Mozilla Project Fusion: Tor Integration into Firefox(trac.torproject.org)

757 pointsby jerheinze8 tahun yang lalu239 comments

trac.torproject.org

Mozilla Project Fusion: Tor Integration into Firefox

https://trac.torproject.org/projects/tor/wiki/org/meetings/2018Rome/Notes/FusionProject

241 comments

tomrittervg8 tahun yang lalu

Hi all. I am a Tor Project Developer and work at Mozilla on this project. We appreciate everyone's enthusiasm and feedback. Our ultimate goal is a long way away because of the amount of work to do and the necessity to match the safety of Tor Browser in Firefox when providing a Tor mode. There's no guarantee this will happen, but I hope it will and we will keep working towards it.

If anyone is interested in assisting development-wise, Firefox bugs tagged 'fingerprinting' in the whiteboard are a good place to start. You can also run Tor relays and help us improve the health of the network by working with Tor's new Relay Advocate (https://blog.torproject.org/get-help-running-your-relay-our-...). More people being involved in spec work (especially at the W3C) and focusing on fingerprinting and privacy concerns is also very useful - it's very hard to keep eyes on all the things happening everywhere.

We also appreciate users of Firefox Beta and Nightly (Nightly especially). The flags Tor features are developed behind (privacy.resistFingerprinting and privacy.firstparty.isolate) are experimental. I appreciate bug reports from users running these flags but you should expect them to break things on the web (resistFingerprinting especially; first party isolate is generally more stable and usually only has breakage on particular login forms).

xoa8 tahun yang lalu

>You can also run Tor relays and help us improve the health of the network by working with Tor's new Relay Advocate

Since I've seen this come up before in many previous discussions of Tor I think it's worth emphasizing/clarifying up front: Tor relays are not the same as Tor exit nodes. Relays do not talk to the public internet, they serve only the full encrypted internal Tor virtual network. So they won't ever send out traffic from an IP under your control to some website or general Internet system (and in turn tie that IP in any way to spam/abuse/whatever, at least not for that reason). It's not necessarily hidden that it is acting as a relay, but the relay itself will have no knowledge of the traffic it's carrying.

Plenty of people have reasonable concerns about the risks/inconveniences that might come with acting as an exit node, but on both a legal and practical level there are many more jurisdictions where merely relaying encrypted traffic between other relays isn't a problem. And it's still quite helpful, both for network speed and because purely internal Tor Hidden Services do not need any exit nodes at all.

pricechild8 tahun yang lalu

That said, plenty of providers use the list of tor relays (which is also public) to block traffic.

Sites such as https://www.dan.me.uk/dnsbl then help people do this.

That site in particular may "warn":

> This DNS blacklist contains ALL tor nodes (entry, transit and exit nodes) - think carefully before choosing to use this list for blocking purposes.

but anyone who doesn't understand tor simply won't understand the decision and choose ALL.

Running a relay on your own address isn't sensible because of this. Nevermind an exit node.

jandrese8 tahun yang lalu

As someone who has run a relay on my home network for years now this has never come up. At least not that I've been able to discern.

I think it might be a problem if I also ran a mail server from home, but almost nobody does that anymore.

lucb1e8 tahun yang lalu

I do, and I've run a Tor relay at home as well (also exit for a while).

mirimir8 tahun yang lalu

Yes, this is a common complaint from relay operators. Running relays at home, or on work networks, is risky.

zrm8 tahun yang lalu

One way to help that avoids this is to operate a bridge node. Bridge nodes are used as entry points into the Tor network for people in regions where Tor is blocked, so efforts are made to keep the addresses of bridges confidential. Which makes it less likely that people who don't know what they're doing will wrongfully put it on a block list.

jerheinze8 tahun yang lalu

One can also run pre-bridges for the snowflake transport by just having some JS code run in a browser's tab (requires WebRTC to be enabled): https://trac.torproject.org/projects/tor/wiki/doc/Snowflake

lozaning8 tahun yang lalu

I had nothing but pain when trying to run an exit node. Every site behind cloudflair would captcha me on what seemed like every page. Cox shut off my internet every other week due to "computers on my network being infected with viruses", and I'd have to call their support and tell them I cant be infected I only run linux at home.

I could do some shenanigans on my modem and end up with a new dynamic IP from cox, but generally within hours that new IP would be on whatever list people use to track exit node IPs and the pain would start all over again.

crtasm8 tahun yang lalu

Tor publishes a list of all exit nodes, anyone could have flagged your new IP as an exit immediately after your client reconnected to the network.

icelancer8 tahun yang lalu

And plenty of people insist that Tor relays are totally safe to run. They are not. I NEVER ran an exit node from my home IP, only relays, and my IP was still blacklisted from various sites due to this behavior.

I still contribute to Tor via VPS rentals and such, but relays are not no-risk alternatives to exit nodes. Period.

walrus018 tahun yang lalu

This is also, sadly, why the individual V4 /24 netblock of cheap VPS providers have terrible IP space reputations in most aggregated abuse systems.

kragormonkey8 tahun yang lalu

Do you have any idea why it's unsafe? In theory, public site should even be able to see your IP. How would they blacklist you?

Edit: nvm, found the answer by pricechild below.

walrus018 tahun yang lalu

Seconding the other posters who mentioned that tor relays and Tor exit nodes are two very different things.

"Why you need balls of steel to run a Tor exit node":

https://lists.torproject.org/pipermail/tor-talk/2009-Septemb...

Given the low level of technical knowledge with a great deal of US law enforcement, increasing militarization, no knock warrants, etc... Please think twice before running an exit node from your house. Do it in Colo somewhere with a small, plucky ISP owned by a first and fourth amendment absolutist.

azernik8 tahun yang lalu

> Our ultimate goal is a long way away because of the amount of work to do and the necessity to match the safety of Tor Browser in Firefox when providing a Tor mode.

If that doesn't pan out, do you expect the ongoing work on this project to reduce the size of the patches that the Tor Browser project needs to carry on top of the Firefox trunk?

cpeterso8 tahun yang lalu

Yes. This Mozilla wiki page has more information about (what Mozilla calls) the "Tor Uplift":

> The intention of Tor Uplift project is to land all Tor Browser patches so that Tor can directly use Firefox main trunk instead of a fork.

https://wiki.mozilla.org/Security/Tor_Uplift

ChrisSD8 tahun yang lalu

> first party isolate is generally more stable and usually only has breakage on particular login forms

Are you referring to third-party login services and comment systems (such as disqus and similar)?

jerheinze8 tahun yang lalu

> Are you referring to third-party login services and comment systems (such as disqus and similar)?

See the full list of bugs of breakage when privacy.firstparty.isolate is enabled: https://wiki.mozilla.org/Security/FirstPartyIsolation#First_...

mirimir8 tahun yang lalu

Most of those involve third-party logins. And most of the others mix domains unnecessarily, through lazy design.

fuckyouzilla8 tahun yang lalu

eganist8 tahun yang lalu

Thanks for your effort! If I can ask, how much overlap exists between your team and the team overseeing the implementation of security protocols within Firefox e.g. HSTS, CSP, etc.? It'd be neat to see Firefox drive innovation here alongside the effort to weave Tor into the browser; although I wouldn't necessarily treat Tor integration the same as I might the implementation of other security specifications, I can see how the teams working on such might overlap, hence my question.

tomrittervg8 tahun yang lalu

The Fusion project is done by a subset of that team (+me, I happen to sit with Sandboxing due to other responsibilities).

dat_boi208 tahun yang lalu

By passing this on to Mozilla and discontinuing Tor Browser, you're going to inherit the innumerable issues in their code base. Wouldn't it be easier to hard-fork and create a simple browser with minimal overhead? It doesn't have to be loaded with features. Just minimalist and private.

