15 ms·

Hrmm, can execute JS in FF's JSON viewer it seems. Still even with JS available there are more steps required to deanonymize. > This Tor Browser exploit was ac

Hrmm, can execute JS in FF's JSON viewer it seems. Still even with JS available there are more steps required to deanonymize. > This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers Of course it was. The surface area of browser tech is just so large. We need a subset of html+css and a browser that only renders that with a really simple implementation (plus side, low bandwidth and terminal friendly). Not a full browser with features conditionally disabled. I haven't put enough thought into client-side scriptability so I'd punt on it for now, but I did put thought into other parts the other day [0]. Many onion services don't want all the features of the modern web anyways. The TBB can still exist for users of full sites of course. 0 - https://github.com/cretz/software-ideas/issues/92 https://github.com/cretz/software-ideas/issues/92

Eridrus 8y ago
I don't know why people are focusing on deanonymization here, once you can run JS, they can just run one of the dozen Firefox 0days they are stockpiling. If your threat profile involves governments targeting you, this bug is critical, more so than the code execution exploits because these bugs are rarer.
pcwalton 8y ago
There's no need to go that far. Just do what Mozilla already did for legacy addons: kill them.
- kodablah 8y ago
  For this issue and for JS execution maybe. But there are so many features in modern browsers that the cat-and-mouse game of waiting for vulns to know you've hit all of the places for fingerprinting and other deanon is untenable. Couple that with extensions TBB bundles by default, e.g. https everywhere, and the surface area is even larger. TBB has value for general browsing, but secure browsing needs to be by document format as much as implementation. Right now, the only reasonable option for onion services is to have their site browsed via the large, feature-rich bundle. Unfortunately, it requires a good bit of funding to build a document browsing platform of any size so I definitely understand the current practical approach.
kart23 8y ago
Wget

Eridrus 8y ago

I don't know why people are focusing on deanonymization here, once you can run JS, they can just run one of the dozen Firefox 0days they are stockpiling. If your threat profile involves governments targeting you, this bug is critical, more so than the code execution exploits because these bugs are rarer.

pcwalton 8y ago

There's no need to go that far. Just do what Mozilla already did for legacy addons: kill them.

kodablah 8y ago
For this issue and for JS execution maybe. But there are so many features in modern browsers that the cat-and-mouse game of waiting for vulns to know you've hit all of the places for fingerprinting and other deanon is untenable. Couple that with extensions TBB bundles by default, e.g. https everywhere, and the surface area is even larger. TBB has value for general browsing, but secure browsing needs to be by document format as much as implementation. Right now, the only reasonable option for onion services is to have their site browsed via the large, feature-rich bundle. Unfortunately, it requires a good bit of funding to build a document browsing platform of any size so I definitely understand the current practical approach.

kart23 8y ago

Wget