12 ms·

901614 – Adopt Tor as a feature in Firefox

DigitalSea 13y ago
This seems like a nice idea, but the developers of Firefox have made it more than known they would prefer to argue the inclusion and removal of version numbers as opposed to actual issues. Look how long it took them to fix the memory leaks that plagued the browser since version 2 and were only not long fixed? It's easy enough to set Tor up with Firefox yourself. Perhaps all that is needed is an easy to understand and access Tor guide. Perhaps the first page you see upon loading Firefox after installing or updating is a, "We recommend you use Tor for a safer browsing experience" and then give some scenarios where Tor should and shouldn't be used.
- marijn 13y ago
  Whenever I see this kind of poorly-informed bashing of the Mozilla team (always mentioning "the memory leaks") I can't help but wonder how the author would do building and maintaining a piece of software as big and complex as a modern Web browser. The thing to note is that these issues were fixed and Firefox is still a competitive, solid browser.
  - DigitalSea 13y ago
    It's well-intentioned bashing if you want to slap a label on it. I am one of the few that still use Firefox, I've used it since the beginning more or less and the memory leaks issue you attempt to downplay was a very real issue that plagued the browser for so long when Chrome came along and sanboxed everything, separate process and was super fast people jumped ship faster than the Titanic. The argument of turning around someone's opinion and asking how they would fix and maintain the problem is an exhausted counterargument that has no validity. It wasn't the Mozilla team didn't have the smarts to fix the memory leaks, it's the fact they denied there was even a problem for so long. It's all about prioritising what you work on. So if I had any involvement in Mozilla and Firefox's development, I would be prioritising what's important and what isn't. This place has really changed. You can't give your opinion on something without being down-voted into oblivion, even if your opinion is well-intentioned and constructive. My comment wasn't negative, it was my opinion. I didn't bash anyone, I'm sick of this place misconstruing other peoples comments (a frequent occurrence from what I've noticed).
- bzbarsky 13y ago
  Setting up tor as in using the Tor proxy is easy enough. Setting it up so it's actually not leaking information that would identify you is hard-to-impossible. See the things the Tor Browser Bundle ends up doing (including changes to C++ Gecko code!).
Achshar 13y ago
How is going to provide the ridiculously large requirement of exit nodes is this hits production? Don't exit nodes cost money in the sense that there is huge risk involved in running one?
tjoff 13y ago
This is really dangerous. Even enthusiasts mix up the anonymity offered with Tor with security. I can almost guarantee that this will do waaaay more harm than good. People will enable this and think they are safe while they are suddenly routing all their cleartext through an untrusted third party (that is, very often, malicious). At the very least a lot of passwords will be gathered (alongside email in a lot of cases) in insecure and unencrypted forums etc. And since most people have the same password for unencrypted forums as their email, facebook and twitter... For this to work it will have to be an option buried deep and before enabling it you'd have to have a huge nag box (the size of a blue screen) that clearly shows the dangers of this. And although many have tried I haven't seen any implementation of such a nag box that actually works (forces the user to think and not just press "OK"/"YES"). And even if it did work people won't understand it, at most they will understand that "okay, this is risky" but they have no way of evaluating that risk since they have no idea what they really are enabling. That said, Tor inbuilt into firefox would be awesome. I just can't imagine it doing more good than harm.
- pgeorgi 13y ago
  So only support TOR for TLS-managed connections and .onion sites. As for TLS, something like http://convergence.io/ http://convergence.io/ would be a nice thing to add by default.
- denzil_correa 13y ago
  You can actually put up the "this is dangerous" sign for pretty much any invention out there. I understand that you are not advocating "this should not be done" but like any other feature one needs to be vigilant with Tor.
- bad_user 13y ago
  It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly? For example, while I visited the US it happened at 2 motels I stayed at for their network to insert ads in the web pages I was visiting. So they where not only snooping my traffic, but going further into altering it. Also, go to any conference or gathering of people, create an open Wifi hotspot (like, with your phone) and then enjoy all the cookies and passwords flowing through, from all the clueless people that connect to it. Truth of the matter is, websites should be secure by default. Those that aren't represent a huge security risk. Fortunately many of the big ones are (e.g. GMail, Twitter, Facebook, etc...) Also see: [1] http://en.wikipedia.org/wiki/Firesheep http://en.wikipedia.org/wiki/Firesheep [2] http://faceniff.ponury.net/ http://faceniff.ponury.net/
