Dr. Neal Krawetz reported on his blog, The Hacker Factor, that he identified problems in the Tor browser that may be working against the anonymity network’s stated goals. These issues cause the browser to disclose information that could potentially allow threat actors to profile Tor users.

One Size Doesn’t Fit All

Krawetz looked beyond the user string information provided by the browser in routine communications. While this string information is the same in all Tor browsers to enhance privacy, he looked at other parameters that the browser shared with a site, including screen size, window size and scrollbar thickness. These factors can vary depending on the OS, but it’s possible to ascertain user patterns by observing them.

For example, a normal browser setting has a window size that is less than the size of the screen; but Tor sets them equal to each other as part of its security stratagem. If a browser communicant notes that the two parameters have equal value, it are more likely to infer that it is dealing with a Tor setup. Krawetz also noted that the macOS Tor browser miscalculates the window size because of the dock menu on the screen.

Additionally, the scrollbar size value is unique for each version of Tor. Bleeping Computer reported that there is a default scrollbar thickness in macOS of 15 pixels, while scrollbars are 17 pixels thick in Windows 7, 8 and 10. Linux can vary between 10 and 16 pixels.

Is the Tor Browser Really Anonymous?

In 1883, Auguste Kerckhoffs formulated six principles for his military cryptography theory. One aspect states that a system “must not rely upon secrecy, and it must be able to fall into the enemy’s hands without disadvantage.”

The principle has been widened in use throughout the security field and remains as relevant as ever. In cybersecurity parlance, making some part of a system obscure will not, in turn, make it secure. If just finding something can defeat the system, you have already lost, and your system is not as secure as you believed.

Krawetz identified patterns that could tell an attacker that Tor is being used for communication. Kerckhoff would likely say, “So what? I’m using Tor and you still can’t identify me.”

While Krawetz’s threat model can be productive, Tor was never truly designed to hide the fact that it was being used. Rather, it was developed to conceal individuals’ use patterns.

Even with these parameters invoked, each OS variant of the Tor browser should look like any other. Ultimately, the Tor browser will still function the way it is supposed to.