13 ms·

Security Vulnerability in Tor Browser

287 points by Vladimof 4y ago

tptacek 4y ago
A reminder that Tor Browser might be one of the least safe browsers you can run: it's a fork of Firefox, meaning that its maintainers have to coordinate and port patches from the mainline project. Firefox is already not one of the most hardened browser engines. Meanwhile, the fork you'll be running is specifically designed to hide sensitive traffic, and collapses all those users into a single version for exploits to target. I'm ambivalent about Tor, but if you're using Tor, don't use the Browser Bundle.
- 0daystock 4y ago
  Wow, what incredible FUD to be reading. "Least safe"? Compared to what? Can you cite any objective sources to back up such extraordinary claims?
- urda 4y ago
  > Firefox is already not one of the most hardened browser engines Citations and sources for this claim?
  - symlinkk 4y ago
    https://zerodium.com/images/zerodium_prices.png https://zerodium.com/images/zerodium_prices.png
    - jandrese 4y ago
      Isn't this taking demand into account? Exploits for Chrome are worth more because more people want them.
    - alduin32 4y ago
      This chart does not support the referred claim at all. Payouts are not only linked to the browser's hardening, but also to the amount of affected users. Given Firefox's engine low market share, it's not very surprising that payouts for its vulnerabilities is lower than for Chrome.
    - urda 4y ago
      That's not a reliable source or claim to support the argument claimed here. That's more aligned with market demand, and whatever that company wants to pay out.
    - gkbrk 4y ago
      Firefox, Safari and Edge being in the same price bracket and less than Google Chrome is not related to their relative security, but their marketshare being a lot less.
    - toolz 4y ago
      using just this image it would imply chrome was the least secure browser, but I'm not sure I can really infer much at all from this image other than bugs have been found in all browsers. Was this intended on showing firefox is the least hardened browser somehow?
    - comboy 4y ago
      tar RCE, linux & macos LPE valued less than adobe pdf/cpanel? Interesting. If you look at number of CVEs[1] Chrome is above Firefox, but I admit that especially given the market share that doesn't say much. I wish they had some score weighted rank. 1. https://www.cvedetails.com/top-50-products.php?year=2022 https://www.cvedetails.com/top-50-products.php?year=2022
- jraby3 4y ago
  What about the Brave browser in a private window? That used Tor but theoretically also has some added protection because of the browser. I’d love to hear your thoughts.
  - encryptluks2 4y ago
    Anything with JavaScript leaks. You can fingerprint a computer just based on Canvas.
    - deleted 4y ago
      [deleted]
    - lucb1e 4y ago
      https://en.wikipedia.org/wiki/Canvas_fingerprinting#Mitigation https://en.wikipedia.org/wiki/Canvas_fingerprinting#Mitigati... > Tor Browser notifies the user of canvas read attempts and provides the option to return blank image data to prevent fingerprinting. > Canvas Defender, a browser add-on, spoofs Canvas fingerprints. > The LibreWolf browser project includes technology to block access to the HTML5 canvas by default It doesn't seem to be the case that anything with javascript must leak canvas fingerprints. Are you saying that Brave is unsafe because it has JS like every other browser on the planet or because it doesn't resist canvas fingerprinting specifically?
      - encryptluks2 4y ago
        I'm saying Brave doesn't do anything as far as I'm aware to stop fingerprinting, and since it is Chromium-based I'm guess also leaks Client Hints.
      - deleted 4y ago
        [deleted]
  - lucb1e 4y ago
    Can't tell why this was downvoted, it sounds like a legitimate question and on-topic given that this is an alternative to the TBB which GP was recommending to avoid.
- ziddoap 4y ago
  Or don't use JS, which has long been a best practice with Tor. >The Safest security level of Tor Browser is not affected because JavaScript is disabled at this security level.
  - RL_Quine 4y ago
    Lets be real, you need to be using JavaScript for the internet to be functional, even within Tor. Anybody claiming they regularly use the internet with JS disabled is just lying for some sort of feel of superiority.
    - capitainenemo 4y ago
      Hm, this is probably a joke, but I do vast majority of my browsing without javascript (noscript+umatrix or w3m). It's especially pleasant on news sites which are crammed with junk the few times I carelessly open them on the JS-only profile I reserve for Google's app suite.
    - tragictrash 4y ago
      I use brave and browse with JS disabled by default. Some sites don't work, some do. I regularly decide the info I'm looking for can be found somewhere else and back out of a broken site because of it. Some sites I enable and proceed with.
      - deleted 4y ago
        [deleted]
      - tlrobinson 4y ago
        > I use brave and browse with JS disabled by default. That’s hilarious given the founder of Brave (Brendan Eich) literally invented JavaScript.
        tragictrash 4y ago
        I mean I'm not arguing JavaScript's utility. Its a tool with a time and place for proper usage.
- frankjr 4y ago
  Isn't it based on Firefox ESR, the Mozilla maintained version of Firefox with slower feature updates?
- mrtesthah 4y ago
  The more unique your browser (i.e., the more you deviate from the Tor Browser based on Firefox ESR), the more unique and therefore fingerprintable you are.
  - RL_Quine 4y ago
    The Tor browser is 100% unique, it makes no attempt to pretend to be anything other than itself. Your anonymity set is other Tor users, not other Firefox users.
    - mrtesthah 4y ago
      This doesn't contradict anything I said. If you believe you are contradicting what I said, perhaps you could rephrase what you thought my comment was communicating. Otherwise, I will interpret the intent of your reply as adding supporting details.