oomkiller 13y ago
My last experience with Tor was somewhat painful due to the sluggish nature of it. If Firefox added Tor as a feature, making Tor "mainstream", could the existing Tor network handle the extra load?
- chalst 13y ago
  My understanding (I'm no expert on this) is that the more users, the more efficient routing is within the Tor network, in principle making .onion space less sluggish, but if you have a big increase in the number of users with no corresponding increase in provision of exit nodes, then the existing bottleneck for accessing sites outside Tor will get worse.
  - rmc 13y ago
    You need more "nodes" not "users". Tor isn't peer-to-peer amoung "users". You'd need more people to run nodes, which is a service/server you run.
    - cbr 13y ago
      Could exit-node functionality be added to firefox? Make it more peer-to-peer?
      - rmc 13y ago
        There is no technical reason why it couldn't be added. However there is political and ethnical reasons to not add that funcionality. There is debatable legality of running a tor exit node. You don't want "Use Firefox, get a visit to the police" to be a headline people can use why not to use FF.
    - chalst 13y ago
      Are you aware that users running the TOR Browser Bundle will normally be a node (i.e., they will provide proxying services to other users/nodes), just as with Bit Torrent clients?
brymaster 13y ago
This wouldn't work at all for mainline Firefox, or at least wouldn't be 'secure' as users might be thinking. One at least needs to have JavaScript disabled when on Tor or you'll easily be compromised and Firefox 23 now ships with JavaScript always-on. http://boingboing.net/2013/08/04/anonymous-web-host-shut-down.html http://boingboing.net/2013/08/04/anonymous-web-host-shut-dow...
- bad_user 13y ago
  Why is JavaScript an issue? In private mode no traces (like cookies) are permanent, so how can JavaScript be used against anonymity? Of course, it increases the surface area of attack for exploits, but is there something else I'm missing?
  - Skalman 13y ago
    It adds a great amount of fingerprintability.
    - foobarqux 13y ago
      Disabling javascript would probably add about the same amount of fingerprintability. Panopticlick says that 1 in 24000 browsers have the same fingerprint as TorBrowser.
  - tghw 13y ago
    There was a recent attack against TorBrowser that utilized a vulnerability in older versions of the Firefox Javascript engine. These sorts of vulnerabilities are not uncommon, so turning off JS significantly decreases the attack surface.
  - brymaster 13y ago
    Here's a good example: https://news.ycombinator.com/item?id=6154246 https://news.ycombinator.com/item?id=6154246
- kristofferR 13y ago
  TorBrowser ships with JavaScript on by default too.
willvarfar 13y ago
If it only works with secure connections, and there's a general improvement in bandwidth and it prompts some big non-profits-with-profits like Mozilla to actually run exit nodes in countries that don't cooperate with other exit-node countries, then ... yes, it could be a little bit better.
marshray 13y ago
This would be great in terms of creating the 'egg' to enable the 'chicken', ordinary web sites, to provide their service over Tor hidden services.
leokun 13y ago
I hope this doesn't happen. I would uninstall Firefox, and not even test development for our application in Firefox. Maybe I could test some other gecko-based browser, like SeaMonkey, but I don't want anything tor related on my computer.
- marshray 13y ago
  Why are you allergic to "anything tor related"?
  - leokun 13y ago
    I don't have a need for tor. I am not a political activist, I'm not a journalist. I'm not convinced that supporting tor is also not supporting criminal activity, such as child pornography and money laundering. I don't want software on my computer that I don't need and I don't like. If Firefox wants to dive deep into controversial and politically complicated topics, that's their right, but I don't have to have them on my computer or support that.
    - sargun 13y ago
      Do you support The Internet? The Internet is used for criminal activity, such as child pornography, and money laundering. ToR is infrastructure, and a utility for the masses. It's up to people on how they want to use it. Why is it worse than the internet?
      - leokun 13y ago
        It's a utility I don't have a need for. Sensitive information I don't want to disclose is hidden with SSL encryption. Maybe you have need for tor, I don't.
        nilved 13y ago
        http://www.wired.com/opinion/2013/06/why-i-have-nothing-to-hide-is-the-wrong-way-to-think-about-surveillance/ http://www.wired.com/opinion/2013/06/why-i-have-nothing-to-h...
petera 13y ago
I really doubt it would become a one-click privacy measure: If you like to participate in an onion-routed, privacy enhancing, anonymity network, why put it in an browser? A browser accesses that network, it is the weakest and least point in that setup. Because tor has no gui? Use vidalia (see https://www.torproject.org/projects/vidalia.html.en https://www.torproject.org/projects/vidalia.html.en). There are so many ways to track an individual, independent of the network, with java-script, extensions, addons, plugins, client-side-caching that even if tor becomes a feature in firefox, the slightest unmitigated problem, even your behavior may compromise your privacy.
