10 ms·
Tor Browser 6.0 is released
- Razengan 10y agoIt's still super slow, as in the UI (especially the scrolling) on OS X on a Retina Macbook (Early 2015). I wonder if it's my DownThemAll add-on.
- lqdc13 10y agoDef shouldn't install any addons.
- na85 10y ago>OS X on a Retina Macbook (Early 2015). Why do apple users do this? Do you really not know what's under the hood of your macbook? Honest question.
- rimantas 10y agoWhy would it matter what's under the hood? I care much more about what I can do than what's inside.
- garrettgrimsley 10y agoBecause we're specifically talking about performance issues, and the issue could very well be what's inside. In this case, the model of computer is given so that we know what's inside.
- kccqzy 10y agoBecause it makes more sense to specify a single model/year than exhaustively list all the under-the-good configurations which others can quite easily look up?
- na85 10y agoThat makes no sense. He's only got one laptop, why would he exhaustively list all the configurations?
- Razengan 10y agoAre you referring to the omission of the exact specs? I don't think there's much variation if any among the first-gen 12" Retina MacBooks, and with Macs usually saying the size+year+class is enough to get an idea of the specs or look them up. Or are you saying it's because of weak hardware? Other, arguably more taxing software runs fine, but TorBrowser suffers from an uncanny slowdown.
- tosseraccount 10y agoIsn't a lot of this longer routing of packets?
- garrettgrimsley 10y agoThey're referring to application performance, specifically UI, not network latency.
- Razengan 10y agoCorrect. I gave up trying to figure it out, wiped my settings, redownloaded TorBrowser and it is fine now, even after reinstalling my add-ons.
- Razengan 10y agoToo late to edit but I agree with the other poster about not installing add-ons, if you're serious about privacy. However I just use TorBroswer as a quick proxy to bypass my network's blacklists.
- deleted 10y ago[deleted]
- elros 10y agoI have absolutely no idea. I can tell you my last computer was a 4 x 1GB Kingston HyperX on a Q9450 Core 2 Quad with a Gigabyte GA-X48-DQ2 motherboard, and it's been a few years. I only know my Mac has 16GB of RAM, and that's part of the beauty of it.
- y7 10y agoIt's one of the most common laptop brands. Specs are easily looked up, and even without looking it up this tells people it's a relatively new laptop, so specs are probably at least half decent.
- Tinyyy 10y agoIt has a Core M though.
- vbezhenar 10y agoThat's an official model name.
- kawsper 10y agoIt might be the name of his model, mine is: MacBook Pro (Retina, Mid 2012). It might tell you more than "2.6 GHz Intel Core i7"
- LeonM 10y agoBecause that's how apple indicates the 'version' or 'revision' of the model, instead of just numbering they give the 'produced from' date. Kinda like car manufacturers distinguish the different versions of a given model (i.e. the 2012 Tesla model S and 2016 Tesla model S). Also, since you can't tell from looking at the laptop (they are all identical since the first retina macbook from 2012), you must go to the 'about this mac' menu, which gives you the model name and revision date. In my case this is "Macbook Pro (Retina, Mid 2012)". When I used to build my own PC's, I could tell you the brand, model, revision etc of every component inside, but since just about every internal part of an Apple laptop (motherboard, SSD, memory etc) is custom fabricated, there is no point in trying to remember what's inside. I know my laptop has the 'second fastest' i7 I could choose from in that time, and the 16GB memory option, but don't ask me which specific i7 or which DDR type I have, I don't know and honestly I no longer care.
- raarts 10y agoI don't see a problem here. The exact model of CPU, memory and other chipsets are irrelevant to me. As long as I can work comfortably on it. I also don't care what's under the hood of my car. I'm technical enough to find out and study it and discuss it, but I'd like to focus on other things. The Macbook is just a tool to me. And one I'm very satisfied with. So I'm very happy there are only a few models which can accurately be referenced by using the model and year.
- wtbob 10y ago> I also don't care what's under the hood of my car. Well, if you're a Mac user then presumably the hood of your car is welded shut.
- Volt 10y agoThis might surprise you, but very few people even look under the hoods of their cars. This even includes non-Mac users.
- schoen 10y agoThere used to be a free software advocacy slogan explicitly asking "would you buy a car with the hood welded shut?". An intuition behind that analogy, I think, is that people will appreciate the importance of being allowed to do car maintenance even if they don't do it: that non-car-tinkerers will still see the value in having a hood that they can open. For example, they'll want to be able to choose others to perform the maintenance or not be dependent on the manufacturer in an emergency. Maybe sufficiently Apple-like car companies will succeed in changing that intuition or have already changed it quite a bit?
- na85 10y agoWhen you're discussing performance, then the hardware that's ostensibly underperforming is relevant. To use your analogy: If our cars are the same model year but mine is faster and you're wondering why or just complaining about it, maybe you'd care what's under the hood then.
- ajoy39 10y agoSure I do. So, likely, do you and most other people reading it, or at least have a general idea. So what's the point of typing out my specs? Should I also type out the specs of my Nexus 6P or just tell you I have a Nexus 6P?
