4 ms·

FBI has, in one case where the exploit was spotted and made public (and they probably knew it would be, since it was deployed so widely), exploited an out-of-da

by comex 12y ago

FBI has, in one case where the exploit was spotted and made public (and they probably knew it would be, since it was deployed so widely), exploited an out-of-date version of TorBrowser. No guarantee that they don't use zero-days elsewhere or won't in the future. This is why I think TorBrowser should switch to Chromium. Whatever you have to say about Google, Chromium is unambiguously more secure than Firefox.

jordigh 12y ago
Unambiguously? This seems like a strong statement. What makes you say that?
- aaron42net 12y ago
  Until Firefox tightens their sandbox, I believe any exploit can still use system calls to directly create TCP sockets. Chrome forces sandboxed processes to use its network stack; if that's been configured to use Tor, it shouldn't end up revealing your IP and therefore identity.
- Niten 12y ago
  comex's statement is correct. Chrome/Chromium was designed from the ground up for fine-grained sandboxing of renderers and extensions; Firefox's single-process design currently prevents it from implementing any similar layered defense. Mozilla acknowledges as much with the mission statement of their Electrolysis project: https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis Hopefully Firefox's situation will improve in the near future—at the very least, we'll all benefit if Chrome has a viable competitor. But in the meantime Firefox absolutely is behind Chrome in the security department.
wtallis 12y ago
If you actually care about security and privacy, then there are plenty of Firefox extensions that go far beyond what can be done with Chromium. Even just adding NoScript to Firefox closes whatever gap still exists. (Aside from the process-per-tab model, what's Chromium got out of the box that Firefox still lacks?)
- debux 12y ago
  NoScript equivalent for Chrome is "HTTP Switchboard"
  - wtallis 12y ago
    Only superficially, and even then, they're not really equivalent. HTTP Switchboard has some blocking features that NoScript users need to use things like AdBlock Plus and RequestPolicy to get. NoScript's features aside from script and plugin blocking are completely beyond the scope of HTTP Switchboard, and some of them are completely unique to NoScript.
  - finnn 12y ago
    Hardly, but chrome does has an option to disable Javascript on a per site basis, similar to NoScript.
- coderzach 12y ago
  Sandboxed processes. There are limits to what code running in chrome can do. AFAIK firefox provides no such guarantees.
  - Freaky 12y ago
    Firefox is moving in that direction at least: https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis
- comex 12y ago
  It's certainly true that using NoScript prevents most browser exploits (though not all), and that if you're strongly concerned about privacy, you should use it. And make sure not to disable it for any trusted darknet sites, since as this article reminds, they have a habit of being compromised... I'm not trying to be sarcastic - this is totally reasonable for many use cases. But the default browser bundle leaves JavaScript enabled by default for good reasons[1], and if you want higher security with JavaScript enabled and/or against non-JS exploits, Chrome's process sandbox is a big deal, and will probably keep it significantly more secure than Firefox for a good amount of time.
dublinben 12y ago
The TorBrowserBundle is based on Firefox ESR. This is a stable release with extended support for security patches. There is no equivalent for Chromium, which is essentially the unstable track of the Chrome browser.
makomk 12y ago
Unfortunately, quite a lot of browser changes are required to prevent information leaks when using Tor, and it's not clear that Chromium can feasibly be made suitable or where the developer time to do it would come from. (That's I think part of the reason TorBrowser is based on Firefox ESR - they can't keep up with the new features otherwise. I don't believe Chromium has equivalent extended-support releases; in order to get security fixes you have to upgrade to new versions with new features and new information leaks.) If you screw up and miss something, the FBI might not even need to exploit a bug in order to find users' IP addresses, they could just use documented browser features to get users to connect to their honeypot using their real IP addresses.
- mike_hearn 12y ago
  This is an artifact of how Tor works. VPN services don't suffer from this issue because all traffic gets routed via the VPN at the operating system level.
  - makomk 12y ago
    Even then there's the issue of various browser and OS fingerprinting attacks which the current Tor Browser goes to significant effort to prevent. Tor actually supports a VPN-like mode, at least on Linux, but it can only protect against some classes of attack.
- pcwalton 12y ago
  Right. I don't believe that process sandboxing would have prevented what the FBI wanted to do here: unmask the identities of Tor users. I would be surprised if compromising a renderer at the moment didn't give you access to enough information for law enforcement to figure out who was accessing the site. (See the list of current leaks on the Site Isolation description [1] just to name a few.) As a practical example, the FBI could slurp usernames and passwords from other sites the user has been to, then subpoena them to determine if they'd ever logged in without Tor, and so forth. [1]: http://www.chromium.org/developers/design-documents/site-isolation http://www.chromium.org/developers/design-documents/site-iso...
RexRollman 12y ago
I think they should consider opening a conversation with Mozilla and see what can be worked out.