- chakalakasp 13y ago
  Presumably Firefox would disable all add-ons, Flash, and possibly JavaScript if tor were enabled. Otherwise, yeah, all bets are off.
  - petera 13y ago
    Your forgot to purge the disk- and memory-caches.
sargun 13y ago
I think that a good, incremental first step would be adding ToR into Firefox with support for the .onion domain. This offsets the problem that there could be potentially dangerous exits sniffing your traffic. Additionally, this makes ToR space much more accessible. The (slight) problem of this is that it'll probably put significantly higher load on the ToR relays, and considering that they're already over capacity, it could hurt ToR badly. Maybe, the relay code could be bundled into Firefox, and there could be a toggle for "make me into a relay"
- mordae 13y ago
  According to some providers, relays are doing just fine (40 Mbps on a 100 Mbps line). There is significantly more relays than exit nodes because law enforcement can't really see them and harass you.
- mlinksva 13y ago
  > adding ToR into Firefox with support for the .onion domain I love this independent of any other step. Would make using and running hidden services much more attractive.
Yuioup 13y ago
I got my wife banned from EsperNet IRC because I was playing around with Tor one evening. Here is their policy: http://www.esper.net/rbl.php http://www.esper.net/rbl.php Our ip-address at home ended up on a blacklist. Eventually the ban was lifted but my wife was not happy for a couple of days ... I wonder if there are other services (IRC, MMO, etc...) that adopt a NO TOR policy.
- marshray 13y ago
  Unless you were running an exit node I don't see the logic in blocking you. I think that kind of aggressive scanning is pretty rare.
  - Yuioup 13y ago
    Yes I was. I was using the Tor browser bundle and checked the box in the settings. Good thing you mentioned that detail I've forgotten it. But still though. If they make Tor a feature in Firefox what is stopping any user from checking that box?
- simmons 13y ago
  Well, Hacker News, for one, seems to auto-hellban posts (or new user registrations?) from Tor. I'm not sure if this is specifically targeting Tor, or if it's some automated system reacting to active abuse from Tor exit node IP addresses. I imagine it can be a tough call for web site operators who want to support anonymity, but also don't want to deal with the bad apples who will use it to create grief.
poolpool 13y ago
Ah yes. Adding a US government owned and operated platform to your product for "anonomity."
- IgorPartola 13y ago
  OMFG how many times will this fucking argument be brought up? It is open source. Who cares? The Internet was a government sponsored project at one point too.
  - poolpool 13y ago
    Except that enough nodes are controlled by government entities to eliminate most if not all of the benefits.
    - IgorPartola 13y ago
      Which has nothing to do with who invented it.
tuananh 13y ago
isn't TorBrowser actually Firefox browser with Tor preinstalled?
- corin_ 13y ago
  The idea here is to bring Tor to a wider audience - not that it would be the first time Tor can be used through Firefox. There may also be other technical advantages or disadvantages, such as the fact that main Firefox will get updates quicker than TorBrowser.
- untothebreach 13y ago
  If I remember correctly, TorBrowser is Firefox + patches + a couple extra extensions.
- bzbarsky 13y ago
  No, it has C++-level patches too.
rjzzleep 13y ago
i feel like an obvious problem is being overlooked. if every firefox bundles tor, mozilla might end up on government blocklists all by itself.
badon 13y ago
It would be fine to just have the feature so .oninon sites are accessible. To get more than that requires education, much like an aircraft pilot. One small mistake and you may literally get yourself and others killed. Even Tor Browser can't be trusted, due to bugs. A bare beginning solution is a firewall to block non-Tor connections: http://www.reddit.com/r/onions/comments/1l15hx/10_steps_to_make_tor_safer_with_pfsense/ http://www.reddit.com/r/onions/comments/1l15hx/10_steps_to_m... Without that, you're just the Titanic happily floating across the ocean without making sure you've got enough lifeboats if something goes wrong. Should failure always mean death? Is it too much to ask to insist on a firewall safety net to block non-Tor connections when the next bug is found in the Tor Browser Bundle (or whatever)? I'm all for making .onion sites reachable, as long as that's the only thing this new feature promises to do. It would make *.onion sites mainstream, which is good for everybody. Strength in numbers, heard immunity, get lost in the crowd - that's precisely what Tor relies on to achieve its most basic goals. Taking Tor mainstream with support in Firefox would mean there would be more Tor users for the seriously privacy-paranoid to hide behind.