Some anti-features that come to my attention off the top of my head:

* Biometric login (as of FF60)

* Dumb PR Stunts like Mr. Robot

* Telemetry

* Balrog (Analytics and browser fingerprinting on AmazonS3)

* Social API

* VR sensors

* DRM

* Google Chrome (large contract Mozilla has with them as they backport this into IPC)

* CloudFlare DNS (Department of Homeland Security partner and Tor arch-enemy)

etc...

tomrittervg8 tahun yang lalu

Tor Browser will exist as long as Tor feels it needs to. If the features or anti-features in FF cause them to believe Firefox does not fit their need, then we're/they're not going to discontinue it.

jerheinze8 tahun yang lalu

> By passing this on to Mozilla and discontinuing Tor Browser, you're going to inherit the innumerable issues in their code base.

What issues exactly? Tor Browser = Firefox ESR + some patches + some other stuff and tweaks. Before the release of the next ESR TB devs rebase and submit these patches to mainline Firefox, that's why you have prefs like privacy.resistFingerprinting and privacy.firstparty.isolate in mainline Firefox, see: https://wiki.mozilla.org/Security/Tor_Uplift

exikyut8 tahun yang lalu

> Google Chrome (large contract Mozilla has with them as they backport this into IPC)

What's this?

anonymfus8 tahun yang lalu

>Biometric login (as of FF60)

Are you talking about Web Authentication? What is wrong with it?

ogennadi8 tahun yang lalu

> Ultimate eventual goal: Make Tor Browser obsolete, so Tor Project can focus on research instead of maintaining a fork of Firefox.

maerF0x08 tahun yang lalu

Hopefully other browsers are encouraged to do something similar also, else Mozilla will effectively control the destiny of Tor

jerheinze8 tahun yang lalu

Brave is already working on Tor private tabs though it won't have the same fingerprinting/first-party isolation guarantees as with a Tor Browser, https://github.com/brave/browser-laptop/labels/feature/tor Should be shipping soon https://twitter.com/BrendanEich/status/984231250104733696

sametmax8 tahun yang lalu

Good, now if only we could have bitorrent baked in...

EDIT: I mean baked in in the browser like tor, not baked in tor. Although interesting, it's really not my priority.

jean-8 tahun yang lalu

Firefox recently whitelisted a bunch of p2p protocols so that they can be used by browser extensions. One of them is the Dat protocol [0], which is similar to BitTorrent but has better support for mutable data and random access [1]. It's far from being "baked in", but it's a step in the right direction.

[0]: https://docs.datproject.org/

[1]: https://docs.datproject.org/faq#dat-vs

sametmax8 tahun yang lalu

We always could do that with extensions since JS is turing complete and has access to the network. Webtorrent is a thing after all.

The issue is not technical. It's just a chicken and egg problem. Most won't use bittorent unless it's stupidely easy to do. Remember that the average user don't know what an URL is and doesn't open new tabs willingly. Since they are the majority, they drive cost and benefits, so we must include them.

jean-8 tahun yang lalu

> We always could do that with extensions

You couldn't, until Firefox 59. Before that, protocol handlers were not allowed to handle links to Dat/IPFS resources [0].

And while I agree with your comment regarding the chicken and egg problem, there are still some technical issues. As the shadowbanned sibling comment says, extensions don't have access to UDP/TCP sockets, meaning that you will need to run a gateway on your machine. See e.g. what dat-fox [1] does.

[0]: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/ma...

[1]: https://github.com/sammacbeth/dat-fox

mook8 tahun yang lalu

> You couldn't, until Firefox 59. Before that, protocol handlers were not allowed to handle links to Dat/IPFS resources [0].

You could, kind of, before Firefox 57 (or at least, at some point). Implementing nsIProtocolHandler/nsIChannel/etc. correctly was difficult (and probably not from JavaScript), and distribution problems meant nobody did it.

classichasclass8 tahun yang lalu

No, not nobody. OverbiteFF was implemented in nearly exactly that fashion, and 100% JavaScript.

https://addons.mozilla.org/en-US/firefox/addon/overbiteff/

But, not possible anymore (without tricks).

jean-8 tahun yang lalu

True, I remember looking into that and it was all a bit of a mess.

Seipaho88 tahun yang lalu

> and has access to the network

It does not have access to TCP or UDP sockets.

ungzd8 tahun yang lalu

Opera had built-in Bittorrent (this feature is now removed, probably after Opera became rebranded version of Chromium).

gsnedders8 tahun yang lalu

Well, removed insofar as it was never reimplemented when the browser UI was rewritten from scratch, but yes.

tempodox8 tahun yang lalu

Nope, I wouldn't want to have to keep the browser open all the time just because I'm downloading a torrent.

crunchatized8 tahun yang lalu

Chrome extensions [1], and Firefox WebExtensions [2], can have background scripts that can continue running even when the browser window is closed. So in theory, with a p2p filesharing extension, you may not have to keep any browser window open or even minimized.

[1] https://developer.chrome.com/extensions/background_pages

[2] https://developer.mozilla.org/en-US/Add-ons/WebExtensions/An...

sametmax8 tahun yang lalu

So when you download something that is not a torrent, you close your browser ?

zdkl8 tahun yang lalu

Hey Sametmax, big fan of your site.

Apart from the existing ecosystem of content, are their any reasons you want BitTorrent over ipfs?

Everyone on tor AND ipfs... Now that would be something.

sametmax8 tahun yang lalu

Thanks :)

I think IFPS needs a little more field testing before being set in stone. Indeed, if you bake in something in the browsers, then those implementation will be the boundary of what is practical to do. So any innovation will then be constraint by the browsers release and good will.

IFPS is a young tech, it needs time to evolve yet.

Tor and bittorrent are now quite mature.

Lennie8 tahun yang lalu

This works today: https://webtorrent.io/

It used WebRTC which is also encrypted. So gets you some privacy.

sametmax8 tahun yang lalu

I know. Check my other comments.

It's nice, but not nearly good enough.

bogomipz8 tahun yang lalu

>"IFPS is a young tech, it needs time to evolve yet."

Could you share your concerns about IPFS in its current state or what you see as its limitations? Thanks.

kleiba8 tahun yang lalu

Honest question: is bittorrent even still a thing?

coolspot8 tahun yang lalu

If you are asking about torrents and pirate community, then yes - it is alive and well.

However it is usually through VPN, not Tor.

mirimir8 tahun yang lalu

Torrenting through Tor overloads relays, increasing latency and throttling bandwidth for other users. Also, it's unworkably slow. Just use nested VPN chains.

toxican8 tahun yang lalu

Of course it is. It didn't go away because you don't use it.

iwaffles8 tahun yang lalu

It is. For both legitimate and nefarious uses. Bigger software/game devs still use bittorrent to distribute patches and updates—World of Warcraft is an example.

d338 tahun yang lalu

It definitely still is. And with the concept of private trackers, it's not really a simple thing to turn off. Companies like IP Echelon tend to automatically bully US/cloud users, but in general they're IMHO far from killing the network. The only problem is that there's fewer and fewer torrent search engines...

sametmax8 tahun yang lalu

tameme.fr is my new fav.

sametmax8 tahun yang lalu

Last month I download 2 linux ISO with it for work. This month all the seasons of the pretender for fun.

Facebook used to deploy their code using bittorent. I doubt it has changed.

A lot of blizzard video games update using bittorent as well. If you play Starcraft 2, you use bittorent.

Streaming services like stremio are basically bittorent. After netflix, it's my main source of video content.

If you want to download the internet archive, that's the saner option. Same if you are a pentester, as a lot of heavy leak or hash db are so huge only bittorent makes it practical. Too expensive to host for one small actor. It's also more resistant to take down notice.

We talked a lot about RSS lately, and how to revive it, while in comments people said it actually never died. Bittorrent is a lot like that. Great tech, great standard, it works flawlessly and fill its use case perfectly.

