3 ms·

Those SDKs have indeed no place in Tor Browser, though at least they appear to be disabled. Have you witnessed Tor Browser sending telemetry data to these servi

Those SDKs have indeed no place in Tor Browser, though at least they appear to be disabled. Have you witnessed Tor Browser sending telemetry data to these services on Android? https://gitlab.torproject.org/tpo/applications/fenix/-/issues/40077 https://gitlab.torproject.org/tpo/applications/fenix/-/issue...

cookiengineer 6y ago
The issue I have with their response is that they argue that it's disabled because it has no API key. I think that's not a real solution because that can change at any time. A request sent is a request sent, relying on the server to block it is the opposite of what TOR initially stood for. I witnessed at least the Leanplum SDK taking action, and I thought I broke the App tbh. After a restart of the phone and clearing all caches via the Settings App I could verify that it happened a second time. But I have no idea whether it was a "chrome://" Page with an externally included JS - or triggered by the underlying SDK directly. In Firefox pre-quantum (pre fenix 9.5), the Extensions Page included Google Analytics for a while, so I was assuming that my installation process of uBlock Origin and uMatrix triggered it somehow down the line. I decided to roll back to TOR 9.5 after it happened the second time on the same day and now I'm building my own Browser (Tholian Stealth) anyways... so I didn't decide to investigate further than a casual look at the codebase where LeanPlum still seems to be littered all over the place. [1] [1] https://gitlab.torproject.org/search?utf8=%E2%9C%93&search=leanplum&group_id=477&project_id=478&scope=&search_code=true&snippets=false&repository_ref=tor-browser-83.0.0b2-10.5-1&nav_source=navbar https://gitlab.torproject.org/search?utf8=%E2%9C%93&search=l...
- dessant 6y ago
  Thanks for the details, I think this should be properly investigated, and if you find any request to telemetry services in Tor Browser, your findings should be made public.

cookiengineer 6y ago

The issue I have with their response is that they argue that it's disabled because it has no API key. I think that's not a real solution because that can change at any time. A request sent is a request sent, relying on the server to block it is the opposite of what TOR initially stood for. I witnessed at least the Leanplum SDK taking action, and I thought I broke the App tbh. After a restart of the phone and clearing all caches via the Settings App I could verify that it happened a second time. But I have no idea whether it was a "chrome://" Page with an externally included JS - or triggered by the underlying SDK directly. In Firefox pre-quantum (pre fenix 9.5), the Extensions Page included Google Analytics for a while, so I was assuming that my installation process of uBlock Origin and uMatrix triggered it somehow down the line. I decided to roll back to TOR 9.5 after it happened the second time on the same day and now I'm building my own Browser (Tholian Stealth) anyways... so I didn't decide to investigate further than a casual look at the codebase where LeanPlum still seems to be littered all over the place. [1] [1] https://gitlab.torproject.org/search?utf8=%E2%9C%93&search=leanplum&group_id=477&project_id=478&scope=&search_code=true&snippets=false&repository_ref=tor-browser-83.0.0b2-10.5-1&nav_source=navbar https://gitlab.torproject.org/search?utf8=%E2%9C%93&search=l...

dessant 6y ago
Thanks for the details, I think this should be properly investigated, and if you find any request to telemetry services in Tor Browser, your findings should be made public.