This seems like a nice idea, but the developers of Firefox have made it more than known they would prefer to argue the inclusion and removal of version numbers as opposed to actual issues. Look how long it took them to fix the memory leaks that plagued the browser since version 2 and were only not long fixed? It's easy enough to set Tor up with Firefox yourself. Perhaps all that is needed is an easy to understand and access Tor guide. Perhaps the first page you see upon loading Firefox after installing or updating is a, "We recommend you use Tor for a safer browsing experience" and then give some scenarios where Tor should and shouldn't be used.

marijn 13y ago
Whenever I see this kind of poorly-informed bashing of the Mozilla team (always mentioning "the memory leaks") I can't help but wonder how the author would do building and maintaining a piece of software as big and complex as a modern Web browser. The thing to note is that these issues were fixed and Firefox is still a competitive, solid browser.
- DigitalSea 13y ago
  It's well-intentioned bashing if you want to slap a label on it. I am one of the few that still use Firefox, I've used it since the beginning more or less and the memory leaks issue you attempt to downplay was a very real issue that plagued the browser for so long when Chrome came along and sanboxed everything, separate process and was super fast people jumped ship faster than the Titanic. The argument of turning around someone's opinion and asking how they would fix and maintain the problem is an exhausted counterargument that has no validity. It wasn't the Mozilla team didn't have the smarts to fix the memory leaks, it's the fact they denied there was even a problem for so long. It's all about prioritising what you work on. So if I had any involvement in Mozilla and Firefox's development, I would be prioritising what's important and what isn't. This place has really changed. You can't give your opinion on something without being down-voted into oblivion, even if your opinion is well-intentioned and constructive. My comment wasn't negative, it was my opinion. I didn't bash anyone, I'm sick of this place misconstruing other peoples comments (a frequent occurrence from what I've noticed).
bzbarsky 13y ago
Setting up tor as in using the Tor proxy is easy enough. Setting it up so it's actually not leaking information that would identify you is hard-to-impossible. See the things the Tor Browser Bundle ends up doing (including changes to C++ Gecko code!).

