[[!meta title="Browsing the web with Tor Browser"]]

[[!img Tor_Browser/mozicon128.png link=no alt=""]]

<span class="application">[Tor Browser](https://www.torproject.org/projects/torbrowser.html.en)</span> is a web
browser based on [Mozilla Firefox](http://getfirefox.com) and configured to
protect your anonymity. Given the popularity of Firefox, you might have used it
before and its user interface is like any other modern web browser.

Some frequently asked questions about the browser can be found in
[[the FAQ|support/faq#browser]].

Here are a few things worth mentioning in the context of Tails.

[[!toc levels=2]]

<div class="tip">

<p>If you want to browse web pages on your local network, refer to our
documentation on [[accessing resources on the local
network|advanced_topics/lan]].</p>

</div>

<a id="confinement"></a>

AppArmor confinement
====================

<span class="application">Tor Browser</span> in Tails is confined with
[[!debwiki AppArmor]] to protect the system and your data from some
types of attack against <span class="application">Tor Browser</span>.
As a consequence, it can only read and write to a limited number of
folders.

<div class="note">

This is why you might face <span class="guilabel">Permission
denied</span> errors, for example if you try to download files to the
<span class="filename">Home</span> folder.

</div>

- You can save files from <span class="application">Tor
Browser</span> to the <span class="filename">Tor Browser</span> folder
that is located in the <span class="filename">Home</span> folder.
The content of this folder will disappear once you shut down Tails.

- If you want to upload files with <span class="application">Tor
Browser</span>, copy them to that folder first.

- If you have activated the <span
class="guilabel">[[Personal
Data|doc/first_steps/persistence/configure#personal_data]]</span>
persistence feature, then you can also use the <span
class="filename">Tor Browser</span> folder that is located in the
<span class="filename">Persistent</span> folder. In that case, the
content of this folder is saved and remains available across separate
working sessions.

<div class="note">

<p>To be able to download files larger than the available RAM, you need
to activate the <span class="guilabel">[[Personal
Data|doc/first_steps/persistence/configure#personal_data]]</span>
persistence feature.</p>

</div>

<a id="https"></a>

HTTPS Encryption
================

Using HTTPS instead of HTTP encrypts your communication while browsing the web.

All the data exchanged between your browser and the server you are visiting are
encrypted. It prevents the
[[Tor exit node to eavesdrop on your communication|doc/about/warning#exit_node]].

HTTPS also includes mechanisms to authenticate the server you are communicating
with. But those mechanisms can be flawed,
[[as explained on our warning page|about/warning#man-in-the-middle]].

For example, here is how the browser looks like when we try to log in an email
account at [riseup.net](https://riseup.net/), using their [webmail
interface](https://mail.riseup.net/):

[[!img doc/anonymous_internet/Tor_Browser/riseup.png link=no alt=""]]

Notice the padlock icon on the left of the address bar saying "mail.riseup.net"
and the address beginning with "https://" (instead of "http://"). These are the
indicators that an encrypted connection using [[!wikipedia HTTPS]] is being
used.

You should try to only use services providing HTTPS when you are sending or
retrieving sensitive information (like passwords), otherwise its very easy for
an eavesdropper to steal whatever information you are sending or to modify the
content of a page on its way to your browser.

<a id="https-everywhere"></a>

HTTPS Everywhere
----------------

[[!img https-everywhere.jpg link=no alt=""]]

[HTTPS Everywhere](https://www.eff.org/https-everywhere) is a Firefox extension
included in <span class="application">Tor Browser</span> and produced as a collaboration between [The Tor
Project](https://torproject.org/) and the [Electronic Frontier
Foundation](https://eff.org/). It encrypts your communications with a number of
major websites. Many sites on the web offer some limited support for encryption
over HTTPS, but make it difficult to use. For instance, they may default to
unencrypted HTTP, or fill encrypted pages with links that go back to the
unencrypted site. The HTTPS Everywhere extension fixes these problems by
rewriting all requests to these sites to HTTPS.

