19 ms·

Mozilla Project Fusion: Tor Integration into Firefox

757 points by jerheinze 8y ago

fredley 8y ago
Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?
- StavrosK 8y ago
  This is the biggest misconception about Tor. Tor provides anonymity, but any node (EDIT: any exit node) can read what you're sending if it's not encrypted. You need both.
  - detaro 8y ago
    nitpick: exit node. The ones on the way can't, neither can any if you access hidden services.
    - StavrosK 8y ago
      Yes, sorry, I should have specified.
  - crankylinuxuser 8y ago
    That's definitely not true if your endpoint you're talking to is an *.onion . A connection to an Onion is encrypted to the destination. That also means if you were running, say NodeRed with authentication, sending credentials "over the clear" (no SSL cert, because stupidity) it's not actually sent over the clear. It's encrypted to the public key relating to your onion address. Now, if you're using Public Internet->Tor->Public Internet, then absolutely yes the last node CAN read the contents of your packets. In that case, you absolutely need appropriate encryption to hide the contents (sigh, not the metadata) of your packets.
    - LinuxBender 8y ago
      I would still prefer https on a .onion. If tor itself is popped, then traffic can be routed or mirrored to another host. This has happened in a PoC and was fixed in a security update in one of the alpha releases. There are additional fixes required for HS that are coming. If the target is using https, you can see if the signature changes (there are addons for this). Digicert will sign .onion domains, though the hidden site must be willing to share their identity with Digicert. I would love to see LetsEncrypt sign .onion domains, assuming they are willing to connect back to a .onion to validate the server.
      - detaro 8y ago
        The CA/B Forum rules only allow EV certificates for .onion, so even if Let's Encrypt wanted they couldn't give out .onion certificates without getting that changed first.
        LinuxBender 8y ago
        Oh right, that is a good point. I suppose Digicert is the only option for now then. Perhaps the Tor team or an affiliate could set up a simplified CA and have a public CA cert restricted to .onion that folks could install as a work around to having browsers trust it by default.
        schoen 8y ago
        I'm trying to get that rule changed and working with several other organizations on this.
        detaro 8y ago
        Are there public discussions somewhere yet? I always find it interesting to peek into these processes.
        schoen 8y ago
        We talked about it in this thread in November. https://cabforum.org/pipermail/public/2017-November/thread.html#12451 https://cabforum.org/pipermail/public/2017-November/thread.h... Since then Fotis Loukos and I have drafted a ballot, which I believe he plans to introduce soon after asking a few other organizations to look it over. You can subscribe to the cabfpub mailing list without becoming an Interested Party or Member. Only Interested Parties or Members can post to the list, while only Members can introduce or vote on ballots. (Edit: Strangely, the reason for this is seemingly not that they're worried that the general public will make crazy suggestions, but rather that the general public will make patented suggestions, without being willing to license them according to the Forum's patent policy, and thereby sneak patented technology into the standards.)
- akerro 8y ago
  You -> Tor node -> Tor node -> Tor Exit node -> http/https clearnet -> NSA/GCQH/BND/you name it -> destination server
- shp0ngle 8y ago
  If you connect to a clearnet website, the clearnet website is fetched by the exit node. If it's not HTTPS, the exit node can change the website however it wants.
- jerheinze 8y ago
  https://www.torproject.org/docs/faq.html.en#CanExitNodesEavesdrop https://www.torproject.org/docs/faq.html.en#CanExitNodesEave... Yes, the guy running the exit node can read the bytes that come in and out there. Tor anonymizes the origin of your traffic, and it makes sure to encrypt everything inside the Tor network, but it does not magically encrypt all traffic throughout the Internet. This is why you should always use end-to-end encryption such as SSL for sensitive Internet connections. ``` Fortunately HTTPS adoption is much better now :)
  - akerro 8y ago
    >Fortunately HTTPS adoption is much better now :) It's HSTS what we need in 2018
    - crankylinuxuser 8y ago
      I disagree. Ive seen HSTS applied to things like Windows 10 updates, to prevent users from seeing what exactly your OS is sending to the mothership. Ideally, we should be able to see exactly the content being exfiltrated, and choose to allow/disallow. But the moment we use tools like ettercap or mitmssl, it kills the session and we can't see the data. HSTS seems more "self cutting" than useful at this juncture.
      - maerF0x0 8y ago
        If its truly your OS I think you can read all the network data you want to, including the key negotiation. Albeit its not the easiest thing to do.
      - kchr 8y ago
        The use of HSTS is a way to suggest to your clients that they use SSL for that domain - for all requests within a time span (which could be "forever"). If anything, the vendors you mention should be applauded for taking that step towards a more secure distribution of updates. Not enforcing SSL makes malware injection through updates way way easier. Debian introduced HTTPS repos a while back as an option, but not by default. Other distros already offer it.
- stordoff 8y ago
  If you're connecting to a clearnet site, you probably need HTTPS _more_ than on a standard connection - you _explicitly_ have a node between you and the site that you don't necessarily trust (see, e.g., https://nakedsecurity.sophos.com/2015/06/25/can-you-trust-tors-exit-nodes/ https://nakedsecurity.sophos.com/2015/06/25/can-you-trust-to...).
- HugoDaniel 8y ago
  anonymity /= confidentiality you can stay anonymous while making sure anyone can read what you are sending. you can send confidential messages while making sure anyone knows who you are. you can also combine the two :)
  - oconnor663 8y ago
    > you can stay anonymous while making sure anyone can read what you are sending. That depends a lot on what you're sending. Tor stops people from identifying you based on your IP address, but you can still identify yourself by logging in on http://not-encrypted.com http://not-encrypted.com.
- Lennie 8y ago
  Please read and play with the graphics on this page, it explains it all: https://www.eff.org/pages/tor-and-https https://www.eff.org/pages/tor-and-https
sp332 8y ago
The page isn't loading for me. https://web.archive.org/web/20180601141754/https://trac.torproject.org/projects/tor/wiki/org/meetings/2018Rome/Notes/FusionProject https://web.archive.org/web/20180601141754/https://trac.torp... (https://archive.org/donate https://archive.org/donate)
- maerF0x0 8y ago
  it worked after a few tries for me. I believe its just serverload, keep trying or try later
  - sp332 8y ago
    I'm sure it is just overloaded. But there's no point kicking it when it's down. Use a mirror for now.
ogennadi 8y ago