Achshar 13y ago

How is going to provide the ridiculously large requirement of exit nodes is this hits production? Don't exit nodes cost money in the sense that there is huge risk involved in running one?

tjoff 13y ago

This is really dangerous. Even enthusiasts mix up the anonymity offered with Tor with security. I can almost guarantee that this will do waaaay more harm than good. People will enable this and think they are safe while they are suddenly routing all their cleartext through an untrusted third party (that is, very often, malicious). At the very least a lot of passwords will be gathered (alongside email in a lot of cases) in insecure and unencrypted forums etc. And since most people have the same password for unencrypted forums as their email, facebook and twitter... For this to work it will have to be an option buried deep and before enabling it you'd have to have a huge nag box (the size of a blue screen) that clearly shows the dangers of this. And although many have tried I haven't seen any implementation of such a nag box that actually works (forces the user to think and not just press "OK"/"YES"). And even if it did work people won't understand it, at most they will understand that "okay, this is risky" but they have no way of evaluating that risk since they have no idea what they really are enabling. That said, Tor inbuilt into firefox would be awesome. I just can't imagine it doing more good than harm.

pgeorgi 13y ago
So only support TOR for TLS-managed connections and .onion sites. As for TLS, something like http://convergence.io/ http://convergence.io/ would be a nice thing to add by default.
denzil_correa 13y ago
You can actually put up the "this is dangerous" sign for pretty much any invention out there. I understand that you are not advocating "this should not be done" but like any other feature one needs to be vigilant with Tor.
bad_user 13y ago
It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly? For example, while I visited the US it happened at 2 motels I stayed at for their network to insert ads in the web pages I was visiting. So they where not only snooping my traffic, but going further into altering it. Also, go to any conference or gathering of people, create an open Wifi hotspot (like, with your phone) and then enjoy all the cookies and passwords flowing through, from all the clueless people that connect to it. Truth of the matter is, websites should be secure by default. Those that aren't represent a huge security risk. Fortunately many of the big ones are (e.g. GMail, Twitter, Facebook, etc...) Also see: [1] http://en.wikipedia.org/wiki/Firesheep http://en.wikipedia.org/wiki/Firesheep [2] http://faceniff.ponury.net/ http://faceniff.ponury.net/

oomkiller 13y ago

My last experience with Tor was somewhat painful due to the sluggish nature of it. If Firefox added Tor as a feature, making Tor "mainstream", could the existing Tor network handle the extra load?

chalst 13y ago
My understanding (I'm no expert on this) is that the more users, the more efficient routing is within the Tor network, in principle making .onion space less sluggish, but if you have a big increase in the number of users with no corresponding increase in provision of exit nodes, then the existing bottleneck for accessing sites outside Tor will get worse.
- rmc 13y ago
  You need more "nodes" not "users". Tor isn't peer-to-peer amoung "users". You'd need more people to run nodes, which is a service/server you run.
  - cbr 13y ago
    Could exit-node functionality be added to firefox? Make it more peer-to-peer?
    - rmc 13y ago
      There is no technical reason why it couldn't be added. However there is political and ethnical reasons to not add that funcionality. There is debatable legality of running a tor exit node. You don't want "Use Firefox, get a visit to the police" to be a headline people can use why not to use FF.
  - chalst 13y ago
    Are you aware that users running the TOR Browser Bundle will normally be a node (i.e., they will provide proxying services to other users/nodes), just as with Bit Torrent clients?

brymaster 13y ago

This wouldn't work at all for mainline Firefox, or at least wouldn't be 'secure' as users might be thinking. One at least needs to have JavaScript disabled when on Tor or you'll easily be compromised and Firefox 23 now ships with JavaScript always-on. http://boingboing.net/2013/08/04/anonymous-web-host-shut-down.html http://boingboing.net/2013/08/04/anonymous-web-host-shut-dow...

