8 ms·
Tor Browser disabled NoScript, but can't update
- deogeo 7y agoIf Mozilla hadn't locked down Firefox so much, the fix could have been as simple as going into about:config and flipping a switch to allow unsigned plugins.
- makomk 7y agoApparently the switch to enable unsigned plugins does work in Tor Browser still - it just doesn't re-enable plugins that failed the signature check because the failure is cached somehow.
- gpm 7y agoSet `app.update.lastUpdateTime.xpi-signature-verification` to 0 and restart the browser to refresh the cache (on normal firefox).
- baku-fr 7y agoI did exactly that, it worked on Debian however not on Windows: 1. Type about:config in URL bar 2. Change xpinstall.signatures.required from true to false 3. Restart Firefox
- javagram 7y agoDebian modifies Firefox builds to set a build flag to allow this preference to work, I believe? The default Windows and Mac builds of Firefox ignore this preference.
- ishitatsuyuki 7y agoIt's the opposite: builds compiled from the source allows changing the flag, those builds from Mozilla have the option disabled.
- javagram 7y agoFWIW, since the original intent of the change to block unsigned plugins was to prevent third party software installers from adding malicious plugins without user consent, leaving a preference to toggle it back would have been pretty pointless as the third party installers could have just toggled the preference themselves (about:config is just some sort of easily modifiable data format on disk). TBH it’s not hard for me to think of ways Mozilla could have preserved user control even in the face of these constraints though. For instance, I already use a master password to encrypt/decrypt the password database in Firefox. Why not allow the master password to also protect the settings and store them encrypted so a third party can’t modify them?
- rightbyte 7y agoIf the malicious plugin or executable can write to disk it's probably to late anyway?
- deogeo 7y agoYeah, it could replace Firefox with the developer edition that allows unsigned plugins.
- Jonnax 7y agoIt was a significant issue for years. Mostly adware and things that replaced your default search engine.
- the8472 7y agothe solution is to help users remove the adware, not centralize control over addons
- jszymborski 7y agoYou're right, I think it just makes it less "gray". If Oracle bundles crapware with a Java installer that installs an unsigned plugin in Firefox, you can write a PR release to smooth things over. If the crapware uninstall Firefox, install Firefox Dev Edition, and installs the unsigned plugin, there's not much of a "gray" defence there.
- jopsen 7y ago> If Mozilla hadn't locked down Firefox so much.. Ordinary users would have 5 levels of toolbars!!! Installed by anti-virus apps, etc. Locking down can back fire, but think not that this wasn't done in the interest of most users.
- Vinnl 7y agoAnd if only my company would allow me to FTP into our servers directly I could hotfix a problem in production much faster. ...which is to say, it's a trade-off, and though you can disagree with the weight Mozilla assigned to the pros and cons, their reasoning was valid.
- quotz 7y agoHas anyone read the article explaining Tor is a government honeypot? Its all funded by gov money
- TheSpiceIsLife 7y agoEven if it isn’t all funded by gov money the security apparatus of, at least, the big players are, without a doubt deep in to Tor. We already know that some governments use drug money to pay for clandestine / black ops.
- eternalban 7y agoThe user needs to keep in mind the goals for the development of this software, originally developed by US military. It has an asymmetric architecture biased for a 'home network' infiltrating a 'hostile network'. So Tor is perfect for military intelligence officers working from a 'safe network' (one that doesn't zero in [on] Tor protocol beacons) to pop up in some other network and do their job.
- TheSpiceIsLife 7y agoConspiracy theory time: Mozilla received a National Security Letter, or equivalent, requiring them to all this cert to expire in an effort to weaken Tor.
- deleted 7y ago[deleted]
- oil25 7y agoDon't attribute malice where incompetence may serve as a valid explanation. This is a fundamental tenet of information security practice. Besides, it's silly to think an outage of massive proportions would be the most effective means of owning software.
- Waterluvian 7y agoSomewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless devices.
