add-ons in torbrowser

[haaber]

Hi this may be a double-post, but I could not find an appropiate help
page. I like to add an adblocker (u-block) to my TBB, since I consider
any browser without adblocking useless, meaning that I will not use it
anyways. So here is my approach:

download .xpi file in anon-whonix, qvm-move it to whonix-gw and there I
would (have liked to) install it. But the torbrowser does not want to be
run in the template-VM. How procede then? Re-Install the .xpi file at
each reboot ???? Cheers!

[Qubes]

From a security point you should not customize TOR in any way. TOR's
strength lies in hiding you in the masses. If everybody using TOR looks
the same then it would be impossible to identify YOU. If you add one
specific add-on to TOR and for arguments sake you are the only TOR user
using that particular add-on you have compromised yourself as you can
then be identified and tracked (by means of fingerprinting).

Customizing TOR is a bad idea. Just leave it stock standard.

[Jackie]

Qubes:

Hi,

This is true. Installing adblock in TB has privacy implications because
it makes you more unique. It's a convenience vs privacy tradeoff.

However you might decide that for certain uses, the added convenience is
worth the privacy loss because you're not doing anything particularly
sensitive where you really need to minimize fingerprintability.

I wouldn't try to install adblock in TB in the template though. I would
have multiple tor-browsing VMs for different purposes, and in any that
are less sensitive, where you're browsing sites with annoying ads,
install adblock in the copy of TB in that specific VM.

Just keep in mind that by customizing TB this way you're increasing the
ability of an adversary to connect different uses together and conclude
they're the same person, even across multiple VMs where you make the
customization.

Btw in some cases you might not need adblock because noscript will
prevent *some* ads from being displayed (assuming you block javascript).
So i'd try it out and only install adblock when you need it, when
fingerprintability is not very important. But for anything sensitive use
a separate VM/dispVM with no adblock.

[fiftyfour...@gmail.com]

Tor browser comes with noscript, which should do a similar job. I suggest using it in combination with Tor's internal safety settings (the shield icon). 

As Qubes said, you shouldn't customize the browser.