The only reason it's not more adopted is because it's not in the browser by default. Otherwise the hosting benefit and the dl speed is such that it would be an instant hit.

scrollaway8 tahun yang lalu

Blizzard games no longer use BitTorrent but a proprietary http-based protocol called ngdp. BitTorrent was causing a lot of issues with firewalls so users were disabling it, so they had added http mirrors to them... And then CDNs became a thing, the rest is history.

I'll be happy to give more details on ngdp if you are curious.

sametmax8 tahun yang lalu

Please.

scrollaway8 tahun yang lalu

Here, I pulled my docs for ya:

https://gist.github.com/jleclanche/91f2f5c0f2042a81db1c61464...

They basically created their own git protocol + virtual filesystem, optimized for asset patches inside large compressed binary files. I wish they'd open source it.

exikyut8 tahun yang lalu

That was interesting to poke through.

Related discussion: https://news.ycombinator.com/item?id=13140257

Rjevski8 tahun yang lalu

If my movie library is of any indication, yes it’s definitely still a thing.

(And before you say anything, I do pay for Netflix and have video included in my Amazon Prime membership - none of which had those movies)

ComodoHacker8 tahun yang lalu

Ultimatest super-goal: make anonymity the default stance and socially accepted norm. Do with anonymous browsing what WhatsApp did with E2E encryption. Force big data suckers to invent new business models for exploiting our data without breaching our privacy.

chipperyman5738 tahun yang lalu

I can't read this article because I'm at work, but unless they managed to solve the problem of Tor being very, very, very slow, this will never happen. End users will definitely notice a difference and likely won't care about their privacy. They'll just see Firefox being way slower than Chrome and switch.

mirimir8 tahun yang lalu

This would be a privacy option for Firefox, not the default. But yes, Tor introduces latency and reduces bandwidth. For traffic to the open Internet, traffic uses circuits through three relays: entry guard, middle and exit. So there are four hops between users and websites, instead of one. The Earth's circumference is about 40 thousand km. So the longest path is arguably ~20 thousand km. And rtt for that would be about 300-500 msec, according to my measurements.[0] It's only ~130 msec at lightspeed, but there are some copper links, plus switching time and caching.

So with four hops, rtt would at most be 1200-2000 msec, if every hop were the maximum length. In practice, rtt for Tor is at most half that, and often even less. But latency is actually good if your goal is anonymity. Because it reduces the accuracy of traffic analysis.

With traditional onion sites, there are two three-relay circuits, one for the user and one for the site, plus a rendezvous relay. So rtt is much greater. However, sites can opt for one-relay circuits, sacrificing anonymity, so overall rtt isn't that bad.

Bandwidth is also reduced with Tor. Increased latency is part of that. But also, many relays have low-bandwidth uplinks, especially ones that people run at home. The Tor client does pick faster relays, but there's a tradeoff, in that doing so reduces anonymity. Increased investment in high-bandwidth relays would help a lot.

Also, with more relays, it would be workable to implement multipath circuits. Especially for onion sites, where precious exit relays aren't needed. Using MPTCP, I managed ~50 Mbps throughput for bbcp transfers between onion sites (with gigabit uplinks).[1] I was getting ~36 subflows per tcp connection.

0) https://www.ivpn.net/privacy-guides/how-to-verify-physical-l...

1) https://ipfs.io/ipfs/QmUDV2KHrAgs84oUc7z9zQmZ3whx1NB6YDPv8ZR...

ngold8 tahun yang lalu

So basically satellite Internet speeds. That is pretty good.

Sir_Cmpwn8 tahun yang lalu

Tor is not that slow these days. Sometimes you get a bad circuit but you can reroute and expect speeds comparable to mobile phone networks.

aseipp8 tahun yang lalu

Is it even worth talking about speed without at least considering client network conditions? A lot of people have poor internet connections, many places world-over are basically mobile-internet only already, shared internet spaces with variable QoS (campuses), etc etc. Most people aren't using engineer-priced laptops/workstations or backed by enterprise-grade routing equipment, after all.

Sir_Cmpwn8 tahun yang lalu

If I understand Tor correctly, last mile connectivity is not a bottleneck.

[deleted]8 tahun yang lalu

ryanisnan8 tahun yang lalu

You are correct. Tor's speed has nothing to do with your local rig or network. Unless you're on an abacus.

dbolgheroni8 tahun yang lalu

Yes it is. I can't speak for everyone, but in Brazil, it's virtually impossible to use Tor even for HTML-only websites. And I can say most people have a slower bandwidth than I.

astrodust8 tahun yang lalu

So long as Tor depends on volunteers to maintain exit nodes, and with that the risk of being arrested for all sorts of criminal activity by non-tech-savvy law enforcement, this is how it'll be.

openasocket8 tahun yang lalu

Tor is slow because every packet has to be routed through several random servers distributed all over the world with multiple layers of crypto at every pass. Even with plenty of top-of-the-line inner and exit nodes you will still see substantially more latency than just sending packets directly.

astrodust8 tahun yang lalu

That wouldn't be as big an issue if all the nodes were very well connected, like positioned near big peering points, but they're not.

seandougall8 tahun yang lalu

The "distributed all over the world" part would still be just as much of an issue; the speed of light puts a substantial lower bound on the total latency.

astrodust8 tahun yang lalu

True, but pinging from one hub to another is way faster than someone's cable modem in Mumbai to someone's in Australia to someone's in Peru and back again. Those last miles add up in a huge way.

pathseeker8 tahun yang lalu

No, IPSec tunnels to remote headquarters have indistinguishable latency impacts for normal users browsing (<150ms). The bad latency is because of congestion, not crypto and multiple hops.

mirimir8 tahun yang lalu

Mirimir typically uses a three-VPN nested chain. Just now, rtt to google.com was ~260 msec. That's four hops. Just not with servers on the far side of the planet.

Exuma8 tahun yang lalu

What do you mean by this: "with that the risk of being arrested for all sorts of criminal activity by non-tech-savvy law enforcement"

You can be arrested for things just by using Tor if they mix you up with someone else or something?

kbrackbill8 tahun yang lalu

You can be arrested for running an exit node, because other Tor users' traffic will appear to be coming from you.

For example: https://www.deepdotweb.com/2017/05/01/russian-tor-exit-node-... https://www.zdnet.com/article/dan-egerstads-tor-exit-nodes-g... https://www.pcworld.com/article/2452320/tor-exit-node-operat...

jerheinze8 tahun yang lalu

All of them from people running their exit from home, which has always been warned against.

Exuma8 tahun yang lalu

Where is the recommended place to run one?

jerheinze8 tahun yang lalu

https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISP...

(Also check the new relay guide: https://trac.torproject.org/projects/tor/wiki/TorRelayGuide)

mirimir8 tahun yang lalu

Also get on the [email protected] mail list.

But the sad truth is that there aren't that many hosting providers that allow Tor relays. Especially exit relays, because of abuse complaints.

Also, as you might expect, Tor relays can use lots of bandwidth. It's more common to get flat-rate bandwidth for 100 Mbps uplinks, and metered bandwidth for 1 Gbps uplinks. Digital Ocean, for example, just switched to metered bandwidth, and that has killed some relays.

However, all this could arguably change, if Tor became mainstream, as part of Firefox.

benevol8 tahun yang lalu

Just use some cheap VPN service in front of your Tor/Firefox browser (which most people should do in any case) and you're good to go.

jerheinze8 tahun yang lalu

That has no relation to the cases above which were of people running Tor exit nodes from their home. If one wants to hide their Tor usage then that's something else and there are pluggable transports that are already built-in the Tor Browser to obfuscate Tor traffic to look like something else--no need for a VPN.

