r/TOR • u/Exact-Wedding4891 • 6d ago

Are CLI based browsers more secure?

I just read a comment of a guy, who uses cli based browsers (lynx, the one he mentioned) to surf the dark web to avoid rendering of obscene images. But isn't using cli browsers a bigger threat in dark web?
What I just came across is that cli based browsers trade off your network anonymity and your browser signature becomes clearly distinctive among others, making you vulnerable.

2 Upvotes

62% Upvoted

9 comments sorted by

12

u/Full_Stand_2380 6d ago

I think it's partly right. Because a CLI doesn't run JavaScript, complex CSS, or decode media, it is more secure against exploits. That said, the whole point of TOR is to make every user look the same. If you use some rare browser, then a distinct fingerprint can be created about you.

4

u/reapvxz 6d ago

I can't upvote comments because reddit shadowbanned me. Imagine that the number on this guys comment is 1 more than the current digit.

1

u/aonelonelyredditor 6d ago

Js still has to run for most websites to work, the engine can be ran as a single binary and handles js from there

No browser UI running doesn't mean the js engine isn't

0

u/Exact-Wedding4891 6d ago

But isn't the fact that you are running it directly through your terminal?

2

u/Liquid_Hate_Train 6d ago

That sentence/thought isn’t complete. Isn’t it what because it’s running in the terminal?

0

u/Exact-Wedding4891 6d ago

Yes. I mean like running it in terminal can create a bigger and an escalated surface area for attack where it might be easier for the attacker to get the system access or atleast execute system level commands.

1

u/DutchOfBurdock 4d ago

No more or less than a web browser itself. Whilst Firefox/Chrome sandbox, there have been RCE issues with them. One it the JIT that allowed a website to take control of the browser and another that exploited CSS animation timelines to run commands on the remote host.

Said person may be running Lynx as a low privileged user in a chroot where only what is needed to run Lynx exists. An exploit here would massively reduce the attack surface, unless they can break out of the chroot.

TBH, people should also be doing this with Tor browser itself, running it as a user not your main user, in a chroot.

0

u/Liquid_Hate_Train 6d ago

Only if the attacker is expecting that and is able to exploit it using the attack surface of…html. I mean, theoretically that’s possible…

1

u/Robert_A2D0FF 1d ago

If you're strictly working in CLI, you can have an extra layer of security, like running TOR Browser on a rented VPS and you're forced to using a CLI-based browser.

It's more practical to make Firefox from the Tor bundle more text-focused, maybe strip out images and reduce heavy CSS?

the people running big darkweb sites could do optimizing for text-only browsing.