JavaScript isn’t normally a security risk, but if you’re trying to hide your IP, you don’t want to use JavaScript. JavaScript is disabled, plug-ins can’t run, and the browser will warn you if you attempt to download a file and open it on another application.

The Tor browser bundle, which we covered when we explained how to use Tor, comes preconfigured with secure settings. JavaScript, Plug-ins, and Other Applications Can Leak Your IP

Bear in mind that your traffic could be monitored – not just by governments, but by malicious people looking for private data. Lesson: When using Tor, be sure to use encrypted (HTTPS) websites for anything sensitive.

The users in question made the mistake of not using encryption on their email system, believing that Tor would somehow protect them with its internal encryption. In 2007, a security researcher intercepted passwords and email messages for a hundred email accounts by running a Tor exit node. It’s likely that governments run some exit nodes and monitor the traffic that leaves them, using what they learn to investigate criminals or, in repressive countries, punish political activists. People must consent to run exit nodes, as running exit nodes puts them at more of a legal risk than just running a relay node that passes traffic. if you’re accessing an unencrypted website, the exit node can potentially monitor your Internet activity, keeping track of the web pages you visit, searches you perform, and messages you send. If you’re accessing an encrypted (HTTPS) website such as your Gmail account, this is okay – although the exit node can see that you’re connecting to Gmail. In the below diagram, the red arrow represents the unencrypted traffic between the exit node and “Bob,” a computer on the Internet. This node where traffic exits the Tor network is known as an “exit node” or “exit relay.” The last Tor node, where your traffic leaves the Tor network and enters the open Internet, can be monitored. For example, let’s say you are connecting to Google through Tor – your traffic is passed through several Tor relays, but it must eventually emerge from the Tor network and connect to Google’s servers.

However, most Tor traffic must eventually emerge from the Tor network.

Tor browser bundle safe