bad_user 13y ago
Why is JavaScript an issue? In private mode no traces (like cookies) are permanent, so how can JavaScript be used against anonymity? Of course, it increases the surface area of attack for exploits, but is there something else I'm missing?
- Skalman 13y ago
  It adds a great amount of fingerprintability.
  - foobarqux 13y ago
    Disabling javascript would probably add about the same amount of fingerprintability. Panopticlick says that 1 in 24000 browsers have the same fingerprint as TorBrowser.
- tghw 13y ago
  There was a recent attack against TorBrowser that utilized a vulnerability in older versions of the Firefox Javascript engine. These sorts of vulnerabilities are not uncommon, so turning off JS significantly decreases the attack surface.
- brymaster 13y ago
  Here's a good example: https://news.ycombinator.com/item?id=6154246 https://news.ycombinator.com/item?id=6154246
kristofferR 13y ago
TorBrowser ships with JavaScript on by default too.

willvarfar 13y ago

If it only works with secure connections, and there's a general improvement in bandwidth and it prompts some big non-profits-with-profits like Mozilla to actually run exit nodes in countries that don't cooperate with other exit-node countries, then ... yes, it could be a little bit better.

marshray 13y ago

This would be great in terms of creating the 'egg' to enable the 'chicken', ordinary web sites, to provide their service over Tor hidden services.

leokun 13y ago

I hope this doesn't happen. I would uninstall Firefox, and not even test development for our application in Firefox. Maybe I could test some other gecko-based browser, like SeaMonkey, but I don't want anything tor related on my computer.

marshray 13y ago
Why are you allergic to "anything tor related"?
- leokun 13y ago
  I don't have a need for tor. I am not a political activist, I'm not a journalist. I'm not convinced that supporting tor is also not supporting criminal activity, such as child pornography and money laundering. I don't want software on my computer that I don't need and I don't like. If Firefox wants to dive deep into controversial and politically complicated topics, that's their right, but I don't have to have them on my computer or support that.
  - sargun 13y ago
    Do you support The Internet? The Internet is used for criminal activity, such as child pornography, and money laundering. ToR is infrastructure, and a utility for the masses. It's up to people on how they want to use it. Why is it worse than the internet?
    - leokun 13y ago
      It's a utility I don't have a need for. Sensitive information I don't want to disclose is hidden with SSL encryption. Maybe you have need for tor, I don't.
      - nilved 13y ago
        http://www.wired.com/opinion/2013/06/why-i-have-nothing-to-hide-is-the-wrong-way-to-think-about-surveillance/ http://www.wired.com/opinion/2013/06/why-i-have-nothing-to-h...

petera 13y ago

I really doubt it would become a one-click privacy measure: If you like to participate in an onion-routed, privacy enhancing, anonymity network, why put it in an browser? A browser accesses that network, it is the weakest and least point in that setup. Because tor has no gui? Use vidalia (see https://www.torproject.org/projects/vidalia.html.en https://www.torproject.org/projects/vidalia.html.en). There are so many ways to track an individual, independent of the network, with java-script, extensions, addons, plugins, client-side-caching that even if tor becomes a feature in firefox, the slightest unmitigated problem, even your behavior may compromise your privacy.

chakalakasp 13y ago
Presumably Firefox would disable all add-ons, Flash, and possibly JavaScript if tor were enabled. Otherwise, yeah, all bets are off.
- petera 13y ago
  Your forgot to purge the disk- and memory-caches.

sargun 13y ago

I think that a good, incremental first step would be adding ToR into Firefox with support for the .onion domain. This offsets the problem that there could be potentially dangerous exits sniffing your traffic. Additionally, this makes ToR space much more accessible. The (slight) problem of this is that it'll probably put significantly higher load on the ToR relays, and considering that they're already over capacity, it could hurt ToR badly. Maybe, the relay code could be bundled into Firefox, and there could be a toggle for "make me into a relay"

mordae 13y ago
According to some providers, relays are doing just fine (40 Mbps on a 100 Mbps line). There is significantly more relays than exit nodes because law enforcement can't really see them and harass you.
mlinksva 13y ago
> adding ToR into Firefox with support for the .onion domain I love this independent of any other step. Would make using and running hidden services much more attractive.