by comex 12y ago

jordigh 12y ago

Unambiguously? This seems like a strong statement. What makes you say that?

aaron42net 12y ago
Until Firefox tightens their sandbox, I believe any exploit can still use system calls to directly create TCP sockets. Chrome forces sandboxed processes to use its network stack; if that's been configured to use Tor, it shouldn't end up revealing your IP and therefore identity.
Niten 12y ago
comex's statement is correct. Chrome/Chromium was designed from the ground up for fine-grained sandboxing of renderers and extensions; Firefox's single-process design currently prevents it from implementing any similar layered defense. Mozilla acknowledges as much with the mission statement of their Electrolysis project: https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis Hopefully Firefox's situation will improve in the near future—at the very least, we'll all benefit if Chrome has a viable competitor. But in the meantime Firefox absolutely is behind Chrome in the security department.

wtallis 12y ago

If you actually care about security and privacy, then there are plenty of Firefox extensions that go far beyond what can be done with Chromium. Even just adding NoScript to Firefox closes whatever gap still exists. (Aside from the process-per-tab model, what's Chromium got out of the box that Firefox still lacks?)

debux 12y ago
NoScript equivalent for Chrome is "HTTP Switchboard"
- wtallis 12y ago
  Only superficially, and even then, they're not really equivalent. HTTP Switchboard has some blocking features that NoScript users need to use things like AdBlock Plus and RequestPolicy to get. NoScript's features aside from script and plugin blocking are completely beyond the scope of HTTP Switchboard, and some of them are completely unique to NoScript.
- finnn 12y ago
  Hardly, but chrome does has an option to disable Javascript on a per site basis, similar to NoScript.
coderzach 12y ago
Sandboxed processes. There are limits to what code running in chrome can do. AFAIK firefox provides no such guarantees.
- Freaky 12y ago
  Firefox is moving in that direction at least: https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis
comex 12y ago
It's certainly true that using NoScript prevents most browser exploits (though not all), and that if you're strongly concerned about privacy, you should use it. And make sure not to disable it for any trusted darknet sites, since as this article reminds, they have a habit of being compromised... I'm not trying to be sarcastic - this is totally reasonable for many use cases. But the default browser bundle leaves JavaScript enabled by default for good reasons[1], and if you want higher security with JavaScript enabled and/or against non-JS exploits, Chrome's process sandbox is a big deal, and will probably keep it significantly more secure than Firefox for a good amount of time.

dublinben 12y ago

The TorBrowserBundle is based on Firefox ESR. This is a stable release with extended support for security patches. There is no equivalent for Chromium, which is essentially the unstable track of the Chrome browser.

makomk 12y ago

Unfortunately, quite a lot of browser changes are required to prevent information leaks when using Tor, and it's not clear that Chromium can feasibly be made suitable or where the developer time to do it would come from. (That's I think part of the reason TorBrowser is based on Firefox ESR - they can't keep up with the new features otherwise. I don't believe Chromium has equivalent extended-support releases; in order to get security fixes you have to upgrade to new versions with new features and new information leaks.) If you screw up and miss something, the FBI might not even need to exploit a bug in order to find users' IP addresses, they could just use documented browser features to get users to connect to their honeypot using their real IP addresses.

mike_hearn 12y ago
This is an artifact of how Tor works. VPN services don't suffer from this issue because all traffic gets routed via the VPN at the operating system level.
- makomk 12y ago
  Even then there's the issue of various browser and OS fingerprinting attacks which the current Tor Browser goes to significant effort to prevent. Tor actually supports a VPN-like mode, at least on Linux, but it can only protect against some classes of attack.
pcwalton 12y ago
Right. I don't believe that process sandboxing would have prevented what the FBI wanted to do here: unmask the identities of Tor users. I would be surprised if compromising a renderer at the moment didn't give you access to enough information for law enforcement to figure out who was accessing the site. (See the list of current leaks on the Site Isolation description [1] just to name a few.) As a practical example, the FBI could slurp usernames and passwords from other sites the user has been to, then subpoena them to determine if they'd ever logged in without Tor, and so forth. [1]: http://www.chromium.org/developers/design-documents/site-isolation http://www.chromium.org/developers/design-documents/site-iso...

RexRollman 12y ago

I think they should consider opening a conversation with Mozilla and see what can be worked out.