10 ms·
Tor Browser 9.0
- agumonkey 7y agoDont be surprised by the letterboxing
- arthurcolle 7y agoWhat do you mean by this?
- progval 7y ago"[letterboxing] works by adding white margins to a browser window so that the window is as close as possible to the desired size while users are still in a couple of screen size buckets that prevent singling them out with the help of screen dimensions." These margins may be surprising (ie. look like a bug) if you don't know what they are.
- CodesInChaos 7y agoIt'll add some padding around the sides of the window to reduce the window size the website sees to common sizes. This reduces finger printing based on display resolution.
- dddddaviddddd 7y ago> Tor Browser in its default mode is starting with a content window rounded to a multiple of 200px x 100px to prevent fingerprinting the screen dimensions. The strategy here is to put all users in a couple of buckets to make it harder to single them out. That worked so far until users started to resize their windows (e.g. by maximizing them or going into fullscreen mode). Tor Browser 9 ships with a fingerprinting defense for those scenarios as well, which is called Letterboxing, a technique developed by Mozilla and presented earlier this year. It works by adding white margins to a browser window so that the window is as close as possible to the desired size while users are still in a couple of screen size buckets that prevent singling them out with the help of screen dimensions.
- dmix 7y agoHow often do people keep the same window size?
- zzo38computer 7y agoI think that perhaps they should have an option to report the height of the content window as Infinity, regardless of its actual height.
- Thorrez 7y agoThat would likely cause some sites to break. Also I wonder how it would interact with CSS. Also I wonder if there would be methods to detect the actual height (such as by testing if something is visible or not, or testing for mouse location, and seeing how many pixels it takes for the mouse to go off the edge).
- zzo38computer 7y agoI thought of that. Visibility testing would always report as visible, and testing the vertical scroll position would always report zero, and the user can configure in what cases mouse location can be tested and how. (Document scripts should actually be disabled by default I think, and what features are available (and in some cases, spoofed) depends on user settings which can be global or specific to URL patterns. For example, full mouse and keyboard events might be available only for activated <canvas> elements when quote mode is active, and other than that is only used to calculate form fields, perhaps.)
- alok-g 7y agoHmm. Then _every_ browser should do that. That will force website development to change over the time to a WYSIWYM approach to handling screen resolutions.
- Ajedi32 7y agoIMO they should whitelist a couple common resolutions. 1920x1080, for example, is extremely common and probably doesn't need to be letterboxed to avoid fingerprinting.
- willvarfar 7y agoIs it possible to disable, or make the page render bigger behind the scenes but scale to display, or anything to stop the massive letterboxing I seem stuck with on a very normal resolution laptop?
- reichardt 7y agoIn about:config change privacy.resistFingerprinting.letterboxing to false.
- ISL 7y agoI think GP is asking for a letterbox that is larger than the desired window size, followed by a downscaling to the desired window size.
- chrysoprace 7y agoNote that even if the screen resolution on your laptop is not unique, the resolution captured via fingerprinting can be quite unique. It was quite an eye-opener for me when I checked it against EFF's fingerprinting testing tool: https://panopticlick.eff.org/ https://panopticlick.eff.org/
- im3w1l 7y agoTried this with tor 9.0 maximized. Said my browser fingerprint is unique oops.
- SalimoS 7y agoi just checked (latest firefox and safari) block trackers but not Tor 9 and all pf them have the same "your browser has a nearly-unique fingerprint"
- chrysoprace 7y agoPanopticlick gives you a breakdown of what's causing it to be unique. Out of all my tweaks to Firefox and Brave, fonts and resolution seem to be the biggest contributors.
- justaj 7y agoI wish the letterboxing margins could be set to a color, in my case black. I've installed the Dark Reader extension but when I enable it the margins are still the default white color.
- ding_ding_dong 7y agoExcellent solution for pedophiles and other garbage. Not so good news for the rest of us.
- notagangsta 7y agoIs there any reason that’s not buying drugs or worse to use this? Honest question.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- ape4 7y agoTry the BBC News (mentioned the other day) at Bbcnewsv2vjtpsuy.onion
- blfr 7y agoHow do I quickly check if my Tor Browser is up to date without the Onion button? Either I'm getting old or I'm using too many different systems and programs because these little UI changes start to bother me.
- ainar-g 7y agoHamburger (≡) → Help → About?
- toby- 7y agoSame as regular Firefox, right? Help -> About, and it'll tell you if it's outdated.
- aasasd 7y agoDepending on your system, the properties of the app may have the version, without even opening the browser. I.e. ‘Get info’ in OSX, ‘Properties’ in Windows. Dunno about Linux, but in that case people are likely to use package managers instead anyway.
- kirkil1 7y agoAlt+H, then A
- octocop 7y agoMore people should use tor
- unicornporn 7y agoFor normal browsing it is almost unusable thanks to Cloudflare's reCAPTCHA (autonomous vehicle training) use.