Yoric8 tahun yang lalu

How does this affect exit nodes?

benevol8 tahun yang lalu

If you're worried that law enforcement will knock on your door because somebody used your exit node for illegal internet activity, a VPN service (that does not log traffic) will give you additional protection by exposing their IP address, not yours.

tscs378 tahun yang lalu

A lot of VPN services forbid running exit nodes in their ToS as it tends to trash IP reputation...

jabn768 tahun yang lalu

Looks like a cheap escape from jail card.

Run an exit node and then do something illegal. Then blame it on someone else.

drexlspivey8 tahun yang lalu

Did you miss the part where exit node operators are getting arrested?

jabn768 tahun yang lalu

They sometimes are. Not always. And they walk out free, except for that Jewish guy who lived in Austria (I can’t remember his name but he was the only one to get in real trouble for running an exit node).

jerheinze8 tahun yang lalu

Why take that trouble when they can do it directly using Tor without running any exit at home? Also for instance Bogatov had an alibi when that happened.

jabn768 tahun yang lalu

Most forums ban all Tor exits.

philipkglass8 tahun yang lalu

The forum I run only bans IP addresses caught posting link-spam. Which, admittedly, asymptotically approached 100% of Tor exit nodes before I instituted more rapid ban-expiration. I added faster ban-expiration after hearing from some of my privacy-conscious users that Tor had become unusable for my forum.

jerheinze8 tahun yang lalu

> Most forums ban all Tor exits.

So running an exit at home to coverup for posting on a forum that bans all Tor exits, that makes no sense.

mirimir8 tahun yang lalu

HN doesn't :)

nodja8 tahun yang lalu

If you use tor and only visit onion sites, the sites don't know who visited them.

If you use tor and visit the regular web sites (like, say, HN), the last computer that does the actual request to the website is an exit node, as far as that site is concerned, the exit node made the http request. If you run an exit node, your computer is going to be doing tons of requests to all kinds of websites, this may include sites that deal in illegal stuff like drugs, child prostitution, human trafficking, terrorism, etc.

edit: Forgot to say, you must explicit be running an exit node. Not every tor node is an exit node.

ComodoHacker8 tahun yang lalu

Depending on jurisdiction — yes.

https://www.eff.org/deeplinks/2017/04/access-now-and-eff-con...

Lennie8 tahun yang lalu

I think Tor will get faster, now new protocols like TLS/1.3, HTTP/2 and QUIC are being developed.

Currently Tor looks like HTTPS done with TLS/1.2 on TCP (like regular HTTPS). As these newer protocols get more and more delpoyed Tor can start using them too which will help make Tor faster.

dimator8 tahun yang lalu

Those standards have nothing to do with Tor's speed.

AlyssaRowan8 tahun yang lalu

Not immediately, but I feel that as those protocols become more ubiquitous, _maybe_ the base Tor transport protocol (for nodes which aren't bridges) might be able to benefit from some of the same upgrades by using them?

I don't know how much (if at all) it might help—but other, similar overlay networks have previously noticed that (intuitively) inefficiency in the transport protocol is likely to be (broadly speaking) multiplied by the number of hops; so any improvements in that might be useful in improving the user experience by using the same available resources more efficiently.

What that might mean for Tor's perceived speed is a somewhat murky issue, as that's a function of the complex interaction of latency and bandwidth and crypto and routing overhead of all the involved nodes in a tunnel put together; which of course is also shared with other tunnels; not to mention it will _also_ be particularly affected by exit node outproxy bandwidth; _and_ any possible packet loss and delay caused by both incidental _and_ deliberate adverse network conditions…

Hello718 tahun yang lalu

There are in fact some vague ideas floating around about using QUIC as a transport protocol for Tor. However, there is so much work to do and so few people that have the necessary skills (solid cryptography -- not at a "build the next AES" level, but "implement AES with no side channels" is already incredibly difficult -- plus low-level networking, C, and so on...) that in my view it is a minimum of 2-3 years from being mainstream available (look at how long HSv3 took).

Ajedi328 tahun yang lalu

Tor circuits tend to be rather high latency, so anything that reduces the number of round trips needed for page loads is likely to have a significant impact on Tor's effective speed.

jerheinze8 tahun yang lalu

Well HTTP/2 is disabled in the Tor Browser (for now), and it has a positive impact on speed, so they do matter: https://bugs.torproject.org/14952

cup-of-tea8 tahun yang lalu

> what WhatsApp did with E2E encryption

Convince everyone that using a closed source, proprietary app is good security?

jacekm8 tahun yang lalu

WhatsApp is not perfect and certainly its code not being available for inspection is one of its flaws. However, it did bring security to the masses. I mean I am pretty sure the security it offers is enough for 95% of people. I would not use it for sending documents stolen from NSA, but for the rest of cases - it gets you covered. Security very often need to be balanced with convenience - with WhatsApp you get immense boost of protection without sacrificing much convenience. One could argue, that you could get better security with Signal - true, but first you'd need to convince all your family and friends to install it.

tinus_hn8 tahun yang lalu

You also get encryption while your traffic looks just the same as everybody else’s. You don’t stand out like when you’re using Tor.

jerheinze8 tahun yang lalu

> You also get encryption while your traffic looks just the same as everybody else’s. You don’t stand out like when you’re using Tor.

Detecting WhatsApp usage is trivial. With Tor you can use pluggable transports to obfuscate your traffic.

adrusi8 tahun yang lalu

But everyone and their cousin is a WhatsApp user, so using Whatsapp isn't suspicious.

jerheinze8 tahun yang lalu

So the solution is to grow Tor usage, or use bridges with pluggable transports.

vntok8 tahun yang lalu

No, using Whatsapp is a more efficient solution.

petra8 tahun yang lalu

They need to solve the issue of speed, altough maybe for sensitive queries(assuming that's enough, a very big assumption,), people may be willing to use a slow "super private browsing mode". another option is to make people pay for faster speeds ?

And if i recall correctly, a "global passive attacker" listening to internet traffic around can de-anonimize TOR using ML. Seems like something that would be possible and profitable for a Google and internet infra companies.

jerheinze8 tahun yang lalu

Google isn't a GPA. Also having a low-latency anonymity system that isn't affected by a GPA is an open problem. The important thing here is that using Tor is better than not.

ComodoHacker8 tahun yang lalu

>another option is to make people pay for faster speeds

This is what Telegram is trying to acheive with their TON and Gram.

Spooky238 tahun yang lalu

Likely actual result: Firefox will become increasingly irrelevant.

If Tor is going to be a built-in feature of Firefox, most employers are going to flag it as malware. This is a ridiculously dumb thing on so many levels -- promote privacy by directing your network traffic to "volunteer" proxy services?

m-p-38 tahun yang lalu

Most businesses deploy Firefox ESR, so I wouldn't be surprised if they omit the Tor capabilities in that version.

sp3328 tahun yang lalu

You already don't know what proxies your traffic is going through. Using Tor might increase the odds of a bad actor a bit but end-to-end security is something the web is getting better at right now.

Spooky238 tahun yang lalu

The risk now is that some bad actor is replacing TLS certificates, which is an uncommon and tamper-evident event. Tor is handing your traffic to an unknown 3rd party.

Plus, users do not understand what Tor is or how to use it.

Fighting political battles with software is dumb — the end result is going to be a permanent loss of freedom, as governments force the use of platforms with trusted app stores.

sp3328 tahun yang lalu

The risk now is BGP hijacking. Or really just normal operation of BGP. You data could go anywhere on the planet on its way to the destination and you're not going to know ahead of time what path any particular packet will take.

If you're using TLS, it doesn't matter so much if the exit node is malicious because they still won't be able to read it.

Spooky238 tahun yang lalu

How about my compromised browser exfiltrating information to an onion address?

