<html xmlns="http://www.w3.org/1999/xhtml"><head> <title></title> <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no"> </head> <body style="font-family:Helvetica;color:#000000;font-size:13px;"><div id="CanaryBody"><div id="CanaryBody">Hi everyone,</div><div id="CanaryBody"><br></div><div id="CanaryBody">Better late than never, here's the recap from the second part of Browser vision exercise that we run at the start of March.</div><div id="CanaryBody"><br></div><div id="CanaryBody">I would like to organise the points discussed during these sessions and also on the email thread into the three areas outlined by Isabela in her email:</div><div id="CanaryBody"><br></div><div id="CanaryBody"><b>Anti Censorship / Surveillance / Tracking</b></div><div id="CanaryBody"><ul><li>Smarter bootstrapping</li><ul><li>What’s next for tor launcher?</li><li>Incorporate OONI data to help user make informed configuration decisions</li><li>Automate configuration decisions whilst keeping users safe</li></ul><li>Better tracking and fingerprinting resistance<br></li><ul><li>Letterboxing</li></ul><ul><li>Canvas-like software rendering (<i>is this the same as window dimension spoofing below?</i>)</li></ul><li>Incremental redirect protection</li></ul></div><div id="CanaryBody"><b>User Experience - some of these touch on some of the other areas too</b></div><div id="CanaryBody"><ul><li>UI polish + product cohesion</li><ul><li><i><b>Action:</b> Let’s make a list of UI “smells” </i></li></ul><li>User Journey mapping <br></li><ul><li>Warnings and notifications</li><li>New identity review</li></ul><li>Config automation<br></li><ul><li>Smarter bootstrapping (see above)</li></ul><li>Opt-in Persistence to Disk</li><ul><li>Browser History retention (aka ability to turn off Private Browsing Mode)</li><li>Encrypted bookmarks</li></ul><li>Running Tor Browser Maximised</li><ul><li>By ensuring users understand the risks and/or implications of maximising Tor Browser window -> Warnings and Notifications work</li><li>By including fingerprinting protections:</li><ul><li>Through letterboxing</li><li>Through spoofing window dimensions without letterboxing</li></ul></ul></ul></div><div id="CanaryBody"><b>New Features/Innovation</b></div><div id="CanaryBody"><ul><li>Sandboxing analysis/planning<br></li><li>Tor Browser Ephemeral sessions <i><- Antonela to explain further :) </i><br></li><li>User safety work </li><ul><li>Protect against malicious exit nodes</li><li>Block executable downloads over HTTP</li><li>Let users block HTTP connections</li><li>Don't let users bypass self-signed cert warning unless self-signed cert is independently “verified"</li><li>Detecting when bitcoin addresses are copied on an insecure page</li></ul><li>Enabling Safe Browsing</li></ul></div><div id="CanaryBody">I have added another category to take into account work that needs to be done but does not really fit into any wider project:</div><div id="CanaryBody"><br></div><div id="CanaryBody"><b>Maintenance</b></div><div id="CanaryBody"><ul><li>ESR Releases<br></li><li>Security Bug fixes<br></li><li>Switch to mingw-clang<br></li><li>Assess new fingerprinting vectors in ESR52, ESR60 (and ESR68) <br></li></ul></div><div id="CanaryBody"></div><div id="CanaryBody"></div><div id="CanaryBody"></div><div id="CanaryBody"><br></div><div id="CanaryBody">Finally, here are some "Big Picture" discussions that we might want to have during our dev-meeting:</div><div id="CanaryBody"><ul><li>Working with other organizations to ship a Tor mode/private browser mode<br></li><ul><li>Apple/Safari, Chromium, Opera</li><li>Working with product people at these organisations</li><li>Looking to help them introduce tor in the background, e.g for telemetry, updates pings, etc…</li><li>promoting change within the whole ecosystem</li><li>advocating for feature parity with Tor Browser</li></ul><li>Working with web standards bodies and/or legislators</li><ul><li>Initiate a cross-browser working group to create standards for browser privacy.