TOR Project: Stop using Windows, disable JavaScript
The anonymizing network gives some advice following a startling Firefox zero-day vulnerability — The TOR Project is advising that people stop using Windows after the discovery of a startling vulnerability in Firefox that undermined …
Context & Ripple Effects
The advice lands one day after Wired's report on malware suspected of being deployed by federal agencies against Tor anonymity, which gives the TOR Project's guidance its urgency: a confirmed Firefox zero-day is undermining user security at exactly the moment suspicion points at well-resourced attackers.
It also extends an old playbook — when Microsoft's Internet Explorer had a zero-day in late 2008, users were told to switch browsers; the TOR Project's answer in August 2013 is to switch operating systems entirely and cut JavaScript. The pickup was broad for a mailing-list advisory, with TechSpot, Quartz, ZDNet, Gizmodo, Bitdefender Labs and others all running the story within a day.
First-order effects
- Tor users on Windows face immediate exposure through the confirmed Firefox zero-day, and the TOR Project's fix degrades their own experience — disabling JavaScript breaks much of the interactive web inside the anonymizing browser.
Second-order effects
- Mozilla faces pressure to ship a Firefox fix fast, while Microsoft takes reputational damage it did not cause: the advisory treats Windows itself, not any specific Windows bug, as the liability for at-risk users.
Third-order effects
- If government-suspected attackers keep targeting the anonymization stack, high-risk users will drift toward hardened configurations — JavaScript off by default, non-Windows platforms as the recommended baseline — making 'abandon the mainstream platform' a recurring incident response rather than a one-off.
The trend: Exploit-driven security advice is escalating from 'switch browsers' to 'switch platforms,' with state-suspected adversaries against anonymity networks setting the threat model.