[xeeeeeeeeeeenu]

> If you access an http site, a government controlled exit node could inject js and eventually gather enough info through profiling mouse movements and browsing habits to ID you.

That's why Tor Browser comes with NoScript.

[yjftsjthsd-h]

And why it's so annoying that it nonetheless sets it to ALLOW JS by default.