5 ms·

Tor Browser 4.5 is released

userisme 11y ago
Is anyone else getting a message that says: Your connection is not private Attackers might be trying to steal your information from blog.torproject.org (for example, passwords, messages, or credit cards). ReloadHide advanced blog.torproject.org normally uses encryption to protect your information. When Chrome tried to connect to blog.torproject.org this time, the website sent back unusual and incorrect credentials. Either an attacker is trying to pretend to be blog.torproject.org, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Chrome stopped the connection before any data was exchanged. You cannot visit blog.torproject.org right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. NET::ERR_CERT_COMMON_NAME_INVALID
- blacksmith_tb 11y ago
  If you are on OSX, recent updates may have broken some of your certs: https://security.stackexchange.com/questions/85830/why-is-symantec-verisign-ca-appearing-as-an-invalid-authority https://security.stackexchange.com/questions/85830/why-is-sy...
- easong 11y ago
  No, and ssllabs seems to think the cert is fine as well. https://www.ssllabs.com/ssltest/analyze.html?d=blog.torproject.org&latest https://www.ssllabs.com/ssltest/analyze.html?d=blog.torproje...
- taejo 11y ago
  I don't get this warning. Is your ISP/company/hotel/OEM/... MITMing your connections? I get a certificate with SHA1 fingerprint DE 20 3D 46 FD C3 68 EB BA 40 56 39 F5 FA FD F5 4E 3A 1F 83
- vbezhenar 11y ago
  Safari, Chrome, Firefox works fine. Can you share the certificate this site serves to you?
  - joshstrange 11y ago
    Completely valid question but OP should know this may expose where they work and/or their location. That said I would be interested in seeing the cert.
- omg_ketchup 11y ago
  For the record, I'm getting the same error. I'm on a company network, so I can only assume it's being blocked by whatever blocks (or doesn't block) porn.
- finnn 11y ago
  Can you post info about the cert you're getting? On Chrome, this is done by clicking the lock icon by the https, selecting the "Connection" tab, then clicking the "Certificate Information" link. As was pointed out elsewhere, be aware that this may expose information about your network.
- darkhorn 11y ago
  Firefox on Windows. No issues.
undefined0 11y ago
They have switched to Disconnect.me as the default search engine. It's hosted by Amazon, in the US. Why did they decide to use it? Also, the image searches link to Google ("https://www.google.com/url?q=..." https://www.google.com/url?q=...") whilst saying it's protected. With that said, I prefer the design in comparison to Startpage. But privacy should take priority. Honestly, Startpage could dramatically improve their design just by removing that background image.
- sdab 11y ago
  Interesting point about image search. In fact, when I perform a Google image search through disconnect and click on an image I see a record of it on google.com/history (while the search itself is not present). I suppose its only to be expected once one thinks about your observation that the links are pointing at google.
- kristjankalm 11y ago
  from comments below the blog post: "Startpage was not happy with our traffic and showed sometimes CAPTCHAs. Disconnect on the other hand approached us with respect to search engine traffic and donated some money."
  - voltagex_ 11y ago
    Why wouldn't they use DuckDuckGo?
    - bigiain 11y ago
      Especially since they are available via a hidden service, removing the "malicious exit node" risk: http://3g2upl4pq6kufc4m.onion http://3g2upl4pq6kufc4m.onion (Note, if you're reading Gabriel, the http://ye.gg/tor http://ye.gg/tor url you've handed out in various places including the privacy page - is dead and redirecting to just http://ye.gg/ http://ye.gg/)
lessthunk 11y ago
We should all help promote the use for Tor!
imaginenore 11y ago
Does anybody know why neither Chrome nor Firefox have TOR routing built-in? It would be so awesome to open .onion links without having to jump through hoops.
- Zuider 11y ago
  There are extensions to do this, but it compromises security.

Is anyone else getting a message that says: Your connection is not private Attackers might be trying to steal your information from blog.torproject.org (for example, passwords, messages, or credit cards). ReloadHide advanced blog.torproject.org normally uses encryption to protect your information. When Chrome tried to connect to blog.torproject.org this time, the website sent back unusual and incorrect credentials. Either an attacker is trying to pretend to be blog.torproject.org, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Chrome stopped the connection before any data was exchanged. You cannot visit blog.torproject.org right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. NET::ERR_CERT_COMMON_NAME_INVALID

blacksmith_tb 11y ago
If you are on OSX, recent updates may have broken some of your certs: https://security.stackexchange.com/questions/85830/why-is-symantec-verisign-ca-appearing-as-an-invalid-authority https://security.stackexchange.com/questions/85830/why-is-sy...
easong 11y ago
No, and ssllabs seems to think the cert is fine as well. https://www.ssllabs.com/ssltest/analyze.html?d=blog.torproject.org&latest https://www.ssllabs.com/ssltest/analyze.html?d=blog.torproje...
taejo 11y ago
I don't get this warning. Is your ISP/company/hotel/OEM/... MITMing your connections? I get a certificate with SHA1 fingerprint DE 20 3D 46 FD C3 68 EB BA 40 56 39 F5 FA FD F5 4E 3A 1F 83
vbezhenar 11y ago
Safari, Chrome, Firefox works fine. Can you share the certificate this site serves to you?
- joshstrange 11y ago
  Completely valid question but OP should know this may expose where they work and/or their location. That said I would be interested in seeing the cert.
omg_ketchup 11y ago
For the record, I'm getting the same error. I'm on a company network, so I can only assume it's being blocked by whatever blocks (or doesn't block) porn.
finnn 11y ago
Can you post info about the cert you're getting? On Chrome, this is done by clicking the lock icon by the https, selecting the "Connection" tab, then clicking the "Certificate Information" link. As was pointed out elsewhere, be aware that this may expose information about your network.
darkhorn 11y ago
Firefox on Windows. No issues.

undefined0 11y ago

They have switched to Disconnect.me as the default search engine. It's hosted by Amazon, in the US. Why did they decide to use it? Also, the image searches link to Google ("https://www.google.com/url?q=..." https://www.google.com/url?q=...") whilst saying it's protected. With that said, I prefer the design in comparison to Startpage. But privacy should take priority. Honestly, Startpage could dramatically improve their design just by removing that background image.

sdab 11y ago
Interesting point about image search. In fact, when I perform a Google image search through disconnect and click on an image I see a record of it on google.com/history (while the search itself is not present). I suppose its only to be expected once one thinks about your observation that the links are pointing at google.
kristjankalm 11y ago
from comments below the blog post: "Startpage was not happy with our traffic and showed sometimes CAPTCHAs. Disconnect on the other hand approached us with respect to search engine traffic and donated some money."
- voltagex_ 11y ago
  Why wouldn't they use DuckDuckGo?
  - bigiain 11y ago
    Especially since they are available via a hidden service, removing the "malicious exit node" risk: http://3g2upl4pq6kufc4m.onion http://3g2upl4pq6kufc4m.onion (Note, if you're reading Gabriel, the http://ye.gg/tor http://ye.gg/tor url you've handed out in various places including the privacy page - is dead and redirecting to just http://ye.gg/ http://ye.gg/)

lessthunk 11y ago

We should all help promote the use for Tor!

imaginenore 11y ago

Does anybody know why neither Chrome nor Firefox have TOR routing built-in? It would be so awesome to open .onion links without having to jump through hoops.

Zuider 11y ago
There are extensions to do this, but it compromises security.