Yuioup 13y ago

I got my wife banned from EsperNet IRC because I was playing around with Tor one evening. Here is their policy: http://www.esper.net/rbl.php http://www.esper.net/rbl.php Our ip-address at home ended up on a blacklist. Eventually the ban was lifted but my wife was not happy for a couple of days ... I wonder if there are other services (IRC, MMO, etc...) that adopt a NO TOR policy.

marshray 13y ago
Unless you were running an exit node I don't see the logic in blocking you. I think that kind of aggressive scanning is pretty rare.
- Yuioup 13y ago
  Yes I was. I was using the Tor browser bundle and checked the box in the settings. Good thing you mentioned that detail I've forgotten it. But still though. If they make Tor a feature in Firefox what is stopping any user from checking that box?
simmons 13y ago
Well, Hacker News, for one, seems to auto-hellban posts (or new user registrations?) from Tor. I'm not sure if this is specifically targeting Tor, or if it's some automated system reacting to active abuse from Tor exit node IP addresses. I imagine it can be a tough call for web site operators who want to support anonymity, but also don't want to deal with the bad apples who will use it to create grief.

poolpool 13y ago

Ah yes. Adding a US government owned and operated platform to your product for "anonomity."

IgorPartola 13y ago
OMFG how many times will this fucking argument be brought up? It is open source. Who cares? The Internet was a government sponsored project at one point too.
- poolpool 13y ago
  Except that enough nodes are controlled by government entities to eliminate most if not all of the benefits.
  - IgorPartola 13y ago
    Which has nothing to do with who invented it.

tuananh 13y ago

isn't TorBrowser actually Firefox browser with Tor preinstalled?

corin_ 13y ago
The idea here is to bring Tor to a wider audience - not that it would be the first time Tor can be used through Firefox. There may also be other technical advantages or disadvantages, such as the fact that main Firefox will get updates quicker than TorBrowser.
untothebreach 13y ago
If I remember correctly, TorBrowser is Firefox + patches + a couple extra extensions.
bzbarsky 13y ago
No, it has C++-level patches too.

rjzzleep 13y ago

i feel like an obvious problem is being overlooked. if every firefox bundles tor, mozilla might end up on government blocklists all by itself.

badon 13y ago

It would be fine to just have the feature so .oninon sites are accessible. To get more than that requires education, much like an aircraft pilot. One small mistake and you may literally get yourself and others killed. Even Tor Browser can't be trusted, due to bugs. A bare beginning solution is a firewall to block non-Tor connections: http://www.reddit.com/r/onions/comments/1l15hx/10_steps_to_make_tor_safer_with_pfsense/ http://www.reddit.com/r/onions/comments/1l15hx/10_steps_to_m... Without that, you're just the Titanic happily floating across the ocean without making sure you've got enough lifeboats if something goes wrong. Should failure always mean death? Is it too much to ask to insist on a firewall safety net to block non-Tor connections when the next bug is found in the Tor Browser Bundle (or whatever)? I'm all for making .onion sites reachable, as long as that's the only thing this new feature promises to do. It would make *.onion sites mainstream, which is good for everybody. Strength in numbers, heard immunity, get lost in the crowd - that's precisely what Tor relies on to achieve its most basic goals. Taking Tor mainstream with support in Firefox would mean there would be more Tor users for the seriously privacy-paranoid to hide behind.