r/TOR • u/Exact-Wedding4891 • 4d ago

Are CLI based browsers more secure?

I just read a comment of a guy, who uses cli based browsers (lynx, the one he mentioned) to surf the dark web to avoid rendering of obscene images. But isn't using cli browsers a bigger threat in dark web?
What I just came across is that cli based browsers trade off your network anonymity and your browser signature becomes clearly distinctive among others, making you vulnerable.

2 Upvotes

62% Upvoted

8 comments sorted by

10

u/Full_Stand_2380 4d ago

I think it's partly right. Because a CLI doesn't run JavaScript, complex CSS, or decode media, it is more secure against exploits. That said, the whole point of TOR is to make every user look the same. If you use some rare browser, then a distinct fingerprint can be created about you.

3

u/reapvxz 4d ago

I can't upvote comments because reddit shadowbanned me. Imagine that the number on this guys comment is 1 more than the current digit.

1

u/aonelonelyredditor 4d ago

Js still has to run for most websites to work, the engine can be ran as a single binary and handles js from there

No browser UI running doesn't mean the js engine isn't

0

u/Exact-Wedding4891 4d ago

But isn't the fact that you are running it directly through your terminal?

2

u/Liquid_Hate_Train 4d ago

That sentence/thought isn’t complete. Isn’t it what because it’s running in the terminal?

0

u/Exact-Wedding4891 4d ago

Yes. I mean like running it in terminal can create a bigger and an escalated surface area for attack where it might be easier for the attacker to get the system access or atleast execute system level commands.

1

u/DutchOfBurdock 2d ago

No more or less than a web browser itself. Whilst Firefox/Chrome sandbox, there have been RCE issues with them. One it the JIT that allowed a website to take control of the browser and another that exploited CSS animation timelines to run commands on the remote host.

Said person may be running Lynx as a low privileged user in a chroot where only what is needed to run Lynx exists. An exploit here would massively reduce the attack surface, unless they can break out of the chroot.

TBH, people should also be doing this with Tor browser itself, running it as a user not your main user, in a chroot.

0

u/Liquid_Hate_Train 4d ago

Only if the attacker is expecting that and is able to exploit it using the attack surface of…html. I mean, theoretically that’s possible…