    - jandrese 4y ago
      The fact that they can detect that you're using the TOR browser configuration isn't that shocking when they also see that you are coming out of a TOR exit node, or the site you are loading is an Onion site. The anonymity comes from looking like every other person who downloaded Tails.
      - RL_Quine 4y ago
        Yes.
- stefan_ 4y ago
  They also still enable JavaScript by default, which is time and time again the source of these vulnerabilities.
  - jerheinze 4y ago
    This has been eloquently addressed by Tor veteran Mike Perry:[1] Concerns about Javascript are rooted in two avenues: 1. Fingerprinting concerns. 2. Zero-day exploits against Firefox. The reason we feel that leaving Javascript enabled trumps these concerns is: 1. We want enough people to actually use Tor Browser such that it becomes less interesting that you're a Tor user. We have plenty of academic research and mathematical proofs that tell us quite clearly that the more people use Tor, the better the privacy, anonymity, and traffic analysis resistance properties will become. In fact, my personal goal is to grab the entire "Do Not Track" userbase from Mozilla. That userbase is probably well in excess of 12.5 million people: http://www.techworld.com.au/article/400248/ http://www.techworld.com.au/article/400248/ I do not believe we can capture that userbase if we ship a JS-disabled-by-default browser. 2. Exploitable vulnerabilities can be anywhere in the browser, not just in the JS interpreter. We disable and/or click-to-play the known major vectors, but the best solutions here are providing bug bounties (Mozilla does this; we should too, if we had any money) and sandboxing systems (Seatbelt, AppArmor, SELinux). [1] : https://lists.torproject.org/pipermail/tor-talk/2012-May/024227.html https://lists.torproject.org/pipermail/tor-talk/2012-May/024...
- cheeze 4y ago
  I've always assumed that Tor was a top target for 3 letter agencies. In that sense, there is so much attention on it that it's kinda pointless.
  - smm11 4y ago
    Where did Tor come from, again?
    - lucb1e 4y ago
      "Comments should get more thoughtful and substantive, not less, as a topic gets more divisive." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html (Not sure a rhetorical question to make some vague accusation counts as a substantive comment)
      - ziddoap 4y ago
        It's not a "vague accusation", onion routing was developed by the US Naval Research Academy ("NRL", a 3 letter government agency). See https://en.wikipedia.org/wiki/Tor_(network)#History https://en.wikipedia.org/wiki/Tor_(network)#History for more detail.
        lucb1e 4y ago
        The vague accusation is that because "onion routing"[1] has roots in the military, it must have a backdoor that we haven't uncovered in decades. If the person had posted this Wikipedia link with the info you mentioned, for example, I wouldn't have thought it unsubstantial per the guidelines (even if the claim/accusation itself is unsubstantiated by the evidence, that's a difference of opinion and not a guidelines thing). [1] Not the cryptography, not even the code implementation, but just the general concept: having a message packed in several layers of encryption such that intermediate routers don't know the contents. https://en.wikipedia.org/wiki/Onion_routing https://en.wikipedia.org/wiki/Onion_routing
        wolverine876 4y ago
- mikojan 4y ago
- Vladimof 4y ago
  > I'm ambivalent about Tor, but if you're using Tor, don't use the Browser Bundle. What do you suggest?
- fsflover 4y ago
  Or use Whonix on Qubes OS, relying on hardware virtualization to protect you.
- _wldu 4y ago
  I no longer use Tor either (unless I have to for work projects such as remote pentesting). What is you opinion of Landlock (Linux kernel 5.13 and newer)? If we wrap vanilla FireFox in LandLock, proxy that to tor and use Apparmor/Tomoyo to further limit what FireFox could do (when it gets compromised) then I think that would be a much safer approach than using the Tor Browser Bundle. Here's a landlock wrapper (in Go) for FireFox: https://github.com/62726164/misc/blob/main/go/landlock/firefox/main.go https://github.com/62726164/misc/blob/main/go/landlock/firef... Also, I've only ever been able to get Tomoyo to work as MAC for FireFox. SELinux and Apparmor were too difficult.
- deleted 4y ago
  [deleted]
- jerheinze 4y ago
  This is deeply misleading and based on old data. > A reminder that Tor Browser might be one of the least safe browsers you can run: it's a fork of Firefox, meaning that its maintainers have to coordinate and port patches from the mainline project. Tor Browser ships updates as soon as new ESR versions come out. > Firefox is already not one of the most hardened browser engines. That might've been true in the past, it's hard to argue for it now. > Meanwhile, the fork you'll be running is specifically designed to hide sensitive traffic, and collapses all those users into a single version for exploits to target. The overwhelming majority of exit traffic now is using HTTPS and Tor Browser ships with HTTPS Everywhere to avoid SSL Striping attacks (in fact the next version of the Tor Browser will have the HTTPS-Only mode enabled by default, it's already being tested in the alpha release), so how will those evil exit node burn those exploits? > I'm ambivalent about Tor, but if you're using Tor, don't use the Browser Bundle. First off, the "Tor Browser Bundle" is a deprecated name. If you're not using the Tor Browser you're making yourself both insecure (it ships with a smaller attack surface, no WebGL for example) and fingerprintable defeating thus the full privacy advantages of the Tor Browser. There is simply no other alternative. You can read the Tor Browser design documentation (though old) to get a rough sketch of what it's trying--and what it's not trying--to achieve: https://2019.www.torproject.org/projects/torbrowser/design/ https://2019.www.torproject.org/projects/torbrowser/design/ Further reading in case you think VPNs are the solution: https://matt.traudt.xyz/posts/2019-10-17-you-want-tor-browser-not-a-vpn/ https://matt.traudt.xyz/posts/2019-10-17-you-want-tor-browse...