- theclaw 7y agoTwo immediately spring to mind, Oculus in 2018 [0] and Zune in 2008 [1] [0] https://www.neowin.net/news/every-oculus-rift-vr-headset-bricked-due-to-expired-certificate https://www.neowin.net/news/every-oculus-rift-vr-headset-bri... [1] https://gizmodo.com/30gb-zunes-failing-everywhere-all-at-once-5121311 https://gizmodo.com/30gb-zunes-failing-everywhere-all-at-onc...
- deleted 7y ago[deleted]
- mraison 7y ago“My left shoe won’t even reboot” https://arstechnica.com/gadgets/2019/02/my-left-shoe-wont-even-reboot-faulty-app-bricks-nike-smart-sneakers/ https://arstechnica.com/gadgets/2019/02/my-left-shoe-wont-ev... I don’t know if they found a fix in the end
- tgtweak 7y agoIt's one of my favorite interview questions. I only know the answer because it happened to us once with 5M users on the affected version before it was discovered. It's a very good question to see how people react in a mostly hopeless situation. The only candidate out of 100s to logically get to the solution (or essentially it) was one of the best engineesr I've hired and worked with. "So you and your team just released a tested and reviewed build, did gradual rollout and numbers looked good - so out to general public it goes. All clients update over the following days. QA discovers, upon testing the next release, a latent bug that prevents the current version from connecting to the update service and running the updater. How do you resolve this?"
- Causality1 7y agoI can't improve upon this comment: "Hey Mozilla - this is why people said that forcing addons to be signed with no way to disable was a bad idea. You didn't even make it a year without screwing it up. Who could have seen this coming? Oh wait, pretty much everyone who argued against this policy."
- Jonnax 7y agoIt's a dumb comment. There was a ton of malware being distributed as add-ons that came packaged with other installers. This solved that issue.
- antt 7y agoBurning down London stopped the plague too.
- floatingatoll 7y agoThe Great Fire burned central London long after the plague had moved to the poorer outer areas of the city, where it continued to die out gradually unaffected by the fires elsewhere.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- shmel 7y agoI don't get why this flag was disabled on Linux though. Nobody uses "installers" on Linux, come on. I am not sure if malware of this kind even exists on Linux.
- overgard 7y agoThe cost of their “solution” seems pretty high in retrospect. This isnt a binary proposition, they could have solved that issue while respecting user choices, if it had been a priority. The solution they chose inherently was flawed. Hopefully this gives other providers pause before they build similar things.
- Svperstar 7y agoI don't buy for 5 minutes that Tor Browser is secure regardless of configuration. TAILS maybe but Tor Browser you may as well let an FBI agent into your house. A few years back the government starts busting all these dark web sites/users and will pull out of court cases rather then explain how. Gee I wonder.
- super_mario 7y agoTor project is US government op, true. It's good at hiding government employees using untrusted networks from hostile third parties. It is also good for foreign whistleblowers releasing data to US government. Tor is NOT good at keeping you private from government. It is good at keeping you private from your ISP or employer however. Don't do anything illegal using tor and thinking you are safe.
- AnaniasAnanas 7y ago> Tor is NOT good at keeping you private from government This is a bold claim. Would you mind backing it up?
- cjbprime 7y agoI wouldn't agree with the claim, but it might be referring to Tor's weaknesses against country or global passive adversaries -- timing attacks correlating your requests with the site's responses. If you can log everyone's bandwidth and can get ISPs to tell you which human is using Tor, metadata anonymity goes away.
- AnaniasAnanas 7y agoIsn't this true for pretty much every privacy tool (i2p, freenode, gnunet, etc) though? I don't think that any of them can protect you if an adversary can monitor the whole internet.
- cjbprime 7y ago
- deleted 7y ago[deleted]
- johnnydoe9 7y agoEvery single one of my Firefox extensions stopped working with an error message that says "could not be verified for use in Firefox and has been disabled" re-downloading doesn't work either. I'm assuming it's happening to everyone?
- cf498 7y agoyes https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/ https://blog.mozilla.org/addons/2019/05/04/update-regarding-...
- DavideNL 7y ago... a method to apply a hotfix manually without enabling studies: https://news.ycombinator.com/item?id=19827302 https://news.ycombinator.com/item?id=19827302
- AnaniasAnanas 7y agoOne of the weird things here is that javascript is not disabled by default in the Tor Browser and instead an addon is needed. This whole thing is also yet another reason to use something like Tails or Whonix which are much safer to use with JS enabled.
