Anonymizers are the services that help make a user's own Web surfing anonymous. An anonymizer removes all the identifying information from a user's…

Anonymizers, which typically function as web proxies, are limited by technologies that can execute code on the client-side and establish network connections independent of the browser's proxy settings. Java applications, ActiveX controls, and browser plugins (e.g., Flash) can create their own direct network connections, bypassing the anonymizer and revealing the user's true IP address. JavaScript can leverage APIs like WebRTC to discover the real IP address or perform advanced browser fingerprinting. Secure protocols, particularly non-HTTP/S protocols, may not be supported by the anonymizer. Even with HTTPS, advanced mechanisms like certificate pinning can interfere with the Man-in-the-Middle process required by the anonymizer, potentially breaking functionality or leaking information.

All the provided options are correct and represent significant limitations to web-based anonymizing services.

1. The Tor Project

Inc.

"The Design and Implementation of the Tor Browser" (2024). In the section "Plugins and Scripting

" the document explains why plugins like Flash

RealPlayer

and Quicktime are a security risk for anonymity: "Plugins typically run as separate processes with the full permissions of the user... they can likely ignore the Tor proxy settings and may be able to perform their own network activity that will not be anonymized." It also details the risks of JavaScript for fingerprinting. (Available at: https://2019.www.torproject.org/projects/torbrowser/design/)

2. Dingledine

R.

Mathewson

N.

& Syverson

P. (2004). "Tor: The Second-Generation Onion Router." Proceedings of the 13th USENIX Security Symposium. This foundational paper on Tor discusses application-level risks

stating

"Applications can leak identity information in the protocol... For example

many web browsers will happily run active content such as Java or ActiveX..." (Section 6.1

Page 15). (Available at: https://www.usenix.org/legacy/events/sec04/tech/fullpapers/dingledine/dingledine.pdf)

3. Eckersley

P. (2010). "How Unique Is Your Web Browser?" Proceedings of the 10th Privacy Enhancing Technologies Symposium. This paper demonstrates how JavaScript can be used to gather detailed information from browsers

creating a highly unique fingerprint that can de-anonymize users even if their IP address is hidden by a proxy. (DOI: https://doi.org/10.1007/978-3-642-14527-81)

4. Boneh

D. (Course Instructor). "CS 255: Introduction to Cryptography and Security." Stanford University. Course lectures on anonymity and privacy systems like Tor frequently cover the limitations and attack vectors

including IP address leaks via browser plugins (Java

Flash)

active content (JavaScript

ActiveX)

and protocol-level leaks. (Course materials available via Stanford University's Computer Science department website).