  - criticaltinker 4y ago
    FYI I’m seeing a 404 from that last link. Is this the intended link? https://matt.traudt.xyz/posts/2019-10-17-you-want-tor-browser-not-a-vpn/ https://matt.traudt.xyz/posts/2019-10-17-you-want-tor-browse...
    - jerheinze 4y ago
      Thanks, corrected.
- autoexec 4y ago
  > Meanwhile, the fork you'll be running is specifically designed to hide sensitive traffic, and collapses all those users into a single version for exploits to target. Yeah, I was never a fan of their position on this. It's basically "let all websites track you and push ads at you all day long, but we've customized 50,000 settings so that you should look identical to everyone else using the Tor Browser" where as I don't trust that they've managed to cover every possible means to fingerprint a specific user/browser install. Instead, I prefer to limit the amount of data websites can collect about me in the first place. I harden the browser as best as I can, block all active content by default, block all the ads I can, and I randomize a few little details (like screen and window resolution or user agent) which in total makes me feel better about my chances of avoiding being fingerprinted across sites and prevents most of the vulnerabilities that would cause a person to get compromised just by browsing to a website. I still love the Tor Browser project though because they're great at spotting things introduced into firefox that would make it easier for you to be fingerprinted, and while I prefer to not give data, or give random data I do understand their reasoning for what they do.
- aaron695 4y ago
- yjftsjthsd-h 4y ago
  > Firefox is already not one of the most hardened browser engines I'm pretty sure it's one of the most hardened, because the list of major engines that are on that list in first place numbers approximately 3. If you want to claim that blink or webkit are more secure that's a reasonable argument, but just say that.
  - pcwalton 4y ago
    Yeah, Gecko is one of the most hardened browser engines out there at this point. Fission and the win32k.sys isolation basically bring the general architecture up to par with Chromium. Chromium got those features earlier and hence has more mature implementations of them, so the edge goes to Chromium, but there's not much of a large-scale difference anymore. There are a few areas in which one browser has the edge over the other in terms of security (e.g. JIT hardening in Chromium's V8 gives it an advantage over Firefox, memory safety of pdf.js in Firefox reduces attack surface over the C++ PDFium in Chromium), but these are nowhere near the old days of "Chrome has a sandbox and Firefox doesn't" or even "Chrome isolates tabs from each other and Firefox doesn't".
    - littlestymaar 4y ago
      > memory safety of pdf.js in Firefox reduces attack surface over the C++ PDFium in Chromium I thought Firefox abandoned PDF.js a few month ago.
- wp381640 4y ago
  If you use anything but the Tor Browser on the Tor network you're going to stand out like a flare Further - many of the privacy enhancements in Firefox, such as fingerprint protection, were adopted from the work on Tor Browser
- aftbit 4y ago
  Perhaps you mean "don't rely on just the Tor Browser"? How else would one use tor to browse the web? Certainly Whonix or another protection layer is advisable if you're doing anything serious as well.
  - cowtools 4y ago
    I don't know, you could just use a simpler (non-js) browser over torsocks
- GekkePrutser 4y ago
  > Meanwhile, the fork you'll be running is specifically designed to hide sensitive traffic, and collapses all those users into a single version for exploits to target. That's a good thing too because of browser fingerprinting. It takes a lot of identifying points away by having everyone use the same.
- nikcub 4y ago
  Terrible advice. If there is one thing I know from ~8 years of following the darkweb markets is that there's nothing worse than stepping outside of the common practice of: use Tor, use Tails, use Whonix If you read the the DOJ indictments of Tor users what they have in common is that they stepped out of those bounds There _was_ a period where Firefox (hence: the Tor Browser) was terrible and 0days were cheap (which is why most of the darkweb switched up to using VM's behing their browsers), but those days are over[0] I can't recall a recent indictment where the adversary in the USA broke Tor Browser. If you are a dissident in Turkey, Syria or Russia .. you're more than safe using the Tor Browser bundle. The NSA aren't burning 0days in Firefox and VM's on 99.9% of Tor users - if you're in that other 0.01% then good luck to you[1], your threat model is very different to those looking to obfuscate from oppressive regimes. As somebody with an infosec background, this is where I feel the industry fails in the sense of "perfect is the enemy of good" - there is no such thing as perfect (I bet most who preach against Tor Browser wouldn't be able to come up with a model that is) - the practical advice today is, and always has been, use Tor (Browser), use Tails, use Whonix [0] I used ungoogled-chromium in that period, until an DNM administrator during a chat told me he could spot me in his acccess logs
- RektBoy 4y ago
  So what are people supposed to use? Chrome? Rofl.
- roastedpeacock 4y ago
  Anyone know how much the Tor Browser 'Safer' security-level mitigates real exploits? Among several things it disables the JavaScript JIT functionality which has been a known mechanism for exploits.
rebelwebmaster 4y ago
These are just the pwn2own vulnerabilities. Nowhere did Mozilla ever say they were being exploited in the wild.
- deleted 4y ago
  [deleted]
- mmastrac 4y ago
  Perhaps they moved fast: "Mozilla is aware of websites exploiting this vulnerability already."
  - rebelwebmaster 4y ago
