Adapt Security Levels in Onion Browser

[cstiens]

Security levels are different now:

• Gold - no javascript
• Silver - requests for microphone access and compass (device orientation, movement and speed) are auto denied; we block the request; there are very few that need this; others are trying to get this information to single you out.
• Bronze

[tladesignz]

@cstiens, let's continue discussion here!

[cstiens]

Ok. I have some questions.

How is bronze browsing different than using Safari to browse with Orbot on?

If a user doesn't want ads, which level should they choose?

In regard to no JavaScript - disabling JavaScript can mean that some sites won't perform well. But it also means that it blocks third parties from tracking you through their JavaScript code. Is that correct? Are there any other privacy or security benefits to blocking JavaScript that we should highlight?

[tladesignz]

How is bronze browsing different than using Safari to browse with Orbot on?

Bronze has JavaScript switched off. Safari does hide this option pretty deeply in the Settings app. And also not per site but just in general.

If a user doesn't want ads, which level should they choose?

They would use an ad blocker add or an app like Firefox Focus which provides a filter extension with continuously updated filter lists to seriously get rid of apps.

Onion Browser has some means to block ads, but we cannot maintain the infrastructure to provide properly updated ad filter lists.

Although we might reconsider this.

In regard to no JavaScript - disabling JavaScript can mean that some sites won't perform well.

Unfortunately, nowadays JavaScript is used in most sites, and disabling it will break them. Besides the most basic informational websites and very considerate ones like DDG or Google, which provide non-JavaScript fallbacks.

But it also means that it blocks third parties from tracking you through their JavaScript code.
Is that correct?

True, a lot of ads and tracking code heavily uses JavaScript. But more advanced (or pretty old) stuff does use non-JavaScript means. Like the good-old tracking pixel.

Are there any other privacy or security benefits to blocking JavaScript that we should highlight?

No. JavaScript just makes things pretty secure, because the biggest angle of attack is gone for privacy invasions and some advanced zero-click sandbox escape attacks.

But, like all the other measures, it's just one brick in a proper defence wall.