Tor Browser can leak your identity through side-channel attack

[zzk9]

A New Attack Can Unmask Anonymous Users on Any Major Browser

Temporary workaround plugins:

Chrome:

Leakuidator+

Firefox:

Leakuidator+ – Get this Extension for 🦊 Firefox (en-US)

Tried adding this to gitlab TOR bugs, but they will not validate my account(Yet another bug with reporting bugs!)

[gus]

This attack is fixed on NoScript 11.4.8, check out this explanation by @ma1:

Cross-tab Identity Leak Protection

NoScript’s Cross-tab Identity Leak Protection (or “TabGuard”) is an experimental countermeasure against the Targeted Deanonymization via the Cache Side Channel attack by Mojtaba Zaheri, Yossi Oren and Reza Curtmola, presented at Usenix Security in August 2022.

It is loosely inspired by the Leakuidator+ browser extension proposed by the authors as a defense, but it’s designed to better integrate with Firefox and the Tor Browser and provide protection against variants of the attack not covered yet. When triggered, TabGuard suspends authenticated requests across related tabs and gives the user the ability to either “Load anonymously” (preventing the attack but also logging out from the target site) or “Load normally”, which may be required by some legitimate cross-site workflows such as online payments, single sign-on and 3rd party authentication systems. This protection is enabled by default on any Private Browsing window (and therefore in the Tor Browser), but can be disabled or enabled globally from the NoScript Options>Advanced panel.

Important Note: this feature is still in its infancy, and while effective it might also be disruptive sometimes. Improvements, especially on the user experience side, are coming. Bug reports are welcome as always.

[Angular]

Does this affect people who are pseudo anonymous, by which I mean known as a username but not known as a person

[ma1]

The attack is generally meant to detect that the user is currently logged with some username on a service, not the personal details behind that username (either “real” or pseudo). But as such could be used to link accounts from 2 or more services, increasing the chances to reveal their real identity.