    Citation needed. Also, they've specifically called that out in the advisory when they're aware of that being the case. See the last out-of-band security update they released for example: https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-0...
  - dveditz_ 4y ago
    We are not aware of any such thing. As rebelwebmaster noted, when we know that we put it in our advisory. Clearly the vulnerabilities are exploitable as demonstrated by Manfred Paul's winning Pwn2Own entry. The details were disclosed only to Zero Day Initiative staff (the contest organizers) and Mozilla. They have not been discovered on any website in the wild.
    - dredmorbius 4y ago
      Who are "we" here?
      - AlexSW 4y ago
        Judging by the post and the user's post history, almost certainly 'we' refers to Mozilla.
Syonyk 4y ago
And this is why Whonix is critical - because even when you pop the browser, you still have another layer of protection - the gateway VM. Tails browser on [almost anything] is one browser exploit away from beaconing out directly from your IP, and has done so rather frequently over the years. Whonix stuffs the whole browser and such into a workstation VM, which is only connected to the gateway VM - which "torifies" everything coming in that port. So even if you pop the workstation and have root, you still can't beacon out directly without going through the gateway - you'd have to find an exploit in that bit as well, with only network access. Not impossible, but a lot harder. And then package all that into Qubes and use it that way, because a disposable Whonix VM set is probably the safest way to browse the web... And still disable Javascript.
- matheusmoreira 4y ago
  I knew about Tails but not Whonix. This is really nice. No live system like Tails though?
- hamiltonians 4y ago
  then why not just use Whonix
  - Syonyk 4y ago
    "Whonix alone" is probably fine against browser exploits in the Tor browser (of which I generally assume there are many, because it's a browser of Very Much Interest to plenty of agencies). However, if you assume a "dirty host," with various bits of nastiness on it, if you're just using Virtualbox or something, it would be easy enough for a compromised Whonix workstation VM to chatter away with the host and have the host beacon out, or have the host modify the disk images for Whonix to add badness, or something of the sort. It's not a high risk, but if you're going to be doing something with Tor where failure of opsec puts you in prison for life (see DPR), it's something to consider. Qubes adds a few more layers of isolation and security, because you now have a Type 1 hypervisor under everything (currently Xen), with your other isolation VMs separated out. Badness in another VM can't directly impact the Whonix VMs, unless it's compromised Dom0, at which point you've lost with Qubes anyway. Both are at risk from a hypervisor escape as well, but I generally consider Xen to be a somewhat better inspected and harder to escape from target than Virtualbox or VMWare Workstation, just because there's less to Xen. It's a far smaller codebase, and when you're using hardware virtualization with paravirtualized devices (virtio-type interfaces), there's just not as much surface exposed for attack. It's not impossible, but I would generally consider VMWare/Virtualbox somewhat softer targets to escape from than Xen. Again, does any of this matter for casual use? No. But if you're going to use Tor for things that have actual consequences, it may very well matter a lot, and at that point, fully understanding the various threats and how they've been used over the years may be a matter of your freedom. For whatever it's worth, I try to add Tor traffic where I can, just to help with the noise factor.
landr0id 4y ago
It's a JavaScript engine bug and JS is disabled by default. Still important, but I question whether anyone who enables JS in Tor is worth compromising.
- retox 4y ago
  >JS is disabled by default This isn't true any more.
  - deleted 4y ago
    [deleted]
  - beebeepka 4y ago
    But it still comes with No script built in, so concerned user is left with a choice
  - aqme28 4y ago
    I wonder why not. It seems like that's the cause of most of these.
    - staticassertion 4y ago
      Because the web isn't practically browsable without js, so rather than users fiddling with noscript and ending up disabling a ton of security features, instead they just turned js on.
joecool1029 4y ago
Just a heads up for Android users: The Play store version is a few releases out of date, to get current use FDroid and make sure Guardian Project repo is selected (it's not by default). Question for the Mozillans/Googlers: How is it that Firefox Nightly are fast-track released multiple times a day to Play Store but stable Tor Browser updates are stuck for weeks? Is there a 'skip the review' option for nightly releases?
- _rdvw 4y ago
  It may not be in that repo for much longer: https://gitlab.com/guardianproject/fdroid-metadata/-/issues/3 https://gitlab.com/guardianproject/fdroid-metadata/-/issues/...
anthk 4y ago
Links web browser has a Tor proxy enforcing setting. Set the proper Socks4a proxy to the Tor daemon's one and mark that checkbox. Enjoy.
3np 4y ago
Since it's not directly mentioned in the submitted link: Fixed in: Firefox 100.0.2, Firefox ESR 91.9.1, Firefox for Android 100.3, Thunderbird 91.9.1 https://www.mozilla.org/en-US/security/advisories/mfsa2022-19/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-1...
- _rdvw 4y ago
  I maintain a table with release history for Android builds: https://divestos.org/misc/ffa-dates.txt https://divestos.org/misc/ffa-dates.txt
elurg 4y ago
> This vulnerability doesn’t break the anonymity and encryption of Tor connections. > The Safest security level of Tor Browser is not affected because JavaScript is disabled at this security level. > For example, after you visit a malicious website, an attacker controlling this website might access the password or other sensitive information that you send to other websites afterwards during the same Tails session. This makes it relatively tame.