- TwoBit 7y agoHow is that?
- unicornporn 7y agoJust about every site out there is on cloudflare these days and cloudflare has decided to consider every connection from a total exit point as suspicious activity. Hence you get a captcha for almost every site you visit. Eternally stuck in captcha hell...
- user7261 7y agoYes but if the BBC initiative starts spreading this might change in the future. No?
- Diederich 7y agoMajor sites have been maintaining tor hidden endpoitns for some time now. For example: https://en.wikipedia.org/wiki/Facebookcorewwwi.onion https://en.wikipedia.org/wiki/Facebookcorewwwi.onion
- antisemiotic 7y agoWhat are the use cases for browsing Facebook through Tor? For me it sounds kind of like asking a prostitute for a hug.
- 7y ago
- JumpCrisscross 7y agoDoes this fix any of tptacek’s issues with the Tor Browser?
- cpeterso 7y agoI don't think so. IIUC tptacek's concern is that the Tor Browser is a monoculture: Tor Browser users are running the same version and thus all vulnerable to the same exploits. Or were there other concerns? https://news.ycombinator.com/item?id=13623821 https://news.ycombinator.com/item?id=13623821
- unqueen 7y agotptacek´s role seems to be having a lot of concerns with many things without providing better alternatives, what makes his words not very valuable. is he a fear mongering nsa puppet? if you really want to be safe, do not listen to hipster pseudo experts, learn the tech and decide for yourself, there is no other way to truth.
- user7261 7y agoI would love to use Tor but I don't want to touch anything illegal. Ever. Is it possible? Is there some index, directory or search engine curated with this in mind? Edit: I didn't mean to make anyone feel offended and I sorry. I will take more care when asking questions like this in the future. Thank you all for your compression
- gatherhunterer 7y agoThe fact that you are afraid of a free and open internet is depressing.
- user7261 7y agoI'm sorry, it's was not my intention to depress you. Actually, the fact is I what to be able to advocate for Tor to friends and family in the future. Too much? Viable?
- mkl 7y agoYou seem to be a bit confused about what Tor and the Tor Browser are. Tor Browser is just a web browser with extra anonymity and tracking avoidance features (in the browser itself, and because it sends traffic through the Tor network). You visit sites you like and avoid sites you don't like, exactly like any other browser. It's not guaranteed to be anonymous: any sites you visit can record and track much of your behaviour there (just like with normal browsers), but third parties can't as easily snoop. Websites with .onion addresses are more resistant to tracking, as your traffic doesn't need to exit the Tor network to get to the destination, but Tor Browser can access most normal sites too. I suggest you just try it. It depends how much your friends and family care about anonymity online, because individual people's browsing behaviour can be unique and trackable - a browser cannot magically hide that. To really be confident of hiding successfully you need to do a lot more, and few people really need to or can be bothered. E.g. I sometimes use the Tor browser at work to check whether local pages are accessible from outside the local network. There I don't care about anonymity, I just want a connection appearing to come from outside.
- darth_skywalker 7y ago>> As usual when preparing Tor Browser releases, we verified that the build is bit-for-bit reproducible. While we managed to get two matching builds, we found that in some occasions the builds differ (we found this happening on the Linux i686 and macOS bundles). We are still investigating the cause of this issue to fix it. I find this quite fascinating. Does anyone have any ideas for how this could happen? My understanding was that if you run the same compiler on the same code, you get the same executables. What could be going on?
- johnsoft 7y agoThis is a good primer: https://blog.conan.io/2019/09/02/Deterministic-builds-with-C-C++.html https://blog.conan.io/2019/09/02/Deterministic-builds-with-C...
- esotericn 7y agohttps://reproducible-builds.org https://reproducible-builds.org is a good resource on this. There are many, many reasons why a build process may not produce reproducible output. Timestamps and unordered maps are two of the more trivial examples.
- cjbprime 7y agoAnother common one: (temporary) directory paths in debug symbols.
- rptr_87 7y agoChromium browser has a master bug to track this: https://bugs.chromium.org/p/chromium/issues/detail?id=314403 https://bugs.chromium.org/p/chromium/issues/detail?id=314403 https://www.chromium.org/developers/testing/isolated-testing/deterministic-builds https://www.chromium.org/developers/testing/isolated-testing...
- Thorrez 7y agoAnother reason I've heard is that when you have a multithreaded compiler, the order the threads execute could change, and that could cause the output code to be different.
- aasasd 7y ago> Clarified the amount of locales we support. It's 32 Wait a minute, does TB use a 5-bit number to enumerate the locales? You'd think that nowadays they would opt for something larger.
- hartator 7y agoIt's working way better than a couple of years ago. Even Google seems to load. Congrats!