Obviously I’m being downvoted into oblivion, but I truly feel this is a solution looking for a problem.

unimpressive8 tahun yang lalu

It's been my understanding that Firefox has been soft splitting its consumer and business versions of the product for a while. This would presumably just be another step down that road.

trumped8 tahun yang lalu

Why would they do that? employers could still spy on you before the data gets on the tor network...

JohnTHaller8 tahun yang lalu

Is it a fork? I thought it was a heavily customized version of Firefox ESR with specific settings and defaults using the channels OEM configs. Looking at the binaries, it's definitely not the standard build anymore.

crunchatized8 tahun yang lalu

OEM configs have never been enough to implement everything they need in Tor Browser. They eventually started their uplift effort [1], to upstream all the patches and features they've added to it, so that they can possibly just use OEM configs.

Project Fusion is a superset of that effort.

[1] https://wiki.mozilla.org/Security/Tor_Uplift

hollerith8 tahun yang lalu

Could someone please explain what "OEM configs" means here?

crunchatized8 tahun yang lalu

Looking it up, I think the more accurate term is actually "partner repacks." [1] They're versions of Firefox shipped with different default settings and/or an extension included by default at install time, IIUC. Though reading this rather opaque page [2] it doesn't seem to explicitly preclude patches to the compiled code, though it seems like they would forbid that.

The key config file is distribution.ini. [3]

[1] https://hg.mozilla.org/build/partner-repacks/file

[2] https://www.mozilla.org/en-US/about/partnerships/distributio...

[3] https://brashear.me/blog/2017/12/07/how-to-deploy-firefox-wi...

gsnedders8 tahun yang lalu

I haven't looked into it in a while, but last I knew you had to have MoFo sign-off on a bunch of stuff, including code changes (i.e., you're only allowed to use the Firefox branding if you get MoFo sign-off on those changes; you can always redistribute it without the trademarks).

JohnTHaller8 tahun yang lalu

That's correct. At least it was the last time I chatted with the Mozilla folks about it and from a quick read of their current trademark policy.

jerheinze8 tahun yang lalu

It's a fork based on Firefox ESR, see for the details: https://www.torproject.org/projects/torbrowser/design/

kibwen8 tahun yang lalu

Ultimate goal of the Tor project, that is. Lots of people in this comment thread seem to have not clicked the link and are presuming that this is a Firefox roadmap. The Mozilla analogue of this page only mentions bringing Tor features into Firefox, without stating a goal of obviating the Tor Browser entirely.

crunchatized8 tahun yang lalu

Well, Mozilla engineers wouldn't be the ones in charge of, or benefiting from, shutting down the Tor Browser fork, would they? So why would they need to include that kind of (incredibly distant, virtually pie in the sky) goal on their wiki page?

forapurpose8 tahun yang lalu

What will Mozilla do about the Tor network's usability problems? Advanced users can workaround them and because they understand the benefits and engineering, accept the frustrations as a cost for a worthwhile (and free) technology. But what will non-technical users do?

Many public Internet websites filter connections from the Tor network, many other websites are very slow, yet others impose extra obstacles such as multiple rounds of captchas (even 5 or more) or degraded service (including high suspicion of payments), and of course you often will receive webpages in the wrong locale or language - which can trigger regional filters. Currently, workarounds requires resetting the circuit (few non-technical users will even understand what the circuit is), lots of patience and reloads, and often just giving up. [EDIT: And non-technical users won't understand what is happening and therefore won't know when to use which workaround.]

If that's the experience of typical Firefox users, they won't use it and they will have bad associations with Tor and Firefox.

cup-of-tea8 tahun yang lalu

Why would Mozilla do anything about that? It's not like this is going to be enabled by default in Firefox.

Hello718 tahun yang lalu

FTFA: Whether there will be two private browsing modes is to be determined.

Hello718 tahun yang lalu

Which sites in 2018 still present multiple CAPTCHAs to users with cookies and JavaScript enabled?

I think the theory behind this project is that those problems are primarily caused by Tor's popular image as a 'fringe network for pedophiles and drug dealers' and that by making it more mainstream they can fix those issues.

(please more replies saying "that sounds really hard" and less replies saying "tor is not a fringe network for pedophiles and drug dealers", thanks)

paulie_a8 tahun yang lalu

Google. Which uses a really shitty custom captcha for their services.

jerheinze8 tahun yang lalu

Google has always been showing captchas when using their search engine for quiet a long time (even for VPN users). In fact they were even straight blocking users from using that very same captcha: https://bugs.torproject.org/23840

paulie_a8 tahun yang lalu

I more meant that Google offers a captcha service for others that is quite good, them implemented a really terrible one for the internal services. It truly is awful to deal with. Whoever made it must have been smoking crack or taking large quantities of lsd

jerheinze8 tahun yang lalu

> I more meant that Google offers a captcha service for others that is quite good, them implemented a really terrible one for the internal services.

They're identical now, I rarely got the awful one that you're talking about when searching on Google.

darpa_escapee8 tahun yang lalu

Cloudflare.

Hello718 tahun yang lalu

Source? Cloudflare did post a moderately hostile response to Tor a few years back, but their technical implementation is sound and does not present multiple CAPTCHAs to users who have cookies enabled (the CAPTCHA might be broken with JS off, but that's a Google problem).

actuator8 tahun yang lalu

Even I have seen CF captchas on multiple sites when using Tor. Though might be because of my usage pattern where I use Tor for a selective list of sites giving CF less chance to maintain my identity.

jerheinze8 tahun yang lalu

It's OK now, they no longer show a captcha on most websites behind Cloudflare.

blauditore8 tahun yang lalu

I thought this will be disabled by default, no? If so, casual users would never get in touch with it in the first place.

kibwen8 tahun yang lalu

There are many things in the Tor Browser that benefit privacy that are separate from the use of the Tor network, and it's these things that Firefox is most likely to adopt.

superkuh8 tahun yang lalu

They aren't Tor network usability problems. They're clear web network usability problems. It'd be great if more people used Tor, NoScript (yes, I know this will not be baked in), and other privacy protecting mechanisms so that clear web sites would care about the users they're intentionally making the experience worse for.

freehunter8 tahun yang lalu

A huge number of people use adblockers, and websites haven't changed to make the experience better. All they've done is changed to block anyone using adblockers, which is what many sites/networks already do to Tor.

cpeterso8 tahun yang lalu

Mozilla used to run some Tor exit nodes. I don't know if that is still the case.

https://www.pcworld.com/article/2877592/mozilla-puts-old-har... (2015)

sp3328 tahun yang lalu

The page isn't loading for me. https://web.archive.org/web/20180601141754/https://trac.torp...

(https://archive.org/donate)

maerF0x08 tahun yang lalu

it worked after a few tries for me. I believe its just serverload, keep trying or try later

sp3328 tahun yang lalu

I'm sure it is just overloaded. But there's no point kicking it when it's down. Use a mirror for now.

MayeulC8 tahun yang lalu

Great news !

With wider adoption of ipv6 and all the good things that come with it (don't mistake me, they are great!) also comes the risk that each computer will get a uniquely identifiable IP address that will be used for fingerprinting. I've never really used Tor in the past, but this got me thinking about it.

An option could be to provide a webRTC-based node, but I am not sure how feasible that would be, after reading some comments here. Maybe for entry nodes and guard nodes instead of exit nodes? The transient nature of browser sessions could greatly enhance privacy. Of course, you would need some algorithms to deal with this very nature... But I can imagine some.

This surely lowers the barrier to entry for greatly enhanced privacy. Quite a lot of people seem to be aware of the private browsing mode, and I can imagine this being turned into a simple toggle on the private browsing home page, along with a short explanation (and a link to additional privacy tips).