- Nullabillity 10y agoFor worse (or better, but not really), phones are a lot more customized than laptops. A Nexus 6P that uses a Snapdragon 810 might have it set up differently a HTC One M9. I remember some reviews were talking about how the 6P wasn't throttling as hard as other 810-powered phones. An i7-6700K will be and perform the same as any other 6700K, save for poor cooling and aftermarket overclocking. Unless the model does something special with the components (it shouldn't) then just typing out the components is what matters, not whether (or when) Acer, Apple, or ASUS designed the chassis.
- na85 10y agoI don't memorize the specs in Apple products, so I actually have no idea what's under your laptop's hood. I can tell you that my thinkpad is an i7 with 16GB of memory, so if it ran slow on my machine I'd blame the browser. My point was that you spend just as many keystrokes to tell the reader it's a late 2015 model macbook pro as you would to type out "i5/8GB" or whatever, but the phrase "late 2015 macbook" means literally nothing to some readers.
- subliminalpanda 10y agoAre there any privacy concerns if ublock origin extension is used with the Tor browser?
- driverdan 10y agoNot necessary if you disable JS, which you absolutely should do if you care about privacy while using Tor.
- bjacobel 10y agoAnything you do like this to "customize" the default Tor Browser install can reduce your privacy instead, as it provides a factor by which you can be fingerprinted and differentiated from the larger base of users using the Tor Browser as-is. Source: see the Tor Browser docs on why they enable JS by default (though NoScript is installed and can be configured to block all JS, if you know the risks) https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
- animeweedlord 10y agoThere are any number of ways to deanonymize users once javascript is running, not to mention the greater possibility of escaping the sandbox. It's a damned if you do, damned if you don't scenario. I know they're trying to serve users that can't be expected to play the whitelisting game, but they really should be stricter here. It's already trivial to differentiate a Tor user from a regular one, they might as well set the most secure defaults possible.
- omginternets 10y agoI'm not an expert in the field, but my understanding is that you can be (partially?) fingerprinted based on the ads you (fail to) download. I also believe such partially discriminating information can be combined with other patterns (time at which you connect, sites visited, etc) to compromise your privacy. I have no idea if this is problematic in practice, though.
- robinduckett 10y agoI often wonder why Tor is bundled within Firefox, would it not be easier to release an app that changes the proxy settings / network routing at a system level? That would let you use your preferred browser, rather than being forced to use the browser Tor chose to bundle.
- iokanuon 10y agoTor is not bundled with a browser. Tor Browser is, but Tor Browser is not Tor, it's a browser with Tor built-in and extra privacy features, such as NoScript.
- joosters 10y agoThe problem is that many user settings and add-ons would defeat the privacy protections in Tor. For example, Javascript and Flash, as well as many other browser features. By bundling a separate browser, Tor can provide sensible defaults to protect users.
- viktorelofsson 10y agoMy guess is so it makes it harder to fingerprint people. If I remember correctly the advice is to not resize the browser window, etc.
- valarauca1 10y agoThis. The default tor browser ensures most tor users look identical so malicious services cannot finger print individual users. It disables a small group of firefox features which make finger printing extremely trivia (RPC Chat, GPU access). In most cases of people being de-anonimized on TOR they're normally running an alternative browser, or out of date TORbrowser.
- draugadrotten 10y ago> out of date TORbrowser. isn't everyone using TOR today using tomorrow's out of date TORbrowser? Meaning that traffic today can be recorded and analysed for vulnerabilities tomorrow.
- akerro 10y agoCould anyone elaborate why tracking protection was removed? https://trac.torproject.org/projects/tor/ticket/17167 https://trac.torproject.org/projects/tor/ticket/17167
- ryanlol 10y agoPresumably because it's normally off by default?
- nxzero 10y agoThis support ticket, which is linked to from the ticket you linked to, appears to say that the reasoning is related to semantics of security related to the security slider: https://trac.torproject.org/projects/tor/ticket/17898 https://trac.torproject.org/projects/tor/ticket/17898
- TazeTSchnitzel 10y agoAs mentioned in the ticket, Tor is opposed to filter lists: https://www.torproject.org/projects/torbrowser/design/#philosophy https://www.torproject.org/projects/torbrowser/design/#philo... Firefox's “Tracking Protection” is one of these.
- akerro 10y agoThat's stupid and inconsistent, I read the ticket and philosophy section. At the same time they add 3rd party NoScript extension that blocks JS, suggest to turn it on to 'safe' level that breaks 80% of websites and a lot of functionality on other websites, and they remove core functionality that blocks tracking, improves security and privacy and breaks less sites...
- mtgx 10y agoIt's a shame Firefox still lacks sandboxing even in version 45, even though they've been promising it for version 42 or 43. I hope Mozilla does end up making a new browser in Rust, so Tor could use a safer platform.