287 points by Vladimof 4y ago

A reminder that Tor Browser might be one of the least safe browsers you can run: it's a fork of Firefox, meaning that its maintainers have to coordinate and port patches from the mainline project. Firefox is already not one of the most hardened browser engines. Meanwhile, the fork you'll be running is specifically designed to hide sensitive traffic, and collapses all those users into a single version for exploits to target. I'm ambivalent about Tor, but if you're using Tor, don't use the Browser Bundle.

0daystock 4y ago
Wow, what incredible FUD to be reading. "Least safe"? Compared to what? Can you cite any objective sources to back up such extraordinary claims?
urda 4y ago
> Firefox is already not one of the most hardened browser engines Citations and sources for this claim?
- symlinkk 4y ago
  https://zerodium.com/images/zerodium_prices.png https://zerodium.com/images/zerodium_prices.png
  - jandrese 4y ago
    Isn't this taking demand into account? Exploits for Chrome are worth more because more people want them.
  - alduin32 4y ago
    This chart does not support the referred claim at all. Payouts are not only linked to the browser's hardening, but also to the amount of affected users. Given Firefox's engine low market share, it's not very surprising that payouts for its vulnerabilities is lower than for Chrome.
  - urda 4y ago
    That's not a reliable source or claim to support the argument claimed here. That's more aligned with market demand, and whatever that company wants to pay out.
  - gkbrk 4y ago
    Firefox, Safari and Edge being in the same price bracket and less than Google Chrome is not related to their relative security, but their marketshare being a lot less.
  - toolz 4y ago
    using just this image it would imply chrome was the least secure browser, but I'm not sure I can really infer much at all from this image other than bugs have been found in all browsers. Was this intended on showing firefox is the least hardened browser somehow?
  - comboy 4y ago
    tar RCE, linux & macos LPE valued less than adobe pdf/cpanel? Interesting. If you look at number of CVEs[1] Chrome is above Firefox, but I admit that especially given the market share that doesn't say much. I wish they had some score weighted rank. 1. https://www.cvedetails.com/top-50-products.php?year=2022 https://www.cvedetails.com/top-50-products.php?year=2022
jraby3 4y ago
What about the Brave browser in a private window? That used Tor but theoretically also has some added protection because of the browser. I’d love to hear your thoughts.
- encryptluks2 4y ago
  Anything with JavaScript leaks. You can fingerprint a computer just based on Canvas.
  - deleted 4y ago
    [deleted]
  - lucb1e 4y ago
    https://en.wikipedia.org/wiki/Canvas_fingerprinting#Mitigation https://en.wikipedia.org/wiki/Canvas_fingerprinting#Mitigati... > Tor Browser notifies the user of canvas read attempts and provides the option to return blank image data to prevent fingerprinting. > Canvas Defender, a browser add-on, spoofs Canvas fingerprints. > The LibreWolf browser project includes technology to block access to the HTML5 canvas by default It doesn't seem to be the case that anything with javascript must leak canvas fingerprints. Are you saying that Brave is unsafe because it has JS like every other browser on the planet or because it doesn't resist canvas fingerprinting specifically?
    - encryptluks2 4y ago
      I'm saying Brave doesn't do anything as far as I'm aware to stop fingerprinting, and since it is Chromium-based I'm guess also leaks Client Hints.
    - deleted 4y ago
      [deleted]
- lucb1e 4y ago
  Can't tell why this was downvoted, it sounds like a legitimate question and on-topic given that this is an alternative to the TBB which GP was recommending to avoid.
ziddoap 4y ago
Or don't use JS, which has long been a best practice with Tor. >The Safest security level of Tor Browser is not affected because JavaScript is disabled at this security level.
- RL_Quine 4y ago
  Lets be real, you need to be using JavaScript for the internet to be functional, even within Tor. Anybody claiming they regularly use the internet with JS disabled is just lying for some sort of feel of superiority.
  - capitainenemo 4y ago
    Hm, this is probably a joke, but I do vast majority of my browsing without javascript (noscript+umatrix or w3m). It's especially pleasant on news sites which are crammed with junk the few times I carelessly open them on the JS-only profile I reserve for Google's app suite.
  - tragictrash 4y ago
    I use brave and browse with JS disabled by default. Some sites don't work, some do. I regularly decide the info I'm looking for can be found somewhere else and back out of a broken site because of it. Some sites I enable and proceed with.
    - deleted 4y ago
      [deleted]
    - tlrobinson 4y ago
      > I use brave and browse with JS disabled by default. That’s hilarious given the founder of Brave (Brendan Eich) literally invented JavaScript.
      - tragictrash 4y ago
        I mean I'm not arguing JavaScript's utility. Its a tool with a time and place for proper usage.
frankjr 4y ago
Isn't it based on Firefox ESR, the Mozilla maintained version of Firefox with slower feature updates?
mrtesthah 4y ago
The more unique your browser (i.e., the more you deviate from the Tor Browser based on Firefox ESR), the more unique and therefore fingerprintable you are.
- RL_Quine 4y ago
  The Tor browser is 100% unique, it makes no attempt to pretend to be anything other than itself. Your anonymity set is other Tor users, not other Firefox users.
  - mrtesthah 4y ago
    This doesn't contradict anything I said. If you believe you are contradicting what I said, perhaps you could rephrase what you thought my comment was communicating. Otherwise, I will interpret the intent of your reply as adding supporting details.