> Ultimate eventual goal: Make Tor Browser obsolete, so Tor Project can focus on research instead of maintaining a fork of Firefox.
- maerF0x0 8y ago
  Hopefully other browsers are encouraged to do something similar also, else Mozilla will effectively control the destiny of Tor
  - jerheinze 8y ago
    Brave is already working on Tor private tabs though it won't have the same fingerprinting/first-party isolation guarantees as with a Tor Browser, https://github.com/brave/browser-laptop/labels/feature/tor https://github.com/brave/browser-laptop/labels/feature/tor Should be shipping soon https://twitter.com/BrendanEich/status/984231250104733696 https://twitter.com/BrendanEich/status/984231250104733696
- sametmax 8y ago
  Good, now if only we could have bitorrent baked in... EDIT: I mean baked in in the browser like tor, not baked in tor. Although interesting, it's really not my priority.
  - kleiba 8y ago
    Honest question: is bittorrent even still a thing?
    - iwaffles 8y ago
      It is. For both legitimate and nefarious uses. Bigger software/game devs still use bittorrent to distribute patches and updates—World of Warcraft is an example.
    - d33 8y ago
      It definitely still is. And with the concept of private trackers, it's not really a simple thing to turn off. Companies like IP Echelon tend to automatically bully US/cloud users, but in general they're IMHO far from killing the network. The only problem is that there's fewer and fewer torrent search engines...
mtgx 8y ago
I've been waiting for this for years. Good job convincing Mozilla to do this! Good idea to standardize the spec, too. I hope they give a good name to this new super-private mode (which actually isn't too bad of a name, either). I also hope they don't just implement a "more private" mode in Firefox, but also a more hardened mode for Tor. The Tor mode in Firefox should use the strictest possible sandboxing technologies available to them from the operating system (file system virtualization, etc). I'm even talking about those new fancy hypervisor-based micro-VMs in Windows 10, which I believe they are called Krypton containers, and it's what Edge uses within the Application Guard context. Although if the users have to enable Hyper-V/Micro-VMs first in Windows, then maybe this hardening mechanism should be optional, but encouraged. Otherwise, it should probably be the default. https://www.zdnet.com/article/how-containers-will-transform-windows-10-in-the-next-three-years/ https://www.zdnet.com/article/how-containers-will-transform-... Oh, and this hardened mode should use a different process for every tab/extension, too, by default, just like Chrome does. I still don't think Mozilla's "hybrid" approach makes it as secure as Chrome (which is why it's a hybrid/compromise for lower memory usage).
kodablah 8y ago
Cool, now let me start an ephemeral v3 onion service from JS and have it reachable via WebRTC by a peer who has their own. It's the perfect tech marriage, removes signalling servers and NAT busters, but may be a bit taxing on directory servers and too slow to use for media streams (but I'll take data channels only).
- SlowRobotAhead 8y ago
  I know some of those words. (I'm an embedded programmer)
- Hello71 8y ago
  sounds really useful, but to be fair, it doesn't really remove either. you're effectively just using the Tor network as freely available (but slow) signalling and TURN servers.
  - kodablah 8y ago
    Exactly. Doesn't require any server side work and you get built in anonymity across peers and for discovery.
- floatboth 8y ago
  Hah, kinda reminds me of Opera Unite. (That one wasn't from JS, it offered some fixed applications like file hosting, notes, etc., but it was hosting stuff from the browser)
  - gsnedders 8y ago
    Unite allowed server-side JavaScript (though I forget how many privileged APIs there were), but I don't think you could support custom protocols.
forapurpose 8y ago
What will Mozilla do about the Tor network's usability problems? Advanced users can workaround them and because they understand the benefits and engineering, accept the frustrations as a cost for a worthwhile (and free) technology. But what will non-technical users do? Many public Internet websites filter connections from the Tor network, many other websites are very slow, yet others impose extra obstacles such as multiple rounds of captchas (even 5 or more) or degraded service (including high suspicion of payments), and of course you often will receive webpages in the wrong locale or language - which can trigger regional filters. Currently, workarounds requires resetting the circuit (few non-technical users will even understand what the circuit is), lots of patience and reloads, and often just giving up. [EDIT: And non-technical users won't understand what is happening and therefore won't know when to use which workaround.] If that's the experience of typical Firefox users, they won't use it and they will have bad associations with Tor and Firefox.
- cup-of-tea 8y ago
  Why would Mozilla do anything about that? It's not like this is going to be enabled by default in Firefox.
  - Hello71 8y ago
    FTFA: Whether there will be two private browsing modes is to be determined.
- Hello71 8y ago
  Which sites in 2018 still present multiple CAPTCHAs to users with cookies and JavaScript enabled? I think the theory behind this project is that those problems are primarily caused by Tor's popular image as a 'fringe network for pedophiles and drug dealers' and that by making it more mainstream they can fix those issues. (please more replies saying "that sounds really hard" and less replies saying "tor is not a fringe network for pedophiles and drug dealers", thanks)
  - paulie_a 8y ago
urda 8y ago
Mozilla keeps driving for the users on the internet. I know many of my own frustrations came from the fork that is Tor. This work is great to see.
- jerheinze 8y ago
  > I know many of my own frustrations came from the fork that is Tor. What are your frustrations with the Tor Browser?
  - tgragnato 8y ago
    There is a gap between the safer and safest security level: sometimes I want to display icons and symbols but don't want js to run. Installing additional extensions is discouraged; but in my experience Decentraleyes makes latency somewhat less disturbing, CAPTCHAs appear less often; and uBlock Origin is essential [-]. [-] shipping with every available filter list enabled and cached may be a good enough default
    - jerheinze 8y ago
      > Installing additional extensions is discouraged; but in my experience Decentraleyes makes latency somewhat less disturbing, CAPTCHAs appear less often; and uBlock Origin is essential [-]. > > [-] shipping with every available filter list enabled and cached may be a good enough default See https://bugs.torproject.org/22089 https://bugs.torproject.org/22089 and https://bugs.torproject.org/17569 https://bugs.torproject.org/17569
Vinnl 8y ago
If I understand it correctly, you shouldn't be using any website accounts using Tor browser that you also use outside of it. I really wonder if/how they can make the user properly aware of that in a kind-of super private browsing mode.
- kodablah 8y ago
  "Multi-Account Containers"
