Can I detect Tor Browser inside the browser itself, via Javascript I suppose?

Question

I\'d like to disable some features of a web app I\'m building, if the browser is Tor Browser. Can I inside the browser itself (client side, not server side) find out if the

Answer 1

There is no reliable way to detect the TOR Browser... That's kind of a goal of that browser. If you find a reliable way, chances are somebody else finds it too, tells the TOR developers and they close it.

E.g. all TOR Browser bundles report bogus, but reasonable User-Agents. The current release version e.g. says it is Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0 no matter what OS you're actually using.

You may apply some heuristics to detect a TOR Browser with a certain probability, but will also generate some false-positives...

• Check the user agent. TOR Browser will report the latest Firefox ESR on a certain OS, currently Windows 7 32-bit (but some users might have changed that again and other users might simply use the ESR release but not the TOR Browser)
• Plugins are disabled, so navigator.plugins will be empty (but some users might have re-enabled plugins again).
• etc.
• Detect the browser actually uses the TOR network.

Of course, you'll have to keep your checks up to date, so it requires a fair amount of maintenance busywork.

Personally, given the less than stellar detection results, maintenance burden and very modest experience improvements for users, I wouldn't try to handle TOR Browser differently at all.