3 ms·

Is it supposed to leak OS in the user agent string now? Or is it just a bug? > "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0" EDIT: No

Is it supposed to leak OS in the user agent string now? Or is it just a bug? > "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0" EDIT: Noscript user experience is also broken, discouraging its use.

r3bl 8y ago
Yeah, they decided against spoofing user agent anymore: https://blog.torproject.org/comment/275941#comment-275941 https://blog.torproject.org/comment/275941#comment-275941
- bo1024 8y ago
  That's really unfortunate. It seems like a big loss of privacy with weak arguments in favor. (1) They could easily spoof one UA for mobile and one for desktop -- user chooses. (2) Why are they worried about the experience of Google Docs over Tor??? More generally why focus on the use case where people enable all kinds of unsafe javascript to do fancy OS-specific things? It's like advertising your lightweight speed-focused track racing bicycle, then putting massive tires on it because some users had trouble going off-road.
  - stordoff 8y ago
    How much of a difference does it make in practice? Just the platform does not seem like that much more information. Further, I'd wonder if, while the actual OS is fingerprintable (as the various discussions seem to suggest), reporting one OS whilst actually being on another flags the user as interesting/has something to hide (i.e. they are probably using Tor Browser, not just Firefox). There's also usability to consider - if this results in more people using Tor Browser, or not disabling things to try and work around it, that might be a net gain.
    - emanreus 8y ago
      > flags the user as interesting/has something to hide (i.e. they are probably using Tor Browser, not just Firefox). Tor nodes are known and it's trivial to detect users using Tor. > There's also usability to consider - if this results in more people using Tor Browser, or not disabling things to try and work around it, that might be a net gain. I'm sorry, but that's just ridiculous. Sharp corners on tabs most certainly won't attract more users. EDIT: Ok I saw the issue with mobile users and some other edge cases. I would still agree with bo1024, it's a weak argument.
jtbayly 8y ago
How is Noscript UX broken?
- octosphere 8y ago
  I think what was meant is that the NoScript UX had a huge overhaul and it is difficult to use. I personally find the new NoScript interface difficult to use too. > Noscript user experience is also broken, discouraging its use.
  - superkuh 8y ago
    Well, the UX had a huge overhaul because Firefox decided that prioritizing grandma's safe experience on Facebook was more important than features. So they removed them. The great extension holocaust. NoScript was big enough to get special attention from Moz but even it is severely gimped now.
  - zzzcpan 8y ago
    Yeah, it's very slow, it doesn't ask for defaults and rather unfriendly towards casual use of tbb, where you don't necessarily remember the user interface and have to rediscover everything each time, only to come across cryptic icons.
  - pitaj 8y ago
    Noscript was broken on the last version for me. It didn't actually block scripts, so I had to disable them in the browser settings instead, which of course meant I couldn't whitelist.

r3bl 8y ago

Yeah, they decided against spoofing user agent anymore: https://blog.torproject.org/comment/275941#comment-275941 https://blog.torproject.org/comment/275941#comment-275941

bo1024 8y ago
That's really unfortunate. It seems like a big loss of privacy with weak arguments in favor. (1) They could easily spoof one UA for mobile and one for desktop -- user chooses. (2) Why are they worried about the experience of Google Docs over Tor??? More generally why focus on the use case where people enable all kinds of unsafe javascript to do fancy OS-specific things? It's like advertising your lightweight speed-focused track racing bicycle, then putting massive tires on it because some users had trouble going off-road.
- stordoff 8y ago
  How much of a difference does it make in practice? Just the platform does not seem like that much more information. Further, I'd wonder if, while the actual OS is fingerprintable (as the various discussions seem to suggest), reporting one OS whilst actually being on another flags the user as interesting/has something to hide (i.e. they are probably using Tor Browser, not just Firefox). There's also usability to consider - if this results in more people using Tor Browser, or not disabling things to try and work around it, that might be a net gain.
  - emanreus 8y ago
    > flags the user as interesting/has something to hide (i.e. they are probably using Tor Browser, not just Firefox). Tor nodes are known and it's trivial to detect users using Tor. > There's also usability to consider - if this results in more people using Tor Browser, or not disabling things to try and work around it, that might be a net gain. I'm sorry, but that's just ridiculous. Sharp corners on tabs most certainly won't attract more users. EDIT: Ok I saw the issue with mobile users and some other edge cases. I would still agree with bo1024, it's a weak argument.

jtbayly 8y ago

How is Noscript UX broken?

octosphere 8y ago
I think what was meant is that the NoScript UX had a huge overhaul and it is difficult to use. I personally find the new NoScript interface difficult to use too. > Noscript user experience is also broken, discouraging its use.
- superkuh 8y ago
  Well, the UX had a huge overhaul because Firefox decided that prioritizing grandma's safe experience on Facebook was more important than features. So they removed them. The great extension holocaust. NoScript was big enough to get special attention from Moz but even it is severely gimped now.
- zzzcpan 8y ago
  Yeah, it's very slow, it doesn't ask for defaults and rather unfriendly towards casual use of tbb, where you don't necessarily remember the user interface and have to rediscover everything each time, only to come across cryptic icons.
- pitaj 8y ago
  Noscript was broken on the last version for me. It didn't actually block scripts, so I had to disable them in the browser settings instead, which of course meant I couldn't whitelist.