How secure is Tor in safest mode?

Questions
1

Tor is usually said to be the least secure of the mainstream browsers, but is that still true if all JavaScript is disabled?

2

it is? i didnt know

3

Why least secure? That doesn’t make sense to me at all. Where did you find this info.

4

From the GrapheneOS usage guide:

At the moment, the only browser with any semblance of privacy is the Tor Browser but there are many ways to bypass the anti-fingerprinting and state partitioning. The Tor Browser’s security is weak which makes the privacy protection weak. The need to avoid diversity (fingerprinting) creates a monoculture for the most interesting targets. This needs to change, especially since Tor itself makes people into much more of a target (both locally and by the exit nodes).

5

Damn GrapheneOS team, I definitely do trust them when it comes to security I must say.

I just can’t comprehend how Tor browser could possibly be more insecure than Firefox, Mullvad, Librewolf, Zen etc.

Sure I understand Gecko is less secure than Chromium, but is Tor less secure than other browsers based on reasons outside of purely not being Chromium-based?

6
7

That was an interesting read. Idk why I had just assumed Tor came with uBO. That’s wild that it doesn’t.

How much less secure is ESR than regular FF?

I will say the changing the security level as a rigid thing and only having three toggles does make sense from an anti-fingerprinting perspective.

The user any1 has Librewolf next to their name, are they a LW dev?

8

I noticed tor browser did nothing about font fingerprinting, which I think is quite stable and unique. For example:

9

Do not use fingerprint test sites.

10

I think you should use Tor browser in a microvm, so you can control what fonts are there, and also make it more secure

11

That will be a really small bucket.

12

why shouldnt you use fingerprint test sites (except for amiunique i think thats not a good site)

if you shouldnt use them what other things should you do to test if youre safe?

13

Fingerprinting is a complicate thing, don’t try too hard, it will backfire.

14

I read its code so I fully understand how that font fingerprinting works and how that web page works. But I get you, privacy is very complex and these detection sites may not truly reflect privacy, and they may collect data.