  - Vinnl 8y ago
    I'm not quite sure what you mean by this comment, but if you mean that their approach would be similar to MAC, in the sense that "super private browsing" would have to be enabled in about:config or through an extension: that would make sense.
    - kodablah 8y ago
      This: https://support.mozilla.org/en-US/kb/containers https://support.mozilla.org/en-US/kb/containers
      - Vinnl 8y ago
        I know the extension, but what does that have to do with informing users about not using their account when browsing with Tor? Heck, informing users about being able to use different accounts with Multi-Account Containers was already such a hard problem that they opted into shipping it as a separate extension, so it's only used by power users.
        kodablah 8y ago
        How I'd do it is have a warning when using Tor outside of the designated Tor container. That is, encourage the installation of the extension when enabling a "Tor" tab (permanently dismissable of course). Alternatively they could co-opt the private-browsing window (a.k.a. incognito) feature to have a tor-browsing window. The latter might even be preferred since the former is only at the tab level and probably quite easy to forget whether you are in Tor before entering an address. It appears to be what is suggested in the notes (now that the link is up).
_bxg1 8y ago
This would be amazing. The main reason I've never used Tor is the fear that it would make me look like I had something to hide (instead of just a general desire for privacy). If it were built into Firefox, I'd probably switch over from Chrome.
- jerheinze 8y ago
  > The main reason I've never used Tor is the fear that it would make me look like I had something to hide (instead of just a general desire for privacy). 1. You can hide the fact that you're using Tor by using pluggable transports which are already built-in the Tor Browser (such as meek-azure, obfs4, snowflake, ...). 2. That's the biggest reason as to why one must use Tor as much as possible even if they don't care about privacy. More people using Tor = the less interesting it is to be a Tor user.
- lucb1e 8y ago
  > it would make me look like I had something to hide That's exactly why I use it on a regular basis! Perhaps when looking up political or medical things (also for friends), it could be good to run that through Tor. That is not something to hide per se, but it is definitely not something that is anyone else's business, and you don't want to be bubbled.
devit 8y ago
I think Mozilla should look at using Servo instead of Gecko in this mode along with a new JavaScript interpreter written in Rust, at least optionally, since perfect security is essential when using a Tor browser without a dedicated VM.
- kibwen 8y ago
  Servo components are being uplifted into Gecko gradually. There's less benefit to rewriting the JIT in Rust because static type systems can only do so much when the whole goal of a program is to generate code dynamically.
  - devit 8y ago
    My suggestion was to have Firefox support both Gecko (with uplifted component) and a pure Rust renderer, with the latter to be used in the Tor mode where security (to preserve anonymity against resourceful adversaries) matters over compatibility. For security, instead of a JIT, a simple JavaScript bytecode interpreter written in Rust to be used exclusively in the Tor mode would be ideal, for maximum security at the cost of worse performance. Another option is a JIT that generates code that is easily proven to be safe (e.g. because it does a bounds check on all memory accesses and only does indirect jumps using a jump table, or because it's the only thing running in a process and jumps are still constrained with a read only jump table and read only code).
  - Yoric 8y ago
    Well, there is the ability to write something along the lines of https://github.com/nbp/holyjit https://github.com/nbp/holyjit :)
tomrittervg 8y ago
Hi all. I am a Tor Project Developer and work at Mozilla on this project. We appreciate everyone's enthusiasm and feedback. Our ultimate goal is a long way away because of the amount of work to do and the necessity to match the safety of Tor Browser in Firefox when providing a Tor mode. There's no guarantee this will happen, but I hope it will and we will keep working towards it. If anyone is interested in assisting development-wise, Firefox bugs tagged 'fingerprinting' in the whiteboard are a good place to start. You can also run Tor relays and help us improve the health of the network by working with Tor's new Relay Advocate (https://blog.torproject.org/get-help-running-your-relay-our-new-advocate https://blog.torproject.org/get-help-running-your-relay-our-...). More people being involved in spec work (especially at the W3C) and focusing on fingerprinting and privacy concerns is also very useful - it's very hard to keep eyes on all the things happening everywhere. We also appreciate users of Firefox Beta and Nightly (Nightly especially). The flags Tor features are developed behind (privacy.resistFingerprinting and privacy.firstparty.isolate) are experimental. I appreciate bug reports from users running these flags but you should expect them to break things on the web (resistFingerprinting especially; first party isolate is generally more stable and usually only has breakage on particular login forms).
- eganist 8y ago
  Thanks for your effort! If I can ask, how much overlap exists between your team and the team overseeing the implementation of security protocols within Firefox e.g. HSTS, CSP, etc.? It'd be neat to see Firefox drive innovation here alongside the effort to weave Tor into the browser; although I wouldn't necessarily treat Tor integration the same as I might the implementation of other security specifications, I can see how the teams working on such might overlap, hence my question.
  - tomrittervg 8y ago
    The Fusion project is done by a subset of that team (+me, I happen to sit with Sandboxing due to other responsibilities).
    - dat_boi20 8y ago
openfuture 8y ago
Okay but what about maidsafe, dat, ipfs etc. The correct solution is to have firefox expose a 'protocol api' or something along those lines so that any 'alternate internet' project can create a backend extension to make firefox compatible with that protocol.
- jean- 8y ago
  Seems like some people are working precisely on that. See for instance: https://blog.mozilla.org/addons/2018/01/26/extensions-firefox-59/ https://blog.mozilla.org/addons/2018/01/26/extensions-firefo... (CTRL-F Decentralization) https://github.com/mozilla/libdweb https://github.com/mozilla/libdweb
  - mtgx 8y ago
    That's amazing to see. Thanks for sharing. This is exactly the kind of tech Mozilla should be supporting - tech that gives users more freedom on the internet.
neokantian 8y ago
"Removing fingerprintability" amounts to the browser just NOT sending all the http request headers that it sends by default. How hard can it be to "comment out" these lines?
- zaphar 8y ago
  I don't think this is true. Especially in the case of things like canvas fingerprinting.
- bzbarsky 8y ago