A low hanging fruit that could enhance the privacy a bit would be to use the trusted recursive resolver (DNS over https) in private browsing by default, since it already is part of Firefox. It just needs a default trusted resolver.

tomrittervg8 tahun yang lalu

> An option could be to provide a webRTC-based node, but I am not sure how feasible that would be, after reading some comments here.

I'll point you at FlashProxy (https://crypto.stanford.edu/flashproxy/) and Snowflake (https://github.com/keroserene/snowflake) the latter of which is in active development. =)

jerheinze8 tahun yang lalu

https://trac.torproject.org/projects/tor/wiki/doc/Snowflake

kodablah8 tahun yang lalu

Cool, now let me start an ephemeral v3 onion service from JS and have it reachable via WebRTC by a peer who has their own. It's the perfect tech marriage, removes signalling servers and NAT busters, but may be a bit taxing on directory servers and too slow to use for media streams (but I'll take data channels only).

floatboth8 tahun yang lalu

Hah, kinda reminds me of Opera Unite. (That one wasn't from JS, it offered some fixed applications like file hosting, notes, etc., but it was hosting stuff from the browser)

gsnedders8 tahun yang lalu

Unite allowed server-side JavaScript (though I forget how many privileged APIs there were), but I don't think you could support custom protocols.

Hello718 tahun yang lalu

sounds really useful, but to be fair, it doesn't really remove either. you're effectively just using the Tor network as freely available (but slow) signalling and TURN servers.

kodablah8 tahun yang lalu

Exactly. Doesn't require any server side work and you get built in anonymity across peers and for discovery.

SlowRobotAhead8 tahun yang lalu

I know some of those words. (I'm an embedded programmer)

urda8 tahun yang lalu

Mozilla keeps driving for the users on the internet. I know many of my own frustrations came from the fork that is Tor. This work is great to see.

jerheinze8 tahun yang lalu

> I know many of my own frustrations came from the fork that is Tor.

What are your frustrations with the Tor Browser?

tgragnato8 tahun yang lalu

There is a gap between the safer and safest security level: sometimes I want to display icons and symbols but don't want js to run.

Installing additional extensions is discouraged; but in my experience Decentraleyes makes latency somewhat less disturbing, CAPTCHAs appear less often; and uBlock Origin is essential [-].

[-] shipping with every available filter list enabled and cached may be a good enough default

jerheinze8 tahun yang lalu

> Installing additional extensions is discouraged; but in my experience Decentraleyes makes latency somewhat less disturbing, CAPTCHAs appear less often; and uBlock Origin is essential [-]. > > [-] shipping with every available filter list enabled and cached may be a good enough default

See https://bugs.torproject.org/22089 and https://bugs.torproject.org/17569

_bxg18 tahun yang lalu

This would be amazing. The main reason I've never used Tor is the fear that it would make me look like I had something to hide (instead of just a general desire for privacy). If it were built into Firefox, I'd probably switch over from Chrome.

jerheinze8 tahun yang lalu

> The main reason I've never used Tor is the fear that it would make me look like I had something to hide (instead of just a general desire for privacy).

1. You can hide the fact that you're using Tor by using pluggable transports which are already built-in the Tor Browser (such as meek-azure, obfs4, snowflake, ...).

2. That's the biggest reason as to why one must use Tor as much as possible even if they don't care about privacy. More people using Tor = the less interesting it is to be a Tor user.

lucb1e8 tahun yang lalu

> it would make me look like I had something to hide

That's exactly why I use it on a regular basis!

Perhaps when looking up political or medical things (also for friends), it could be good to run that through Tor. That is not something to hide per se, but it is definitely not something that is anyone else's business, and you don't want to be bubbled.

ccnafr8 tahun yang lalu

Wasn't this launched in 2014? I see the wiki hasn't been updated since January. Is this a new push to get this done?

Vinnl8 tahun yang lalu

If I understand it correctly, you shouldn't be using any website accounts using Tor browser that you also use outside of it. I really wonder if/how they can make the user properly aware of that in a kind-of super private browsing mode.

Hello718 tahun yang lalu

you can, and it is still a valuable contribution to the Tor network, since it adds cover traffic. the catch is just that the website you're using will know who you are. I hope that the vast majority of users will understand that if they log in, there is no privacy mode that will save them from the site they log into.

Vinnl8 tahun yang lalu

Right, I guess that's good if you want to contribute to the Tor ecosystem, but if you want to browse anonymously, that's no good. Unfortunately, even as a somewhat tech savvy (though in hindsight obviously naive) person, the repercussions of logging in somewhere in Tor Browser weren't immediately clear to me.

kodablah8 tahun yang lalu

"Multi-Account Containers"

Vinnl8 tahun yang lalu

I'm not quite sure what you mean by this comment, but if you mean that their approach would be similar to MAC, in the sense that "super private browsing" would have to be enabled in about:config or through an extension: that would make sense.

kodablah8 tahun yang lalu

This: https://support.mozilla.org/en-US/kb/containers

Vinnl8 tahun yang lalu

I know the extension, but what does that have to do with informing users about not using their account when browsing with Tor? Heck, informing users about being able to use different accounts with Multi-Account Containers was already such a hard problem that they opted into shipping it as a separate extension, so it's only used by power users.

kodablah8 tahun yang lalu

How I'd do it is have a warning when using Tor outside of the designated Tor container. That is, encourage the installation of the extension when enabling a "Tor" tab (permanently dismissable of course). Alternatively they could co-opt the private-browsing window (a.k.a. incognito) feature to have a tor-browsing window.

The latter might even be preferred since the former is only at the tab level and probably quite easy to forget whether you are in Tor before entering an address. It appears to be what is suggested in the notes (now that the link is up).

wpdev_638 tahun yang lalu

Have you considered also implementing I2P[0] in parallel with tor? It suppose to be harder to analyze traffic at nodes with I2p though it isn't as battletested as tor.

[0]:https://geti2p.net/en/comparison/tor

jerheinze8 tahun yang lalu

I2P is more concerned with inward traffic rather than clearnet 'exit' traffic which is the main thing that Mozilla wants in a super private mode.

openfuture8 tahun yang lalu

Okay but what about maidsafe, dat, ipfs etc. The correct solution is to have firefox expose a 'protocol api' or something along those lines so that any 'alternate internet' project can create a backend extension to make firefox compatible with that protocol.

jean-8 tahun yang lalu

Seems like some people are working precisely on that.

See for instance:

https://blog.mozilla.org/addons/2018/01/26/extensions-firefo... (CTRL-F Decentralization)

https://github.com/mozilla/libdweb

mtgx8 tahun yang lalu

That's amazing to see. Thanks for sharing.

This is exactly the kind of tech Mozilla should be supporting - tech that gives users more freedom on the internet.

devit8 tahun yang lalu

I think Mozilla should look at using Servo instead of Gecko in this mode along with a new JavaScript interpreter written in Rust, at least optionally, since perfect security is essential when using a Tor browser without a dedicated VM.

kibwen8 tahun yang lalu

Servo components are being uplifted into Gecko gradually. There's less benefit to rewriting the JIT in Rust because static type systems can only do so much when the whole goal of a program is to generate code dynamically.

devit8 tahun yang lalu

My suggestion was to have Firefox support both Gecko (with uplifted component) and a pure Rust renderer, with the latter to be used in the Tor mode where security (to preserve anonymity against resourceful adversaries) matters over compatibility.

For security, instead of a JIT, a simple JavaScript bytecode interpreter written in Rust to be used exclusively in the Tor mode would be ideal, for maximum security at the cost of worse performance.

Another option is a JIT that generates code that is easily proven to be safe (e.g. because it does a bounds check on all memory accesses and only does indirect jumps using a jump table, or because it's the only thing running in a process and jumps are still constrained with a read only jump table and read only code).