- oil25 7y agoIt is a valid trade-off to leave Javascript enabled by default in Tor Browser. The reason being, the experience is much more user-friendly to a layperson and thus results in greater network usage and diversity. "Safe" is a relative concept in information security and not everyone has the same goals or risks - though in principle I agree disabling JS greatly hardens a browser.
- Kenji 7y ago> Layperson > Tor browser Pick one.
- d0bby 7y ago> Turns out an unrelated 3rd party can suddenly remotely disable Tor anonymity protections at their whim, and possibly endanger TBB users (or deliberately help in deanonymizing them). > remotely disable Tor anonymity protections [!] Maybe a 'certificate is expiring soon' warning on the browser side? Users would know and Mozilla would be forced to keep certs valid.
- Faark 7y ago> Turns out an unrelated 3rd party can suddenly remotely disable Tor anonymity protections at their whim Am I the only one annoyed by people pushing this "they flicked a switch" narrative? No. They provided shitty software that didn't work under certain conditions (in this case date related) and thus broke your shitty software. A third party having remote control capability is something entirely different.
- judge2020 7y agoIf I'm not mistaken, then very well could revoke the intermediate certificate if they wanted. This wasn't a case of that, but it seems it could happen.
- crehn 7y agoUsually the whole certificate chain is distributed as a bundle, and most software don't bother checking revocations.
- tedunangst 7y agoAre we talking about Firefox extensions or something else?
- crehn 7y agoNot sure of the Firefox implementation; just pointing out revocation isn't necessarily straightforward.
- tknkx 7y agoThe way I understand it is: certificate revocation is handled by checking OCSP servers, and OCSP servers can be programmed so they give different answers depending on the IP address of whomever is asking. In other words, it should be possible to disable all addons for a selected user by targeting him by IP address.
- jobsinkansas 7y agobut can you configure it. https://job-openings-in-kansas.blogspot.com https://job-openings-in-kansas.blogspot.com
- swiley 7y agoI remember saying over and over again that using Firefox for the TOR browser was a horrible idea. Use curl -H "" and links --dump. Until we have something sane that's really the only safe way to browse TOR if you actually have something to hide. (There's dillo and other things like the absolutely horrifying browser I've been writing but that hardly even supports forms right now heh. but I'm worried about connecting stuff like that to stuff like TOR)
- dontbenebby 7y agoOTOH the more people who use Tor, the more anonymous everyone on the network is, so having a usable version is important. https://www.freehaven.net/anonbib/cache/usability:weis2006.pdf https://www.freehaven.net/anonbib/cache/usability:weis2006.p... People with heightened privacy concerns can always use Whonix or Tails instead.
- swiley 7y agocurl is good enough for fetching RSS, leaving that running would probably help quite a lot.
- throwawaymanbot 7y agoWhy does TOR not release its OWN blocker if it cannot work with the No-Script creator(s) -- Why leave something so important, that may imperil people in countries like china and Russia, to people who can do that?
- krick 7y agoHow Firefox came to be like that? Which browser should I use now?
- Hacker_Jack 7y agoI observed the whole scenario for the last days: For me it looks clear that the US spygov along with NAS, Mossad and EU UK have overtaken the security infrastructure on TOR net. Since 1-2 years, they control mozilla (firefox), oracle (java) and some other devs. to flaw security sensitive code. And now, this simple trick with the certificate infrastructure and the pushing of mozilla to only signed code they have compromised some 10mio. users worldwide and shown their power to kill torbrowser security with a simple wrong certificate. They have killed the most important security component - noscript - in many browsers. And if u look around .... NOBODY gives some clear information: just we make a fix and wait for next time .... It looks like the killing of truescrypt some years ago! With no real reason a worldclass security and crypto system was shut down by US LEA agents. With this action taken by US agencies it is clear that they are on the way to compromise all worldwide security software to get control on. NEVER EVER TRUST ANY US ORGANUSATION or US based SOFTWARE SYSTEM!