  I just checked and there are over 100 checks for "should I have different behavior here if I am resisting fingerprinting?" just in the C++ code in Firefox today. There are some more in the JS code but they're harder to search for. Some simple examples: * Various navigator APIs (oscpu, platform, etc) need to be disabled. * Gamepad API needs to be disabled. * Have to prevent reading canvas pixel data * Have to block information about avaiable OpenGL extensions from WebGL * Modifier keys on keyboard events need to be spoofed (because they can be used to guess at keyboard layout) * Errors from the media stack (for <video> and <audio>) need to be blanked out. * Something to do with voice synthesis APIs; I didn't look into details. * Connection API needs to be neutered * Various timing APIs hanging off "performance" need to be neutered. * Presentation API needs to be neutered. * Number of CPUs reported by the navigator API needs to be spoofed. * Window sizing for window.open needs to be spoofed. * Ability to measure the difference between the window.inner* and window.outer* APIs needs to be disabled. * Mouse positions in mouse events need to be spoofed to make it look like the window is fullscreened. * Touch event positions need to be spoofed. * Geolocation needs to be disabled. And so on, and so forth.
  - gsnedders 8y ago
    Need to do something about fonts and the CSSOM (Element.getBoundingClientRect() for example), too. Just shipping a standard bundled set of fonts and only allowing use of that doesn't suffice because anti-aliasing width differences could give away the used font renderer.
bunkydoo 8y ago
I believe Tor browser is already just a version of Firefox if I'm not mistaken. What would be the advantage of integrating with Firefox as opposed to say, a VPN integrated into the browser via a plugin. Just seems a little redundant and Tor is beginning to seem dated also with new solutions popping up and making the pitfalls of Tor more apparent.
- ubershmekel 8y ago
  I imagine the idea is to have an incognito mode that actually is incognito, and free.
- Vinnl 8y ago
  I think an important part is to lessen the maintenance burden for the Tor project: if the code is in Firefox proper, Firefox developers will encounter it when working on other features and make sure they work together, whereas currently the Tor project needs to rebase their modifications onto "regular" Firefox.
- ec109685 8y ago
  The vpn owner knows all traffic flowing through it.
Endy 8y ago
So we lose another valuable project of the Web. I wonder why I feel so lost - that when I was young, the Internet was barely born... and now I'm watching it die.
- jerheinze 8y ago
  What's going to be lost?
  - Endy 8y ago
    Tor Browser. A single privacy-dedicated browser package; even if it is now being built on Chromefox.
- trumped 8y ago
  I agree and I don't really like how the internet is evolving either but this sounds like one of the good changes, unless I'm missing something
MayeulC 8y ago
Great news ! With wider adoption of ipv6 and all the good things that come with it (don't mistake me, they are great!) also comes the risk that each computer will get a uniquely identifiable IP address that will be used for fingerprinting. I've never really used Tor in the past, but this got me thinking about it. An option could be to provide a webRTC-based node, but I am not sure how feasible that would be, after reading some comments here. Maybe for entry nodes and guard nodes instead of exit nodes? The transient nature of browser sessions could greatly enhance privacy. Of course, you would need some algorithms to deal with this very nature... But I can imagine some. This surely lowers the barrier to entry for greatly enhanced privacy. Quite a lot of people seem to be aware of the private browsing mode, and I can imagine this being turned into a simple toggle on the private browsing home page, along with a short explanation (and a link to additional privacy tips). A low hanging fruit that could enhance the privacy a bit would be to use the trusted recursive resolver (DNS over https) in private browsing by default, since it already is part of Firefox. It just needs a default trusted resolver.
- tomrittervg 8y ago
  > An option could be to provide a webRTC-based node, but I am not sure how feasible that would be, after reading some comments here. I'll point you at FlashProxy (https://crypto.stanford.edu/flashproxy/ https://crypto.stanford.edu/flashproxy/) and Snowflake (https://github.com/keroserene/snowflake https://github.com/keroserene/snowflake) the latter of which is in active development. =)
  - jerheinze 8y ago
    https://trac.torproject.org/projects/tor/wiki/doc/Snowflake https://trac.torproject.org/projects/tor/wiki/doc/Snowflake
ccnafr 8y ago
Wasn't this launched in 2014? I see the wiki hasn't been updated since January. Is this a new push to get this done?
fwdpropaganda 8y ago
> How many more "super private browsing mode" Firefox users will there be? Potentially hundreds of millions of daily users. Tor has hundreds of millions of daily users?
- vntok 8y ago
  Of course not.
- jerheinze 8y ago
  https://metrics.torproject.org/userstats-relay-country.html https://metrics.torproject.org/userstats-relay-country.html
  - xur17 8y ago
    Does anyone know what caused the big spike in users at the end of last year?
    - jerheinze 8y ago
      Most likely a botnet.
- Buge 8y ago
  That quote doesn't say currently hundreds of millions of daily tor users. That quote says that in the future, when firefox includes tor by default, there might become hundreds of millions of daily tor users.
mortdeus 8y ago
I am starting to feel firefox in a serious way. But im just sooo concerned that their software still sucks. I mean, we ARE talking about a company who thought it was smart to spend time trying to build a javascript OS for mobile. So let me ask again. When are you guys going to start building firefox from the ground up and make the perfect browser we all deserve? And if you disagree, please. Present your arguments. I am the person you need to sell right now.
- firefoxd 8y ago
  Building the perfect browser from the ground up? Do you remember netscape?
- Sylos 8y ago
  They've started on it, it's called Servo. But webstandards are evolving faster than modern browsers are, so building a browser from the ground up would require quite a bit more money, and worse know-how - you can't just buy that in unlimited amounts, than they have for Firefox right now, and they can't exactly stop developing Firefox in the meantime either. Also, their three big competitors have most of their browser market share thanks to building an operating system underneath it. No matter how slim Mozilla's chances at success were, it would've been foolish to not try to get into the operating system market. And they built it based on web technologies, because that's where they have know-how.
wpdev_63 8y ago
Have you considered also implementing I2P[0] in parallel with tor? It suppose to be harder to analyze traffic at nodes with I2p though it isn't as battletested as tor. [0]:https://geti2p.net/en/comparison/tor https://geti2p.net/en/comparison/tor
- jerheinze 8y ago
  I2P is more concerned with inward traffic rather than clearnet 'exit' traffic which is the main thing that Mozilla wants in a super private mode.