Yoric8 tahun yang lalu

Well, there is the ability to write something along the lines of https://github.com/nbp/holyjit :)

Endy8 tahun yang lalu

So we lose another valuable project of the Web. I wonder why I feel so lost - that when I was young, the Internet was barely born... and now I'm watching it die.

jerheinze8 tahun yang lalu

What's going to be lost?

Endy8 tahun yang lalu

Tor Browser. A single privacy-dedicated browser package; even if it is now being built on Chromefox.

trumped8 tahun yang lalu

I agree and I don't really like how the internet is evolving either but this sounds like one of the good changes, unless I'm missing something

mtgx8 tahun yang lalu

I've been waiting for this for years. Good job convincing Mozilla to do this! Good idea to standardize the spec, too.

I hope they give a good name to this new super-private mode (which actually isn't too bad of a name, either).

I also hope they don't just implement a "more private" mode in Firefox, but also a more hardened mode for Tor. The Tor mode in Firefox should use the strictest possible sandboxing technologies available to them from the operating system (file system virtualization, etc).

I'm even talking about those new fancy hypervisor-based micro-VMs in Windows 10, which I believe they are called Krypton containers, and it's what Edge uses within the Application Guard context. Although if the users have to enable Hyper-V/Micro-VMs first in Windows, then maybe this hardening mechanism should be optional, but encouraged. Otherwise, it should probably be the default.

https://www.zdnet.com/article/how-containers-will-transform-...

Oh, and this hardened mode should use a different process for every tab/extension, too, by default, just like Chrome does. I still don't think Mozilla's "hybrid" approach makes it as secure as Chrome (which is why it's a hybrid/compromise for lower memory usage).

fwdpropaganda8 tahun yang lalu

> How many more "super private browsing mode" Firefox users will there be? Potentially hundreds of millions of daily users.

Tor has hundreds of millions of daily users?

Buge8 tahun yang lalu

That quote doesn't say currently hundreds of millions of daily tor users. That quote says that in the future, when firefox includes tor by default, there might become hundreds of millions of daily tor users.

jerheinze8 tahun yang lalu

https://metrics.torproject.org/userstats-relay-country.html

xur178 tahun yang lalu

Does anyone know what caused the big spike in users at the end of last year?

jerheinze8 tahun yang lalu

Most likely a botnet.

vntok8 tahun yang lalu

Of course not.

bunkydoo8 tahun yang lalu

I believe Tor browser is already just a version of Firefox if I'm not mistaken. What would be the advantage of integrating with Firefox as opposed to say, a VPN integrated into the browser via a plugin. Just seems a little redundant and Tor is beginning to seem dated also with new solutions popping up and making the pitfalls of Tor more apparent.

Vinnl8 tahun yang lalu

I think an important part is to lessen the maintenance burden for the Tor project: if the code is in Firefox proper, Firefox developers will encounter it when working on other features and make sure they work together, whereas currently the Tor project needs to rebase their modifications onto "regular" Firefox.

ubershmekel8 tahun yang lalu

I imagine the idea is to have an incognito mode that actually is incognito, and free.

ec1096858 tahun yang lalu

The vpn owner knows all traffic flowing through it.

neokantian8 tahun yang lalu

"Removing fingerprintability" amounts to the browser just NOT sending all the http request headers that it sends by default. How hard can it be to "comment out" these lines?

bzbarsky8 tahun yang lalu

I just checked and there are over 100 checks for "should I have different behavior here if I am resisting fingerprinting?" just in the C++ code in Firefox today. There are some more in the JS code but they're harder to search for.

Some simple examples:

* Various navigator APIs (oscpu, platform, etc) need to be disabled.

* Gamepad API needs to be disabled.

* Have to prevent reading canvas pixel data

* Have to block information about avaiable OpenGL extensions from WebGL

* Modifier keys on keyboard events need to be spoofed (because they can be used to guess at keyboard layout)

* Errors from the media stack (for <video> and <audio>) need to be blanked out.

* Something to do with voice synthesis APIs; I didn't look into details.

* Connection API needs to be neutered

* Various timing APIs hanging off "performance" need to be neutered.

* Presentation API needs to be neutered.

* Number of CPUs reported by the navigator API needs to be spoofed.

* Window sizing for window.open needs to be spoofed.

* Ability to measure the difference between the window.inner* and window.outer* APIs needs to be disabled.

* Mouse positions in mouse events need to be spoofed to make it look like the window is fullscreened.

* Touch event positions need to be spoofed.

* Geolocation needs to be disabled.

And so on, and so forth.

gsnedders8 tahun yang lalu

Need to do something about fonts and the CSSOM (Element.getBoundingClientRect() for example), too.

Just shipping a standard bundled set of fonts and only allowing use of that doesn't suffice because anti-aliasing width differences could give away the used font renderer.

zaphar8 tahun yang lalu

I don't think this is true. Especially in the case of things like canvas fingerprinting.

mortdeus8 tahun yang lalu

I am starting to feel firefox in a serious way. But im just sooo concerned that their software still sucks. I mean, we ARE talking about a company who thought it was smart to spend time trying to build a javascript OS for mobile.

So let me ask again. When are you guys going to start building firefox from the ground up and make the perfect browser we all deserve?

And if you disagree, please. Present your arguments. I am the person you need to sell right now.

Sylos8 tahun yang lalu

They've started on it, it's called Servo.

But webstandards are evolving faster than modern browsers are, so building a browser from the ground up would require quite a bit more money, and worse know-how - you can't just buy that in unlimited amounts, than they have for Firefox right now, and they can't exactly stop developing Firefox in the meantime either.

Also, their three big competitors have most of their browser market share thanks to building an operating system underneath it. No matter how slim Mozilla's chances at success were, it would've been foolish to not try to get into the operating system market. And they built it based on web technologies, because that's where they have know-how.

firefoxd8 tahun yang lalu

Building the perfect browser from the ground up?

Do you remember netscape?

fredley8 tahun yang lalu

Why does the Tor Browser Bundle ship with HTTPS Everywhere? Surely if you're connected through a Tor circuit, HTTPS provides no extra security?

StavrosK8 tahun yang lalu

This is the biggest misconception about Tor. Tor provides anonymity, but any node (EDIT: any exit node) can read what you're sending if it's not encrypted. You need both.

crankylinuxuser8 tahun yang lalu

That's definitely not true if your endpoint you're talking to is an *.onion . A connection to an Onion is encrypted to the destination. That also means if you were running, say NodeRed with authentication, sending credentials "over the clear" (no SSL cert, because stupidity) it's not actually sent over the clear. It's encrypted to the public key relating to your onion address.

Now, if you're using Public Internet->Tor->Public Internet, then absolutely yes the last node CAN read the contents of your packets. In that case, you absolutely need appropriate encryption to hide the contents (sigh, not the metadata) of your packets.

LinuxBender8 tahun yang lalu

I would still prefer https on a .onion. If tor itself is popped, then traffic can be routed or mirrored to another host. This has happened in a PoC and was fixed in a security update in one of the alpha releases. There are additional fixes required for HS that are coming.

If the target is using https, you can see if the signature changes (there are addons for this).

Digicert will sign .onion domains, though the hidden site must be willing to share their identity with Digicert. I would love to see LetsEncrypt sign .onion domains, assuming they are willing to connect back to a .onion to validate the server.

detaro8 tahun yang lalu

The CA/B Forum rules only allow EV certificates for .onion, so even if Let's Encrypt wanted they couldn't give out .onion certificates without getting that changed first.

LinuxBender8 tahun yang lalu

Oh right, that is a good point. I suppose Digicert is the only option for now then.

Perhaps the Tor team or an affiliate could set up a simplified CA and have a public CA cert restricted to .onion that folks could install as a work around to having browsers trust it by default.

schoen8 tahun yang lalu

I'm trying to get that rule changed and working with several other organizations on this.

detaro8 tahun yang lalu

Are there public discussions somewhere yet? I always find it interesting to peek into these processes.

schoen8 tahun yang lalu

We talked about it in this thread in November.

https://cabforum.org/pipermail/public/2017-November/thread.h...