  - jandrese 4y ago
    The fact that they can detect that you're using the TOR browser configuration isn't that shocking when they also see that you are coming out of a TOR exit node, or the site you are loading is an Onion site. The anonymity comes from looking like every other person who downloaded Tails.
    - RL_Quine 4y ago
      Yes.
stefan_ 4y ago
They also still enable JavaScript by default, which is time and time again the source of these vulnerabilities.
- jerheinze 4y ago
  This has been eloquently addressed by Tor veteran Mike Perry:[1] Concerns about Javascript are rooted in two avenues: 1. Fingerprinting concerns. 2. Zero-day exploits against Firefox. The reason we feel that leaving Javascript enabled trumps these concerns is: 1. We want enough people to actually use Tor Browser such that it becomes less interesting that you're a Tor user. We have plenty of academic research and mathematical proofs that tell us quite clearly that the more people use Tor, the better the privacy, anonymity, and traffic analysis resistance properties will become. In fact, my personal goal is to grab the entire "Do Not Track" userbase from Mozilla. That userbase is probably well in excess of 12.5 million people: http://www.techworld.com.au/article/400248/ http://www.techworld.com.au/article/400248/ I do not believe we can capture that userbase if we ship a JS-disabled-by-default browser. 2. Exploitable vulnerabilities can be anywhere in the browser, not just in the JS interpreter. We disable and/or click-to-play the known major vectors, but the best solutions here are providing bug bounties (Mozilla does this; we should too, if we had any money) and sandboxing systems (Seatbelt, AppArmor, SELinux). [1] : https://lists.torproject.org/pipermail/tor-talk/2012-May/024227.html https://lists.torproject.org/pipermail/tor-talk/2012-May/024...
cheeze 4y ago
I've always assumed that Tor was a top target for 3 letter agencies. In that sense, there is so much attention on it that it's kinda pointless.
- smm11 4y ago
  Where did Tor come from, again?
  - lucb1e 4y ago
    "Comments should get more thoughtful and substantive, not less, as a topic gets more divisive." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html (Not sure a rhetorical question to make some vague accusation counts as a substantive comment)
    - ziddoap 4y ago
      It's not a "vague accusation", onion routing was developed by the US Naval Research Academy ("NRL", a 3 letter government agency). See https://en.wikipedia.org/wiki/Tor_(network)#History https://en.wikipedia.org/wiki/Tor_(network)#History for more detail.
      - lucb1e 4y ago
        The vague accusation is that because "onion routing"[1] has roots in the military, it must have a backdoor that we haven't uncovered in decades. If the person had posted this Wikipedia link with the info you mentioned, for example, I wouldn't have thought it unsubstantial per the guidelines (even if the claim/accusation itself is unsubstantiated by the evidence, that's a difference of opinion and not a guidelines thing). [1] Not the cryptography, not even the code implementation, but just the general concept: having a message packed in several layers of encryption such that intermediate routers don't know the contents. https://en.wikipedia.org/wiki/Onion_routing https://en.wikipedia.org/wiki/Onion_routing
      - wolverine876 4y ago
mikojan 4y ago
Vladimof 4y ago
> I'm ambivalent about Tor, but if you're using Tor, don't use the Browser Bundle. What do you suggest?
fsflover 4y ago
Or use Whonix on Qubes OS, relying on hardware virtualization to protect you.
_wldu 4y ago
I no longer use Tor either (unless I have to for work projects such as remote pentesting). What is you opinion of Landlock (Linux kernel 5.13 and newer)? If we wrap vanilla FireFox in LandLock, proxy that to tor and use Apparmor/Tomoyo to further limit what FireFox could do (when it gets compromised) then I think that would be a much safer approach than using the Tor Browser Bundle. Here's a landlock wrapper (in Go) for FireFox: https://github.com/62726164/misc/blob/main/go/landlock/firefox/main.go https://github.com/62726164/misc/blob/main/go/landlock/firef... Also, I've only ever been able to get Tomoyo to work as MAC for FireFox. SELinux and Apparmor were too difficult.
deleted 4y ago
[deleted]
jerheinze 4y ago
This is deeply misleading and based on old data. > A reminder that Tor Browser might be one of the least safe browsers you can run: it's a fork of Firefox, meaning that its maintainers have to coordinate and port patches from the mainline project. Tor Browser ships updates as soon as new ESR versions come out. > Firefox is already not one of the most hardened browser engines. That might've been true in the past, it's hard to argue for it now. > Meanwhile, the fork you'll be running is specifically designed to hide sensitive traffic, and collapses all those users into a single version for exploits to target. The overwhelming majority of exit traffic now is using HTTPS and Tor Browser ships with HTTPS Everywhere to avoid SSL Striping attacks (in fact the next version of the Tor Browser will have the HTTPS-Only mode enabled by default, it's already being tested in the alpha release), so how will those evil exit node burn those exploits? > I'm ambivalent about Tor, but if you're using Tor, don't use the Browser Bundle. First off, the "Tor Browser Bundle" is a deprecated name. If you're not using the Tor Browser you're making yourself both insecure (it ships with a smaller attack surface, no WebGL for example) and fingerprintable defeating thus the full privacy advantages of the Tor Browser. There is simply no other alternative. You can read the Tor Browser design documentation (though old) to get a rough sketch of what it's trying--and what it's not trying--to achieve: https://2019.www.torproject.org/projects/torbrowser/design/ https://2019.www.torproject.org/projects/torbrowser/design/ Further reading in case you think VPNs are the solution: https://matt.traudt.xyz/posts/2019-10-17-you-want-tor-browser-not-a-vpn/ https://matt.traudt.xyz/posts/2019-10-17-you-want-tor-browse...