757 points by jerheinze 8y ago

Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?

StavrosK 8y ago
This is the biggest misconception about Tor. Tor provides anonymity, but any node (EDIT: any exit node) can read what you're sending if it's not encrypted. You need both.
- detaro 8y ago
  nitpick: exit node. The ones on the way can't, neither can any if you access hidden services.
  - StavrosK 8y ago
    Yes, sorry, I should have specified.
- crankylinuxuser 8y ago
  That's definitely not true if your endpoint you're talking to is an *.onion . A connection to an Onion is encrypted to the destination. That also means if you were running, say NodeRed with authentication, sending credentials "over the clear" (no SSL cert, because stupidity) it's not actually sent over the clear. It's encrypted to the public key relating to your onion address. Now, if you're using Public Internet->Tor->Public Internet, then absolutely yes the last node CAN read the contents of your packets. In that case, you absolutely need appropriate encryption to hide the contents (sigh, not the metadata) of your packets.
  - LinuxBender 8y ago
    I would still prefer https on a .onion. If tor itself is popped, then traffic can be routed or mirrored to another host. This has happened in a PoC and was fixed in a security update in one of the alpha releases. There are additional fixes required for HS that are coming. If the target is using https, you can see if the signature changes (there are addons for this). Digicert will sign .onion domains, though the hidden site must be willing to share their identity with Digicert. I would love to see LetsEncrypt sign .onion domains, assuming they are willing to connect back to a .onion to validate the server.
    - detaro 8y ago
      The CA/B Forum rules only allow EV certificates for .onion, so even if Let's Encrypt wanted they couldn't give out .onion certificates without getting that changed first.
      - LinuxBender 8y ago
        Oh right, that is a good point. I suppose Digicert is the only option for now then. Perhaps the Tor team or an affiliate could set up a simplified CA and have a public CA cert restricted to .onion that folks could install as a work around to having browsers trust it by default.
      - schoen 8y ago
        I'm trying to get that rule changed and working with several other organizations on this.
        detaro 8y ago
        Are there public discussions somewhere yet? I always find it interesting to peek into these processes.
        schoen 8y ago
        We talked about it in this thread in November. https://cabforum.org/pipermail/public/2017-November/thread.html#12451 https://cabforum.org/pipermail/public/2017-November/thread.h... Since then Fotis Loukos and I have drafted a ballot, which I believe he plans to introduce soon after asking a few other organizations to look it over. You can subscribe to the cabfpub mailing list without becoming an Interested Party or Member. Only Interested Parties or Members can post to the list, while only Members can introduce or vote on ballots. (Edit: Strangely, the reason for this is seemingly not that they're worried that the general public will make crazy suggestions, but rather that the general public will make patented suggestions, without being willing to license them according to the Forum's patent policy, and thereby sneak patented technology into the standards.)
akerro 8y ago
You -> Tor node -> Tor node -> Tor Exit node -> http/https clearnet -> NSA/GCQH/BND/you name it -> destination server
shp0ngle 8y ago
If you connect to a clearnet website, the clearnet website is fetched by the exit node. If it's not HTTPS, the exit node can change the website however it wants.
jerheinze 8y ago
https://www.torproject.org/docs/faq.html.en#CanExitNodesEavesdrop https://www.torproject.org/docs/faq.html.en#CanExitNodesEave... Yes, the guy running the exit node can read the bytes that come in and out there. Tor anonymizes the origin of your traffic, and it makes sure to encrypt everything inside the Tor network, but it does not magically encrypt all traffic throughout the Internet. This is why you should always use end-to-end encryption such as SSL for sensitive Internet connections. ``` Fortunately HTTPS adoption is much better now :)
- akerro 8y ago
  >Fortunately HTTPS adoption is much better now :) It's HSTS what we need in 2018
  - crankylinuxuser 8y ago
    I disagree. Ive seen HSTS applied to things like Windows 10 updates, to prevent users from seeing what exactly your OS is sending to the mothership. Ideally, we should be able to see exactly the content being exfiltrated, and choose to allow/disallow. But the moment we use tools like ettercap or mitmssl, it kills the session and we can't see the data. HSTS seems more "self cutting" than useful at this juncture.
    - maerF0x0 8y ago
      If its truly your OS I think you can read all the network data you want to, including the key negotiation. Albeit its not the easiest thing to do.
    - kchr 8y ago
      The use of HSTS is a way to suggest to your clients that they use SSL for that domain - for all requests within a time span (which could be "forever"). If anything, the vendors you mention should be applauded for taking that step towards a more secure distribution of updates. Not enforcing SSL makes malware injection through updates way way easier. Debian introduced HTTPS repos a while back as an option, but not by default. Other distros already offer it.
stordoff 8y ago
If you're connecting to a clearnet site, you probably need HTTPS _more_ than on a standard connection - you _explicitly_ have a node between you and the site that you don't necessarily trust (see, e.g., https://nakedsecurity.sophos.com/2015/06/25/can-you-trust-tors-exit-nodes/ https://nakedsecurity.sophos.com/2015/06/25/can-you-trust-to...).
HugoDaniel 8y ago
anonymity /= confidentiality you can stay anonymous while making sure anyone can read what you are sending. you can send confidential messages while making sure anyone knows who you are. you can also combine the two :)
- oconnor663 8y ago
  > you can stay anonymous while making sure anyone can read what you are sending. That depends a lot on what you're sending. Tor stops people from identifying you based on your IP address, but you can still identify yourself by logging in on http://not-encrypted.com http://not-encrypted.com.
Lennie 8y ago
Please read and play with the graphics on this page, it explains it all: https://www.eff.org/pages/tor-and-https https://www.eff.org/pages/tor-and-https

sp332 8y ago

The page isn't loading for me. https://web.archive.org/web/20180601141754/https://trac.torproject.org/projects/tor/wiki/org/meetings/2018Rome/Notes/FusionProject https://web.archive.org/web/20180601141754/https://trac.torp... (https://archive.org/donate https://archive.org/donate)

maerF0x0 8y ago
it worked after a few tries for me. I believe its just serverload, keep trying or try later
- sp332 8y ago
  I'm sure it is just overloaded. But there's no point kicking it when it's down. Use a mirror for now.