Since then Fotis Loukos and I have drafted a ballot, which I believe he plans to introduce soon after asking a few other organizations to look it over.

You can subscribe to the cabfpub mailing list without becoming an Interested Party or Member. Only Interested Parties or Members can post to the list, while only Members can introduce or vote on ballots.

(Edit: Strangely, the reason for this is seemingly not that they're worried that the general public will make crazy suggestions, but rather that the general public will make patented suggestions, without being willing to license them according to the Forum's patent policy, and thereby sneak patented technology into the standards.)

crankylinuxuser8 tahun yang lalu

Indeed, I too would love to have SSL certs for .onions and not have to bend over with an Extended Payment... Err, Verification check.

I thought about setting up boulder on tor, and start rolling it myself. But then again who'd trust me? This should be part of the Tor organization. I can't see my own system getting inertia, or put into TBB, or Firefox for that matter. It was hard enough for LE to be put in trusted CAs on machines.

jerheinze8 tahun yang lalu

https://matt.traudt.xyz/posts/dont-https-your-o44SnkW2.html

LinuxBender8 tahun yang lalu

Those are interesting preferences and perspectives. I will set up a site to counter them from my perspective and experiences.

To summarize, you are a dissident. I am a news reporter. You are giving me information about your government. Your life and the lives of your family members now depend 100% on the security of the Tor Proxy transport. Tor is a proxy transport and nothing more.

As a dissident, you have been trained by me to install addons that validate the signature of my HTTPS certs will not change. I also showed you how to do this using openssl s_client. When Tor is popped and routing you to your government hosts, you will see the SSL signature change. Per my instructions, you will cease all communication with me.

Without HTTPS, you are relying entirely on the transport for assurance of who you are talking to. This is neither appropriate nor acceptable for this type of communication.

PGP is not a mitigating control, because the handshake has completed and you are now downloading your state sponsored rootkit. It's too late by that point. The only thing we have to validate ID and allow or block application traffic is a certificate.

jerheinze8 tahun yang lalu

> Without HTTPS, you are relying entirely on the transport for assurance of who you are talking to.

That's not the case, even with a SecureDrop setup, a Gov can compromise your SecureDrop machine and listen directly.

LinuxBender8 tahun yang lalu

Exactly, they have to pop my machine too. They can't just take control of the traffic in the middle, which absolutely can be done in Tor with enough gov controlled guard nodes, as the arms race of patching has proven.

I can set up multiple canaries that they will have to pop and the fingerprint of one of those canaries is going to change or drop off the net.

jerheinze8 tahun yang lalu

> They can't just take control of the traffic in the middle, which absolutely can be done in Tor with enough gov controlled guard nodes, as the arms race of patching has proven.

I think you're misunderstanding something here, with onion services traffic is e2e encrypted and self-authenticated, as Matt explains:

> When you connect to an onion service, how do you know no one is MitM'ing you? Easy. It's impossible. The bad guy would have to be in your browser (more accurately: between the browser part of Tor Browser and the Tor process it runs in the background) or between the Tor process the onion service operator is running and the webserver it's pointing at. If you assume your Tor Browser hasn't been compromised, and you assume the onion service is being run intelligently, then a MitM attack is impossible. (And if the onion service isn't being run intelligently, can you really trust its operator to do HTTPS intelligently?) > > https://matt.traudt.xyz/posts/dont-https-your-o44SnkW2.html

LinuxBender8 tahun yang lalu

I think where we are having a disconnect is that what Matt posted works when Tor is working as expected. Software has bugs. Tor has not been an exception to this. I watch their change logs for alpha and there are often bugs that affect this overall concept. They are patched quickly, but Tor nodes are not forced to update, nor is there a safe way for them to do so.

My point is that is a single point of success. Any other web service I would cut some slack. In the case of Tor, it is marketed as a means by which dissidents may communicate safely. Putting peoples lives on a single point of success is not appropriate, especially when there are technical means to mitigate the risk.

detaro8 tahun yang lalu

nitpick: exit node. The ones on the way can't, neither can any if you access hidden services.

StavrosK8 tahun yang lalu

Yes, sorry, I should have specified.

akerro8 tahun yang lalu

You -> Tor node -> Tor node -> Tor Exit node -> http/https clearnet -> NSA/GCQH/BND/you name it -> destination server

shp0ngle8 tahun yang lalu

If you connect to a clearnet website, the clearnet website is fetched by the exit node. If it's not HTTPS, the exit node can change the website however it wants.

jerheinze8 tahun yang lalu

https://www.torproject.org/docs/faq.html.en#CanExitNodesEave...

Yes, the guy running the exit node can read the bytes that come in and out there. Tor anonymizes the origin of your traffic, and it makes sure to encrypt everything inside the Tor network, but it does not magically encrypt all traffic throughout the Internet.

This is why you should always use end-to-end encryption such as SSL for sensitive Internet connections.

```

Fortunately HTTPS adoption is much better now :)

akerro8 tahun yang lalu

>Fortunately HTTPS adoption is much better now :)

It's HSTS what we need in 2018

auslander8 tahun yang lalu

HSTS can track people. Apple fixed that just few months ago. https://news.ycombinator.com/item?id=17209697

crankylinuxuser8 tahun yang lalu

I disagree.

Ive seen HSTS applied to things like Windows 10 updates, to prevent users from seeing what exactly your OS is sending to the mothership.

Ideally, we should be able to see exactly the content being exfiltrated, and choose to allow/disallow. But the moment we use tools like ettercap or mitmssl, it kills the session and we can't see the data.

HSTS seems more "self cutting" than useful at this juncture.

pfg8 tahun yang lalu

You're thinking of HPKP and other certificate and key-pinning implementations. HSTS only enforces HTTPS, it does not prevent the usage of things like mitmproxy with custom roots added to your trust store.

maerF0x08 tahun yang lalu

If its truly your OS I think you can read all the network data you want to, including the key negotiation. Albeit its not the easiest thing to do.

kchr8 tahun yang lalu

The use of HSTS is a way to suggest to your clients that they use SSL for that domain - for all requests within a time span (which could be "forever").

If anything, the vendors you mention should be applauded for taking that step towards a more secure distribution of updates. Not enforcing SSL makes malware injection through updates way way easier.

Debian introduced HTTPS repos a while back as an option, but not by default. Other distros already offer it.

seba_dos18 tahun yang lalu

Debian, and most other distributions as well, verifies its updates for ages and doesn't need SSL to do that. There are some arguments for using HTTPS anyway, but preventing malware injection isn't one (unless your package manager is exploitable).

218 tahun yang lalu

It's called defense in depth.

Otherwise go ahead and disable DEP, ASLR, and other modern defense in depth and mitigations mechanisms used by Debian, of course, unless your OS is exploitable.

stordoff8 tahun yang lalu

If you're connecting to a clearnet site, you probably need HTTPS _more_ than on a standard connection - you _explicitly_ have a node between you and the site that you don't necessarily trust (see, e.g., https://nakedsecurity.sophos.com/2015/06/25/can-you-trust-to...).

HugoDaniel8 tahun yang lalu

anonymity /= confidentiality

you can stay anonymous while making sure anyone can read what you are sending.

you can send confidential messages while making sure anyone knows who you are.

you can also combine the two :)

oconnor6638 tahun yang lalu

> you can stay anonymous while making sure anyone can read what you are sending.

That depends a lot on what you're sending. Tor stops people from identifying you based on your IP address, but you can still identify yourself by logging in on http://not-encrypted.com.

Lennie8 tahun yang lalu

Please read and play with the graphics on this page, it explains it all:

https://www.eff.org/pages/tor-and-https