Font fingerprinting 
function fontsList() {
  return [
    "mono",
    "system-ui",
    "-apple-system",
    "BlinkMacSystemFont",
    "MS Shell Dlg",
    "MS Shell Dlg \\32",
    "aakar",
    "Abadi MT Condensed",
    "Abadi MT Condensed Light",
    "ABeeZee",
    "Abel",
    "Abhaya Libre",
    "Abril Fatface",
    "Abyssinica SIL",
    "Academy Engraved LET",
    "AcadEref",
    "Aclonica",
    "Acme",
    "Actor",
...
    "Zhi Mang Xing",
    "Zilla Slab",
    "Zilla Slab Highlight",
    "Zurich BlkEx BT",
    "Zurich Ex BT",
    "ZWAdobeF",
    "מרים",
    "মিত্র",
    "মুক্তি",
    "মুক্তি পাতনা",
    "गार्गी",
    "नालिमाटी",
    "অনি Dvf",
    "宋体",
    "微软雅黑",
    "游ゴシック",
    "細明體",
    "細明體_HKSCS",
    "新細明體",
    "굴림",
    "굴림체",
    "바탕",
    "ＭＳ ゴシック",
    "ＭＳ 明朝",
    "ＭＳ Ｐゴシック",
    "ＭＳ Ｐ明朝",
  ];
}
!(function () {
  var d = _el("#fonts-metrics-hash"),
    C = ((d.className = "load-td"), _el("#fonts-glyphs-hash")),
    y =
      ((C.className = "load-td"),
      ["default", "sans-serif", "serif", "monospace", "cursive", "fantasy"]);
  function L(t, e) {
    return (69069 * t + e) % 4294967296;
  }
  function u(t, e) {
    return ((t.style.fontFamily = e), t.offsetWidth + "," + t.offsetHeight);
  }
  function x() {
    for (
      var t,
        e = fontsList(),
        n = e.length,
        o = _el("#fonts-metrics-testbox"),
        s = document.createElement("span"),
        r =
          ((s.style.fontSize = "128px"),
          (s.innerHTML =
            "mmmMMMmmmlllmmmLLL₹▁₺₸ẞॿmmmiiimmmIIImmmwwwmmmWWW"),
          o.appendChild(s),
          {}),
        i = u(s, "br0k3nd3f4u17"),
        a = 0,
        l = 0;
      l < y.length;
      l++
    )
      (r[(t = u(s, y[l]))] || (r[t] = ""),
        "" != r[t] && (r[t] += ", "),
        (r[t] += y[l]),
        a++);
    for (l = 0; l < n; l++)
      (t = u(s, e[l])) !== i &&
        (r[t] || (r[t] = ""),
        "" != r[t] && (r[t] += ", "),
        (r[t] += e[l]),
        a++);
    var m,
      f = 0,
      c = "";
    for (t in r)
      (0 < f && (c += "\n"),
        f++,
        (c +=
          t +
          ((m = t),
          "\t".repeat(Math.max(0, Math.ceil((8 - m.length) / 4)) + 1)) +
          r[t]));
    ((o = _el("#fonts-metrics-output")),
      o.closest("tr").classList.remove("n"),
      (o.textContent = c),
      (o = _el("#fonts-metrics-report")));
    (o.closest("tr").classList.remove("n"),
      (o.innerHTML = a + " fonts and " + f + " unique metrics found"),
      (d.className = "wball mono upper"),
      (d.innerHTML = ico(1) + md5(c)));
  }
  setTimeout(function () {
    for (
      var t,
        e,
        n,
        o,
        s = document.createElement("div"),
        r =
          ((s.id = "fonts-glyphs-testbox"),
          document.body.appendChild(s),
          [
            8377, 9601, 8378, 42813, 65533, 8376, 1478, 7838, 2431, 61443, 7386,
            6109, 9134, 3330, 2946, 4442, 9253, 12334, 43056, 11014, 8676, 8381,
            11387, 8368, 64494, 63504, 65535, 127, 4256, 120720, 1792, 6480,
            12437, 21293, 1564, 8419, 65529, 536, 1423, 2276, 2483, 7248, 9753,
          ]),
        i = {},
        a = {},
        l = 0,
        m = [],
        f = 0;
      f < y.length;
      f++
    )
      ((t = y[f]),
        (n = document.createElement("div")),
        (e = document.createElement("span")),
        (n.id = "div_" + t),
        (e.id = "span_" + t),
        "default" !== t && (e.style.fontFamily = t),
        (e.textContent = "A"),
        s.appendChild(n),
        n.appendChild(e),
        (i[t] = n),
        (a[t] = e));
    for (f = 0; f < r.length; f++) {
      for (
        var c = r[f],
          d =
            (o = c) <= 65535
              ? String.fromCharCode(c)
              : ((o -= 65536),
                String.fromCharCode(55296 + (o >> 10), 56320 + (o % 1024))),
          u = [
            (function () {
              for (var t = c.toString(16).toUpperCase(); t.length < 4;)
                t = "0" + t;
              return "U+" + t;
            })(),
          ],
          h = 0;
        h < y.length;
        h++
      ) {
        ((n = i[(t = y[h])]), ((e = a[t]).textContent = d));
        var p = e.offsetWidth,
          g = n.offsetHeight,
          p = ((l = L(l, p)), (l = L(l, g)), p + "," + g);
        (p.length < 4 && (p += "\t"), p.length < 8 && (p += "\t"), u.push(p));
      }
      m.push(u.join("\t"));
    }
    for (h = 0; h < y.length; h++) (e = a[(t = y[h])]).textContent = "";
    var v = ("00000000" + l.toString(16)).slice(-8),
      v =
        ((C.className = "wball mono upper"),
        (C.innerHTML = ico(1) + v),
        _el("#fonts-glyphs-output"));
    (v.closest("tr").classList.remove("n"),
      (v.textContent =
        "glyph\tdefault\t\tsans-serif\tserif\t\tmonospace\tcursive\t\tfantasy\n\n" +
        m.join("\n")),
      setTimeout(x, 10));
  }, 10);
})();
15

Yes https://discuss.privacyguides.net/g/developers#:~:text=any1-,Librewolf,-Primary

You can’t really quantify how much exactly, but it is enough of a regression to take note of.

16

Tor Browser ships its own fonts that get used.

17

I tested years ago. Good to know it does now.

18

I wouldn’t worry about security of Tor Browser in Safest mode on desktop, if you don’t need to make exceptions. If you need to make exceptions, it depends.