

I asked this question in another topic here on PSC, but sadly it was ignored.

I followed your steps, but now for example the Quote function here does not work for me.

So do I have to enable the scripts temporarily for PSC as a trusted site to get these functions to work again?

Would be grateful for a little help/clarification.

No, do not ever enable scripts for PSC, even if only for a minute! If you wish to quote a post, browse to the post in question, and click the Quote button to the top-right of the post. The page will load with the entire post in quotes. Edit as necessary, and make your response.

If your intention is to include multiple quotes from different posts, you'll have to do as i've just said, copy the entire text of the quote, go back one page so that you're viewing the thread normally, then hit the Quote button above the next post you wish to quote. Paste the first quote into the box, separating it from the second quote, then repeat as necessary until you have all quotes ready to go in one post.

I hope this makes sense to you. The Insert Quote button requires javascript, and as such has become potentially unsafe. Never enable scripts on here ever again.

[404_Lolis]

@GLover. Thanks for writing step-by-step instructions on how to disable scripts on TBB. Disabling scripts is absolutely essential to staying safe. I already know to how disable scripts with NoScripts or Tools--->Options on Firefox, and I was planning to write a step-by-step guide on how disable scripts. But I guess you beat me to it.

[GLover]

Thanks for thinking of this. We do attempt to preempt the needs of our members, as do many other members, but there are times where we miss things in part, or altogether. You're always welcome to write guides in here, as is everyone else, and to contribute to the discussion on them, especially if all you have is questions or corrections. Our aim is to help you be as secure as possible.

[liasiangirllvr]

Hello!

I asked this question in another topic here on PSC, but sadly it was ignored.

I followed your steps, but now for example the Quote function here does not work for me.

So do I have to enable the scripts temporarily for PSC as a trusted site to get these functions to work again?

Would be grateful for a little help/clarification.

No, do not ever enable scripts for PSC, even if only for a minute! If you wish to quote a post, browse to the post in question, and click the Quote button to the top-right of the post. The page will load with the entire post in quotes. Edit as necessary, and make your response.

If your intention is to include multiple quotes from different posts, you'll have to do as i've just said, copy the entire text of the quote, go back one page so that you're viewing the thread normally, then hit the Quote button above the next post you wish to quote. Paste the first quote into the box, separating it from the second quote, then repeat as necessary until you have all quotes ready to go in one post.

I hope this makes sense to you. The Insert Quote button requires javascript, and as such has become potentially unsafe. Never enable scripts on here ever again.

Thank you GLover for the explanation. I always tried this Insert Quote Button, because I was used to always first press the reply button and then adding the Quotes to my reply.
It sadly never occurred to me to use the Quote button first.

So I think it is correct, that when I want to put a Quote, then my own text and then a Quote again it must look like this:  [/quote author=xy] quoted text [/quote]  my own text  [/quote] quoted text [/quote]

Correct? I will try it.

[GLover]

Almost right. When you want to manually add a quote, you must use this format:

[quote=A Person]This is what they wrote.[/quote]

It should then come out like this:

This is what they wrote.

Hope that's clear enough. You'll lose the automatic link to the post you're quoting, but that's not the end of the world. Using the Quote button automatically puts the quote tags in place.

[Trainwreck]

hey thanks i updated and went to disable it but it wasent there so i was a little scared lol thanks