ogennadi 8y ago

> Ultimate eventual goal: Make Tor Browser obsolete, so Tor Project can focus on research instead of maintaining a fork of Firefox.

maerF0x0 8y ago
Hopefully other browsers are encouraged to do something similar also, else Mozilla will effectively control the destiny of Tor
- jerheinze 8y ago
  Brave is already working on Tor private tabs though it won't have the same fingerprinting/first-party isolation guarantees as with a Tor Browser, https://github.com/brave/browser-laptop/labels/feature/tor https://github.com/brave/browser-laptop/labels/feature/tor Should be shipping soon https://twitter.com/BrendanEich/status/984231250104733696 https://twitter.com/BrendanEich/status/984231250104733696
sametmax 8y ago
Good, now if only we could have bitorrent baked in... EDIT: I mean baked in in the browser like tor, not baked in tor. Although interesting, it's really not my priority.
- kleiba 8y ago
  Honest question: is bittorrent even still a thing?
  - iwaffles 8y ago
    It is. For both legitimate and nefarious uses. Bigger software/game devs still use bittorrent to distribute patches and updates—World of Warcraft is an example.
  - d33 8y ago
    It definitely still is. And with the concept of private trackers, it's not really a simple thing to turn off. Companies like IP Echelon tend to automatically bully US/cloud users, but in general they're IMHO far from killing the network. The only problem is that there's fewer and fewer torrent search engines...

mtgx 8y ago

I've been waiting for this for years. Good job convincing Mozilla to do this! Good idea to standardize the spec, too. I hope they give a good name to this new super-private mode (which actually isn't too bad of a name, either). I also hope they don't just implement a "more private" mode in Firefox, but also a more hardened mode for Tor. The Tor mode in Firefox should use the strictest possible sandboxing technologies available to them from the operating system (file system virtualization, etc). I'm even talking about those new fancy hypervisor-based micro-VMs in Windows 10, which I believe they are called Krypton containers, and it's what Edge uses within the Application Guard context. Although if the users have to enable Hyper-V/Micro-VMs first in Windows, then maybe this hardening mechanism should be optional, but encouraged. Otherwise, it should probably be the default. https://www.zdnet.com/article/how-containers-will-transform-windows-10-in-the-next-three-years/ https://www.zdnet.com/article/how-containers-will-transform-... Oh, and this hardened mode should use a different process for every tab/extension, too, by default, just like Chrome does. I still don't think Mozilla's "hybrid" approach makes it as secure as Chrome (which is why it's a hybrid/compromise for lower memory usage).

kodablah 8y ago

Cool, now let me start an ephemeral v3 onion service from JS and have it reachable via WebRTC by a peer who has their own. It's the perfect tech marriage, removes signalling servers and NAT busters, but may be a bit taxing on directory servers and too slow to use for media streams (but I'll take data channels only).

SlowRobotAhead 8y ago
I know some of those words. (I'm an embedded programmer)
Hello71 8y ago
sounds really useful, but to be fair, it doesn't really remove either. you're effectively just using the Tor network as freely available (but slow) signalling and TURN servers.
- kodablah 8y ago
  Exactly. Doesn't require any server side work and you get built in anonymity across peers and for discovery.
floatboth 8y ago
Hah, kinda reminds me of Opera Unite. (That one wasn't from JS, it offered some fixed applications like file hosting, notes, etc., but it was hosting stuff from the browser)
- gsnedders 8y ago
  Unite allowed server-side JavaScript (though I forget how many privileged APIs there were), but I don't think you could support custom protocols.

forapurpose 8y ago

What will Mozilla do about the Tor network's usability problems? Advanced users can workaround them and because they understand the benefits and engineering, accept the frustrations as a cost for a worthwhile (and free) technology. But what will non-technical users do? Many public Internet websites filter connections from the Tor network, many other websites are very slow, yet others impose extra obstacles such as multiple rounds of captchas (even 5 or more) or degraded service (including high suspicion of payments), and of course you often will receive webpages in the wrong locale or language - which can trigger regional filters. Currently, workarounds requires resetting the circuit (few non-technical users will even understand what the circuit is), lots of patience and reloads, and often just giving up. [EDIT: And non-technical users won't understand what is happening and therefore won't know when to use which workaround.] If that's the experience of typical Firefox users, they won't use it and they will have bad associations with Tor and Firefox.

cup-of-tea 8y ago
Why would Mozilla do anything about that? It's not like this is going to be enabled by default in Firefox.
- Hello71 8y ago
  FTFA: Whether there will be two private browsing modes is to be determined.
Hello71 8y ago
Which sites in 2018 still present multiple CAPTCHAs to users with cookies and JavaScript enabled? I think the theory behind this project is that those problems are primarily caused by Tor's popular image as a 'fringe network for pedophiles and drug dealers' and that by making it more mainstream they can fix those issues. (please more replies saying "that sounds really hard" and less replies saying "tor is not a fringe network for pedophiles and drug dealers", thanks)
- paulie_a 8y ago

urda 8y ago

Mozilla keeps driving for the users on the internet. I know many of my own frustrations came from the fork that is Tor. This work is great to see.

jerheinze 8y ago
> I know many of my own frustrations came from the fork that is Tor. What are your frustrations with the Tor Browser?
- tgragnato 8y ago
  There is a gap between the safer and safest security level: sometimes I want to display icons and symbols but don't want js to run. Installing additional extensions is discouraged; but in my experience Decentraleyes makes latency somewhat less disturbing, CAPTCHAs appear less often; and uBlock Origin is essential [-]. [-] shipping with every available filter list enabled and cached may be a good enough default
  - jerheinze 8y ago
    > Installing additional extensions is discouraged; but in my experience Decentraleyes makes latency somewhat less disturbing, CAPTCHAs appear less often; and uBlock Origin is essential [-]. > > [-] shipping with every available filter list enabled and cached may be a good enough default See https://bugs.torproject.org/22089 https://bugs.torproject.org/22089 and https://bugs.torproject.org/17569 https://bugs.torproject.org/17569

