[tor-bugs] #12671 [meek]: Does meek's network-facing browser run javascript?

[Tor Bug Tracker & Wiki]

#12671: Does meek's network-facing browser run javascript?
--------------------+---------------------
 Reporter:  arma    |          Owner:  dcf
     Type:  defect  |         Status:  new
 Priority:  normal  |      Milestone:
Component:  meek    |        Version:
 Keywords:          |  Actual Points:
Parent ID:          |         Points:
--------------------+---------------------
 Can Amazon S3 pass javascript to meek's network-facing browser (i.e. the
 copy of Tor Browser that it runs with a separate profile), and it will run
 it?

 Seems like disabling javascript would provide a way for S3 to distinguish
 meek users from the typical web user, but leaving it enabled would be sad
 (and surprising) for users who prefer to disable javascript. That said,
 there are already other ways for S3 itself to learn that it's a meek user,
 and there shouldn't be a way for an external observer to learn whether
 they run it? And in that case it would be wise to lock down meek's browser
 at least as much as tor browser itself?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12671>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online