In order to obtain such information, an application would have to find a way “break out” of VirtualBox, or to subvert the Gateway (perhaps through a bug in Tor or the Gateway’s Linux kernel).

User applications therefore have no knowledge of the user’s “real” IP address, nor do they have access to any information about the physical hardware. The Workstation VM can “see” only IP addresses on the Internal LAN, which are the same in every Whonix installation. It is connected only to the internal virtual LAN, and can directly communicate only with the Gateway, which forces all traffic coming from the Workstation to pass through the Tor network. The Workstation VM runs user applications. The following is an excerpt taken from the Whonix Wiki To be honest I don’t know if there are any know cases, however someone from the whonix team would be better suited to answering that question for you. I don’t think there is a lot you could do if a state actor wanted to ID you.Īs I’m sure you know anything is possible but I believe whonix is designed to prevent your Ip from leaking out or being exposed to the host or attacker. There is one thing I do know, depending on your threat model having no scripts may not be enough to prevent someone from obtaining your identity/ ip. This is not an area I know a lot about so I’m going to leave this up to someone else to explain.

I know you said you temporarily enable java script on certain sites and sometimes you have not choice but to disable no scripts for site functionality but you could still be tracked.(e.i You could develop a pattern of visiting the same sites at the same time everyday ) This could be further exacerbated if you have installed additional browser plugins.Īnother thing disabling no scripts could do is open you up to possibility of malicious java script executing in your browser. You have to have java script enabled to use it.

There is also the EFF’s Panopticlick which will show you how unique your browser is. Web Browsers Leave ‘Fingerprints’ Behind as You Surf the Net. The EFF has a good little article on it with a few links you may be interested in. That in turn could be used to track you as you search the web. I know enabling java script could allow web sites to fingerprint your browser.

How to disable javascript in tor 2017