- criticaltinker 4y ago
  FYI I’m seeing a 404 from that last link. Is this the intended link? https://matt.traudt.xyz/posts/2019-10-17-you-want-tor-browser-not-a-vpn/ https://matt.traudt.xyz/posts/2019-10-17-you-want-tor-browse...
  - jerheinze 4y ago
    Thanks, corrected.
autoexec 4y ago
> Meanwhile, the fork you'll be running is specifically designed to hide sensitive traffic, and collapses all those users into a single version for exploits to target. Yeah, I was never a fan of their position on this. It's basically "let all websites track you and push ads at you all day long, but we've customized 50,000 settings so that you should look identical to everyone else using the Tor Browser" where as I don't trust that they've managed to cover every possible means to fingerprint a specific user/browser install. Instead, I prefer to limit the amount of data websites can collect about me in the first place. I harden the browser as best as I can, block all active content by default, block all the ads I can, and I randomize a few little details (like screen and window resolution or user agent) which in total makes me feel better about my chances of avoiding being fingerprinted across sites and prevents most of the vulnerabilities that would cause a person to get compromised just by browsing to a website. I still love the Tor Browser project though because they're great at spotting things introduced into firefox that would make it easier for you to be fingerprinted, and while I prefer to not give data, or give random data I do understand their reasoning for what they do.
aaron695 4y ago
yjftsjthsd-h 4y ago
> Firefox is already not one of the most hardened browser engines I'm pretty sure it's one of the most hardened, because the list of major engines that are on that list in first place numbers approximately 3. If you want to claim that blink or webkit are more secure that's a reasonable argument, but just say that.
- pcwalton 4y ago
  Yeah, Gecko is one of the most hardened browser engines out there at this point. Fission and the win32k.sys isolation basically bring the general architecture up to par with Chromium. Chromium got those features earlier and hence has more mature implementations of them, so the edge goes to Chromium, but there's not much of a large-scale difference anymore. There are a few areas in which one browser has the edge over the other in terms of security (e.g. JIT hardening in Chromium's V8 gives it an advantage over Firefox, memory safety of pdf.js in Firefox reduces attack surface over the C++ PDFium in Chromium), but these are nowhere near the old days of "Chrome has a sandbox and Firefox doesn't" or even "Chrome isolates tabs from each other and Firefox doesn't".
  - littlestymaar 4y ago
    > memory safety of pdf.js in Firefox reduces attack surface over the C++ PDFium in Chromium I thought Firefox abandoned PDF.js a few month ago.
wp381640 4y ago
If you use anything but the Tor Browser on the Tor network you're going to stand out like a flare Further - many of the privacy enhancements in Firefox, such as fingerprint protection, were adopted from the work on Tor Browser
aftbit 4y ago
Perhaps you mean "don't rely on just the Tor Browser"? How else would one use tor to browse the web? Certainly Whonix or another protection layer is advisable if you're doing anything serious as well.
- cowtools 4y ago
  I don't know, you could just use a simpler (non-js) browser over torsocks
GekkePrutser 4y ago
> Meanwhile, the fork you'll be running is specifically designed to hide sensitive traffic, and collapses all those users into a single version for exploits to target. That's a good thing too because of browser fingerprinting. It takes a lot of identifying points away by having everyone use the same.
nikcub 4y ago
Terrible advice. If there is one thing I know from ~8 years of following the darkweb markets is that there's nothing worse than stepping outside of the common practice of: use Tor, use Tails, use Whonix If you read the the DOJ indictments of Tor users what they have in common is that they stepped out of those bounds There _was_ a period where Firefox (hence: the Tor Browser) was terrible and 0days were cheap (which is why most of the darkweb switched up to using VM's behing their browsers), but those days are over[0] I can't recall a recent indictment where the adversary in the USA broke Tor Browser. If you are a dissident in Turkey, Syria or Russia .. you're more than safe using the Tor Browser bundle. The NSA aren't burning 0days in Firefox and VM's on 99.9% of Tor users - if you're in that other 0.01% then good luck to you[1], your threat model is very different to those looking to obfuscate from oppressive regimes. As somebody with an infosec background, this is where I feel the industry fails in the sense of "perfect is the enemy of good" - there is no such thing as perfect (I bet most who preach against Tor Browser wouldn't be able to come up with a model that is) - the practical advice today is, and always has been, use Tor (Browser), use Tails, use Whonix [0] I used ungoogled-chromium in that period, until an DNM administrator during a chat told me he could spot me in his acccess logs
RektBoy 4y ago
So what are people supposed to use? Chrome? Rofl.
roastedpeacock 4y ago
Anyone know how much the Tor Browser 'Safer' security-level mitigates real exploits? Among several things it disables the JavaScript JIT functionality which has been a known mechanism for exploits.