Vinnl 8y ago

If I understand it correctly, you shouldn't be using any website accounts using Tor browser that you also use outside of it. I really wonder if/how they can make the user properly aware of that in a kind-of super private browsing mode.

kodablah 8y ago
"Multi-Account Containers"
- Vinnl 8y ago
  I'm not quite sure what you mean by this comment, but if you mean that their approach would be similar to MAC, in the sense that "super private browsing" would have to be enabled in about:config or through an extension: that would make sense.
  - kodablah 8y ago
    This: https://support.mozilla.org/en-US/kb/containers https://support.mozilla.org/en-US/kb/containers
    - Vinnl 8y ago
      I know the extension, but what does that have to do with informing users about not using their account when browsing with Tor? Heck, informing users about being able to use different accounts with Multi-Account Containers was already such a hard problem that they opted into shipping it as a separate extension, so it's only used by power users.
      - kodablah 8y ago
        How I'd do it is have a warning when using Tor outside of the designated Tor container. That is, encourage the installation of the extension when enabling a "Tor" tab (permanently dismissable of course). Alternatively they could co-opt the private-browsing window (a.k.a. incognito) feature to have a tor-browsing window. The latter might even be preferred since the former is only at the tab level and probably quite easy to forget whether you are in Tor before entering an address. It appears to be what is suggested in the notes (now that the link is up).

_bxg1 8y ago

This would be amazing. The main reason I've never used Tor is the fear that it would make me look like I had something to hide (instead of just a general desire for privacy). If it were built into Firefox, I'd probably switch over from Chrome.

jerheinze 8y ago
> The main reason I've never used Tor is the fear that it would make me look like I had something to hide (instead of just a general desire for privacy). 1. You can hide the fact that you're using Tor by using pluggable transports which are already built-in the Tor Browser (such as meek-azure, obfs4, snowflake, ...). 2. That's the biggest reason as to why one must use Tor as much as possible even if they don't care about privacy. More people using Tor = the less interesting it is to be a Tor user.
lucb1e 8y ago
> it would make me look like I had something to hide That's exactly why I use it on a regular basis! Perhaps when looking up political or medical things (also for friends), it could be good to run that through Tor. That is not something to hide per se, but it is definitely not something that is anyone else's business, and you don't want to be bubbled.

devit 8y ago

I think Mozilla should look at using Servo instead of Gecko in this mode along with a new JavaScript interpreter written in Rust, at least optionally, since perfect security is essential when using a Tor browser without a dedicated VM.

kibwen 8y ago
Servo components are being uplifted into Gecko gradually. There's less benefit to rewriting the JIT in Rust because static type systems can only do so much when the whole goal of a program is to generate code dynamically.
- devit 8y ago
  My suggestion was to have Firefox support both Gecko (with uplifted component) and a pure Rust renderer, with the latter to be used in the Tor mode where security (to preserve anonymity against resourceful adversaries) matters over compatibility. For security, instead of a JIT, a simple JavaScript bytecode interpreter written in Rust to be used exclusively in the Tor mode would be ideal, for maximum security at the cost of worse performance. Another option is a JIT that generates code that is easily proven to be safe (e.g. because it does a bounds check on all memory accesses and only does indirect jumps using a jump table, or because it's the only thing running in a process and jumps are still constrained with a read only jump table and read only code).
- Yoric 8y ago
  Well, there is the ability to write something along the lines of https://github.com/nbp/holyjit https://github.com/nbp/holyjit :)

tomrittervg 8y ago

Hi all. I am a Tor Project Developer and work at Mozilla on this project. We appreciate everyone's enthusiasm and feedback. Our ultimate goal is a long way away because of the amount of work to do and the necessity to match the safety of Tor Browser in Firefox when providing a Tor mode. There's no guarantee this will happen, but I hope it will and we will keep working towards it. If anyone is interested in assisting development-wise, Firefox bugs tagged 'fingerprinting' in the whiteboard are a good place to start. You can also run Tor relays and help us improve the health of the network by working with Tor's new Relay Advocate (https://blog.torproject.org/get-help-running-your-relay-our-new-advocate https://blog.torproject.org/get-help-running-your-relay-our-...). More people being involved in spec work (especially at the W3C) and focusing on fingerprinting and privacy concerns is also very useful - it's very hard to keep eyes on all the things happening everywhere. We also appreciate users of Firefox Beta and Nightly (Nightly especially). The flags Tor features are developed behind (privacy.resistFingerprinting and privacy.firstparty.isolate) are experimental. I appreciate bug reports from users running these flags but you should expect them to break things on the web (resistFingerprinting especially; first party isolate is generally more stable and usually only has breakage on particular login forms).

eganist 8y ago
Thanks for your effort! If I can ask, how much overlap exists between your team and the team overseeing the implementation of security protocols within Firefox e.g. HSTS, CSP, etc.? It'd be neat to see Firefox drive innovation here alongside the effort to weave Tor into the browser; although I wouldn't necessarily treat Tor integration the same as I might the implementation of other security specifications, I can see how the teams working on such might overlap, hence my question.
- tomrittervg 8y ago
  The Fusion project is done by a subset of that team (+me, I happen to sit with Sandboxing due to other responsibilities).
  - dat_boi20 8y ago

openfuture 8y ago

Okay but what about maidsafe, dat, ipfs etc. The correct solution is to have firefox expose a 'protocol api' or something along those lines so that any 'alternate internet' project can create a backend extension to make firefox compatible with that protocol.

jean- 8y ago
Seems like some people are working precisely on that. See for instance: https://blog.mozilla.org/addons/2018/01/26/extensions-firefox-59/ https://blog.mozilla.org/addons/2018/01/26/extensions-firefo... (CTRL-F Decentralization) https://github.com/mozilla/libdweb https://github.com/mozilla/libdweb
- mtgx 8y ago
  That's amazing to see. Thanks for sharing. This is exactly the kind of tech Mozilla should be supporting - tech that gives users more freedom on the internet.

neokantian 8y ago

"Removing fingerprintability" amounts to the browser just NOT sending all the http request headers that it sends by default. How hard can it be to "comment out" these lines?