To learn more about HTTPS Everywhere you can see:

 - the [HTTPS Everywhere homepage](https://www.eff.org/https-everywhere)
 - the [HTTPS Everywhere FAQ](https://www.eff.org/https-everywhere/faq/)

<a id="torbutton"></a>

Torbutton
=========

Tor alone is not enough to protect your anonymity and privacy while browsing the
web.  All modern web browsers, such as Firefox, support [[!wikipedia
JavaScript]], [[!wikipedia Adobe_Flash]], [[!wikipedia HTTP_cookie
desc="cookies"]] and other services which have been shown to be able to defeat
the anonymity provided by the Tor network.

In <span class="application">Tor Browser</span> all such features are handled from inside the browser by an extension
called [Torbutton](https://www.torproject.org/torbutton/) which does all sorts
of things to prevent the above type of attacks. But that comes at a price: since
this will disable some functionalities and some sites might not work as
intended.

<div class="note">

<p>In Tails, the <a href="https://people.torproject.org/~mikeperry/images/OnionMenu.jpg">circuit
view</a> of <span class="application">Tor Browser</span> is disabled because we are
not sure whether it would have security implications in the particular
context of Tails (see [[!tails_ticket 9365 desc="#9365"]] and [[!tails_ticket 9366
desc="#9366"]]). This feature is safe to use outside of Tails.</p>

<p>You can see the Tor circuits in
<span class="application">[[Onion Circuits|tor_status#circuits]]</span>.</p>

</div>

<a id="javascript"></a>

Protection against dangerous JavaScript
---------------------------------------

Having all JavaScript disabled by default would disable a lot of harmless and
possibly useful JavaScript and render unusable many websites.

That's why **JavaScript is enabled by default** in <span class="application">Tor Browser</span>.

But we rely on Torbutton to **disable all potentially dangerous JavaScript**.

We consider this as a necessary compromise between security and usability and as
of today we are not aware of any JavaScript that would compromise Tails
anonymity.

<div class="note">

<p>To understand better the behavior of <span class="application">Tor
Browser</span>, for example regarding JavaScript and cookies, you can
refer to the <a href="https://www.torproject.org/projects/torbrowser/design/">
<span class="application">Tor Browser</span> design document</a>.</p>

</div>

<a id="security_slider"></a>

Security slider
---------------

You can use the security slider of *Torbutton* to disable browser
features as a trade-off between security and usability. For example, you
can use the security slider to disable JavaScript completely.

The security slider is set to *low* by default. This value provides the
default level of protection of *Torbutton* and the most usable experience.

To change the value of the security slider, click on the [[!img torbutton.png link=no class=symbolic alt="green onion"]] button
and choose **Privacy and Security Settings**.

[[!img security_slider.png link="no" alt="Security slider in its default value (low)"]]

<a id="new_identity"></a>

<span class="guilabel">New Identity</span> feature
--------------------------------------------------
[[!img new_identity.png link=no]]

The <span class="guilabel">New Identity</span> feature of *Tor Browser*:

  - Closes all open tabs.
  - Clears the session state including cache, history, and cookies
    (except the cookies protected by the **Cookie Protections** feature).
  - Closes all existing web connections and creates new Tor circuits.
  - Erases the content of the clipboard.

<div class="caution">

<p>This feature is not enough to strongly [[separate contextual identities|about/warning#identities]]
in the context of Tails as the connections outside of
<span class="application">Tor Browser</span> are not restarted.</p>

<p>Shutdown and restart Tails instead.</p>

</div>

For more details, see the [design and implementation of the Tor Browser](https://www.torproject.org/projects/torbrowser/design/#new-identity).

<a id="noscript"></a>

NoScript to have even more control over JavaScript
==================================================

[[!img noscript.png link=no alt=""]]

To allow more control over JavaScript, for example to disable JavaScript
completely on some websites, <span class="application">Tor Browser</span> includes the <span class="application">NoScript</span>
extension.

By default, <span class="application">NoScript</span> is disabled and some
JavaScript is allowed by the <span
class="application">[[Torbutton|Tor_Browser#javascript]]</span> extension as
explained above.

For more information you can refer to the NoScript
[website](http://noscript.net/) and [features](http://noscript.net/features).