rebelwebmaster 4y ago

These are just the pwn2own vulnerabilities. Nowhere did Mozilla ever say they were being exploited in the wild.

deleted 4y ago
[deleted]
mmastrac 4y ago
Perhaps they moved fast: "Mozilla is aware of websites exploiting this vulnerability already."
- rebelwebmaster 4y ago
  Citation needed. Also, they've specifically called that out in the advisory when they're aware of that being the case. See the last out-of-band security update they released for example: https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-0...
- dveditz_ 4y ago
  We are not aware of any such thing. As rebelwebmaster noted, when we know that we put it in our advisory. Clearly the vulnerabilities are exploitable as demonstrated by Manfred Paul's winning Pwn2Own entry. The details were disclosed only to Zero Day Initiative staff (the contest organizers) and Mozilla. They have not been discovered on any website in the wild.
  - dredmorbius 4y ago
    Who are "we" here?
    - AlexSW 4y ago
      Judging by the post and the user's post history, almost certainly 'we' refers to Mozilla.

Syonyk 4y ago

And this is why Whonix is critical - because even when you pop the browser, you still have another layer of protection - the gateway VM. Tails browser on [almost anything] is one browser exploit away from beaconing out directly from your IP, and has done so rather frequently over the years. Whonix stuffs the whole browser and such into a workstation VM, which is only connected to the gateway VM - which "torifies" everything coming in that port. So even if you pop the workstation and have root, you still can't beacon out directly without going through the gateway - you'd have to find an exploit in that bit as well, with only network access. Not impossible, but a lot harder. And then package all that into Qubes and use it that way, because a disposable Whonix VM set is probably the safest way to browse the web... And still disable Javascript.

matheusmoreira 4y ago
I knew about Tails but not Whonix. This is really nice. No live system like Tails though?
hamiltonians 4y ago
then why not just use Whonix
- Syonyk 4y ago
  "Whonix alone" is probably fine against browser exploits in the Tor browser (of which I generally assume there are many, because it's a browser of Very Much Interest to plenty of agencies). However, if you assume a "dirty host," with various bits of nastiness on it, if you're just using Virtualbox or something, it would be easy enough for a compromised Whonix workstation VM to chatter away with the host and have the host beacon out, or have the host modify the disk images for Whonix to add badness, or something of the sort. It's not a high risk, but if you're going to be doing something with Tor where failure of opsec puts you in prison for life (see DPR), it's something to consider. Qubes adds a few more layers of isolation and security, because you now have a Type 1 hypervisor under everything (currently Xen), with your other isolation VMs separated out. Badness in another VM can't directly impact the Whonix VMs, unless it's compromised Dom0, at which point you've lost with Qubes anyway. Both are at risk from a hypervisor escape as well, but I generally consider Xen to be a somewhat better inspected and harder to escape from target than Virtualbox or VMWare Workstation, just because there's less to Xen. It's a far smaller codebase, and when you're using hardware virtualization with paravirtualized devices (virtio-type interfaces), there's just not as much surface exposed for attack. It's not impossible, but I would generally consider VMWare/Virtualbox somewhat softer targets to escape from than Xen. Again, does any of this matter for casual use? No. But if you're going to use Tor for things that have actual consequences, it may very well matter a lot, and at that point, fully understanding the various threats and how they've been used over the years may be a matter of your freedom. For whatever it's worth, I try to add Tor traffic where I can, just to help with the noise factor.

landr0id 4y ago

It's a JavaScript engine bug and JS is disabled by default. Still important, but I question whether anyone who enables JS in Tor is worth compromising.

retox 4y ago
>JS is disabled by default This isn't true any more.
- deleted 4y ago
  [deleted]
- beebeepka 4y ago
  But it still comes with No script built in, so concerned user is left with a choice
- aqme28 4y ago
  I wonder why not. It seems like that's the cause of most of these.
  - staticassertion 4y ago
    Because the web isn't practically browsable without js, so rather than users fiddling with noscript and ending up disabling a ton of security features, instead they just turned js on.

joecool1029 4y ago

Just a heads up for Android users: The Play store version is a few releases out of date, to get current use FDroid and make sure Guardian Project repo is selected (it's not by default). Question for the Mozillans/Googlers: How is it that Firefox Nightly are fast-track released multiple times a day to Play Store but stable Tor Browser updates are stuck for weeks? Is there a 'skip the review' option for nightly releases?

_rdvw 4y ago
It may not be in that repo for much longer: https://gitlab.com/guardianproject/fdroid-metadata/-/issues/3 https://gitlab.com/guardianproject/fdroid-metadata/-/issues/...

anthk 4y ago

Links web browser has a Tor proxy enforcing setting. Set the proper Socks4a proxy to the Tor daemon's one and mark that checkbox. Enjoy.

3np 4y ago

Since it's not directly mentioned in the submitted link: Fixed in: Firefox 100.0.2, Firefox ESR 91.9.1, Firefox for Android 100.3, Thunderbird 91.9.1 https://www.mozilla.org/en-US/security/advisories/mfsa2022-19/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-1...

_rdvw 4y ago
I maintain a table with release history for Android builds: https://divestos.org/misc/ffa-dates.txt https://divestos.org/misc/ffa-dates.txt

elurg 4y ago

> This vulnerability doesn’t break the anonymity and encryption of Tor connections. > The Safest security level of Tor Browser is not affected because JavaScript is disabled at this security level. > For example, after you visit a malicious website, an attacker controlling this website might access the password or other sensitive information that you send to other websites afterwards during the same Tails session. This makes it relatively tame.