zaphar 8y ago
I don't think this is true. Especially in the case of things like canvas fingerprinting.
bzbarsky 8y ago
I just checked and there are over 100 checks for "should I have different behavior here if I am resisting fingerprinting?" just in the C++ code in Firefox today. There are some more in the JS code but they're harder to search for. Some simple examples: * Various navigator APIs (oscpu, platform, etc) need to be disabled. * Gamepad API needs to be disabled. * Have to prevent reading canvas pixel data * Have to block information about avaiable OpenGL extensions from WebGL * Modifier keys on keyboard events need to be spoofed (because they can be used to guess at keyboard layout) * Errors from the media stack (for <video> and <audio>) need to be blanked out. * Something to do with voice synthesis APIs; I didn't look into details. * Connection API needs to be neutered * Various timing APIs hanging off "performance" need to be neutered. * Presentation API needs to be neutered. * Number of CPUs reported by the navigator API needs to be spoofed. * Window sizing for window.open needs to be spoofed. * Ability to measure the difference between the window.inner* and window.outer* APIs needs to be disabled. * Mouse positions in mouse events need to be spoofed to make it look like the window is fullscreened. * Touch event positions need to be spoofed. * Geolocation needs to be disabled. And so on, and so forth.
- gsnedders 8y ago
  Need to do something about fonts and the CSSOM (Element.getBoundingClientRect() for example), too. Just shipping a standard bundled set of fonts and only allowing use of that doesn't suffice because anti-aliasing width differences could give away the used font renderer.

bunkydoo 8y ago

I believe Tor browser is already just a version of Firefox if I'm not mistaken. What would be the advantage of integrating with Firefox as opposed to say, a VPN integrated into the browser via a plugin. Just seems a little redundant and Tor is beginning to seem dated also with new solutions popping up and making the pitfalls of Tor more apparent.

ubershmekel 8y ago
I imagine the idea is to have an incognito mode that actually is incognito, and free.
Vinnl 8y ago
I think an important part is to lessen the maintenance burden for the Tor project: if the code is in Firefox proper, Firefox developers will encounter it when working on other features and make sure they work together, whereas currently the Tor project needs to rebase their modifications onto "regular" Firefox.
ec109685 8y ago
The vpn owner knows all traffic flowing through it.

Endy 8y ago

So we lose another valuable project of the Web. I wonder why I feel so lost - that when I was young, the Internet was barely born... and now I'm watching it die.

jerheinze 8y ago
What's going to be lost?
- Endy 8y ago
  Tor Browser. A single privacy-dedicated browser package; even if it is now being built on Chromefox.
trumped 8y ago
I agree and I don't really like how the internet is evolving either but this sounds like one of the good changes, unless I'm missing something

MayeulC 8y ago

Great news ! With wider adoption of ipv6 and all the good things that come with it (don't mistake me, they are great!) also comes the risk that each computer will get a uniquely identifiable IP address that will be used for fingerprinting. I've never really used Tor in the past, but this got me thinking about it. An option could be to provide a webRTC-based node, but I am not sure how feasible that would be, after reading some comments here. Maybe for entry nodes and guard nodes instead of exit nodes? The transient nature of browser sessions could greatly enhance privacy. Of course, you would need some algorithms to deal with this very nature... But I can imagine some. This surely lowers the barrier to entry for greatly enhanced privacy. Quite a lot of people seem to be aware of the private browsing mode, and I can imagine this being turned into a simple toggle on the private browsing home page, along with a short explanation (and a link to additional privacy tips). A low hanging fruit that could enhance the privacy a bit would be to use the trusted recursive resolver (DNS over https) in private browsing by default, since it already is part of Firefox. It just needs a default trusted resolver.

tomrittervg 8y ago
> An option could be to provide a webRTC-based node, but I am not sure how feasible that would be, after reading some comments here. I'll point you at FlashProxy (https://crypto.stanford.edu/flashproxy/ https://crypto.stanford.edu/flashproxy/) and Snowflake (https://github.com/keroserene/snowflake https://github.com/keroserene/snowflake) the latter of which is in active development. =)
- jerheinze 8y ago
  https://trac.torproject.org/projects/tor/wiki/doc/Snowflake https://trac.torproject.org/projects/tor/wiki/doc/Snowflake

ccnafr 8y ago

Wasn't this launched in 2014? I see the wiki hasn't been updated since January. Is this a new push to get this done?

fwdpropaganda 8y ago

> How many more "super private browsing mode" Firefox users will there be? Potentially hundreds of millions of daily users. Tor has hundreds of millions of daily users?

vntok 8y ago
Of course not.
jerheinze 8y ago
https://metrics.torproject.org/userstats-relay-country.html https://metrics.torproject.org/userstats-relay-country.html
- xur17 8y ago
  Does anyone know what caused the big spike in users at the end of last year?
  - jerheinze 8y ago
    Most likely a botnet.
Buge 8y ago
That quote doesn't say currently hundreds of millions of daily tor users. That quote says that in the future, when firefox includes tor by default, there might become hundreds of millions of daily tor users.

mortdeus 8y ago

I am starting to feel firefox in a serious way. But im just sooo concerned that their software still sucks. I mean, we ARE talking about a company who thought it was smart to spend time trying to build a javascript OS for mobile. So let me ask again. When are you guys going to start building firefox from the ground up and make the perfect browser we all deserve? And if you disagree, please. Present your arguments. I am the person you need to sell right now.

firefoxd 8y ago
Building the perfect browser from the ground up? Do you remember netscape?
Sylos 8y ago
They've started on it, it's called Servo. But webstandards are evolving faster than modern browsers are, so building a browser from the ground up would require quite a bit more money, and worse know-how - you can't just buy that in unlimited amounts, than they have for Firefox right now, and they can't exactly stop developing Firefox in the meantime either. Also, their three big competitors have most of their browser market share thanks to building an operating system underneath it. No matter how slim Mozilla's chances at success were, it would've been foolish to not try to get into the operating system market. And they built it based on web technologies, because that's where they have know-how.

wpdev_63 8y ago

Have you considered also implementing I2P[0] in parallel with tor? It suppose to be harder to analyze traffic at nodes with I2p though it isn't as battletested as tor. [0]:https://geti2p.net/en/comparison/tor https://geti2p.net/en/comparison/tor

jerheinze 8y ago
I2P is more concerned with inward traffic rather than clearnet 'exit' traffic which is the main thing that Mozilla wants in a super private mode.