- secfirstmd 10y agoJust clicked on this link from Heathrow Airport public wifi and got a certificate warning: https://twitter.com/roryireland/status/737626851749679105 https://twitter.com/roryireland/status/737626851749679105
- Cakez0r 10y agoAirports usually do SSL MITM so they can inspect the traffic. Or they redirect all addresses to a hotspot sign-in page until the user signs in.
- themartorana 10y agoReally wish this was illegal or SSL didn't have such a gaping vulnerability.
- mikegerwitz 10y agoThere is no gaping vulnerability. The user will be presented with a certificate error (or denied outright, depending on the browser). If the user decides to add an exception, only then will a handshake succeed and the MITM be possible (in this particular scenario).
- NotreDev 10y agoNot what you were replying to, but SSL does provide for MITM outside of the options offered in your response. I.e. https://mitmproxy.org https://mitmproxy.org
- kecks 10y agoNo? The link you posted is indeed a MITM proxy for SSL, but it will generate certificate errors, as my grandparent said. Users will know the MITM attack is going on (unless the website doesn't use HSTS and the attacker has stolen/bought a signing key from a CA registered in your device's trust store).
- elsen 10y agoTor Browser... You mean Loki?
- needusername 10y ago> But for a while now Disconnect has no access to Google search results anymore which we used in Tor Browser. Disconnect being more a meta search engine which allows users to choose between different search providers fell back to delivering Bing search results which were basically unacceptable quality-wise. While Disconnect is still trying to fix the situation we asked them to change the fallback to DuckDuckGo as their search results are strictly better than the ones Bing delivers. Ouch
- iamgopal 10y agoIn alternate world, where Tor is a dominantly used browser, How will hypothetical google works ? ( i.e. Autonomous content discovery ? )
- kerkeslager 10y agoThere's nothing hypothetical about tor search engines. A small list can be found here: http://www.thehiddenwiki.net/deep-web-directories-search-engines/ http://www.thehiddenwiki.net/deep-web-directories-search-eng...
- djsumdog 10y agoTor/Mozilla still haven't gotten the FBI to reveal how their pulled of their most recent Tor attack have they (not the CMU one, but the kiddy-fiddlers one). Many have put forth those users were using flash, plugins or were convinced to download and execute something, but we don't know do we? And until developers do, the Tor Browser bundle could have a vulnerability that could compromise its main purpose.
- nikcub 10y agoFirefox exploit similar to the 2013 attack[0] The zerodium price list has Firefox 0day at $30k[1] a pop - compared to $100k+ (today ~$1M) for Chrome The long term solution for Tor Browser is to build on Chromium + Containers/VM + Isolating proxy [0] https://www.wired.com/2013/09/freedom-hosting-fbi/ https://www.wired.com/2013/09/freedom-hosting-fbi/ [1] https://www.wired.com/2015/11/heres-a-spy-firms-price-list-for-secret-hacker-techniques/ https://www.wired.com/2015/11/heres-a-spy-firms-price-list-f...
- e12e 10y ago> The long term solution for Tor Browser is to build on Chromium + Containers/VM + Isolating proxy Surely text-mode gopher would also be more secure? (Only half-joking)
- nisa 10y ago> Surely text-mode gopher would also be more secure? I guess early nineties, late 80ies network C code is wonderful for security! On the plus side it let's less to audit. And you rewrite it in a secure language.
- amluto 10y agoIt wouldn't be particular hard to sandbox Tor Browser on Linux and use namespaces such that the browser itself has limited ability to fingerprint its host or learn its host's IP.
- deftnerd 10y agoI'm excited that they're now based on a Firefox branch that supports Subresource-Integrity. This allows websites to add hashes of externally called resources, like JS or CSS files, to let the browser determine if they've been modified.
- runeks 10y agoI'm very happy to hear this practice has become reality. It just seems so much more convenient to refer to all these JS/CSS blobs with a universally unique ID (a hash), rather than whichever CDN the developer has chosen to use. As an ID, a 32 byte cryptographically secure hash really is practically the same as http://somecdn.com/somejslib/v0.1.js.min http://somecdn.com/somejslib/v0.1.js.min, except that only a single ID exists for each "shared object", plus the ID can be derived deterministically from the object it refers to. Perhaps each CDN could have a symlink in its root directory with the hash of each file it serves, redirecting to that file. Then you'd be able to find any file by its hash as long as you have the CDN host name. EDIT: I see now this is a security measure (protection against a hostile CDN), rather than a way to avoid dependence on a single CDN. I hope what I suggest is still possible though.
- martin1975 10y agoMight be the only one here, but I'm looking forward to a day when Tor Browser is Servo based.
- thiht 10y agoWhat would be the advantages for Tor Browser?
- martin1975 10y agotoo many to list.
- vaadu 10y agoHow do you deal with corp computers that quarantine tor.exe with something like McAfee? I can copy in a renamed version of tor.exe but I'm not sure what file(s) to change to use the new filename.
- sudojudo 10y agoBoot to a live CD/USB based OS. Keep in mind that even outside of a corporate environment, Windows is not private.