<br></li></ul><li>Evangelising to web service providers</li><ul><li>how to avoid broken usability for Tor Browser users</li><li>being profitable without the need for “creepy” tracking</li></ul></ul></div><div id="CanaryBody">One thing we did not really talk about though are what are the principles we should have in mind when designing and implementing new features? Here's a few I took from our emails and discussions on this topic to get us started:</div><div id="CanaryBody"><ul><li>User first<br></li><li>Secure by default<br></li><li>Providing the best anonymity/privacy tool for users</li></ul></div><div id="CanaryBody">This is my interpretation of what has been discussed so far, so please correct me if I’ve made any incorrect statements/assumptions and add your own thoughts. If there is something I missed out, it does not mean I do not think it’s important :) there was a lot discussed and I’m sure I’ve forgotten many details. Please share them again if that’s the case!</div><div id="CanaryBody"><br></div><div id="CanaryBody">Thank you so much to everyone that participated and shared their ideas!</div><div id="CanaryBody"><br></div><div id="CanaryBody">Pili</div> </div> <div id="CanarySig"> <div> <div style="font-family:Helvetica;color:#000;font-size:13px;">—<div><span style="caret-color: rgb(96, 108, 118); color: rgb(96, 108, 118); font-family: -apple-system, "Helvetica Neue", Helvetica, Arial, sans-serif; letter-spacing: 0.12999999523162842px;">Project Manager: Tor Browser, UX and Community teams</span></div><div><font color="#606c76" face="-apple-system, Helvetica Neue, Helvetica, Arial, sans-serif"><span style="caret-color: rgb(96, 108, 118); letter-spacing: 0.12999999523162842px;">pili at torproject dot org </span></font></div><div><font color="#606c76" face="-apple-system, Helvetica Neue, Helvetica, Arial, sans-serif"><span style="caret-color: rgb(96, 108, 118); letter-spacing: 0.12999999523162842px;">gpg </span></font><font color="#4d5862">3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45</font></div></div> <div><br></div> </div> </div> <div id="CanaryDropbox"> </div> <blockquote id="CanaryBlockquote"> <div> <div>On Monday, Feb 11, 2019 at 12:47 PM, Pili Guerra <<a href="mailto:pili@torproject.org">pili@torproject.org</a>> wrote:<br></div> <div style="font-family:Helvetica;color:#000000;font-size:13px;"><div id=""> <div> <div>Hi everyone, </div><div><br></div><div>We had a very good meeting to start scoping out the Tor Browser vision for the near future on Friday and I just wanted to recap what was discussed and open it up for wider discussion here for those that wanted, but were unable, to join. </div><div><br></div><div>The starting point for the discussion was: "Why do we need Tor Browser?"</div><div><br></div><div>It was agreed that there is currently a need for a browser to protect users from tracking, surveillance and censorship as well as making tor more accessible for users. However, currently the Tor Project is not a browser vendor and Tor Browser is still in some ways just a prototype for how to do truly private browsing, at the expense of usability and features. Moving forward, it's not clear whether we should try to become a first-class browser, or help others in the actual browser business to take up the challenge to create a truly secure and private browser that meets the Tor Project's privacy standards and that we can fully endorse. </div><div><br></div><div>Does the Tor Project need to become a browser vendor? If so, what would it take for Tor Browser to become a user's main browser as opposed to one that is only used for specific tasks?</div><div><br></div><div>If not, what does this mean for Tor Browser in future? Should it continue serving *just* as a prototype for how to put user's privacy first? Do we want to let other browser vendors take up this task and instead create tools that measure the privacy standards of different browsers?</div><div><br></div><div>Working on the premise that we do want to become the main browser for a significant percentage of users, what is it that we need to do in order to achieve this? Do we want to make a compromise by slightly reducing privacy in order to improve usability and add more features? Or should we keep on investing in privacy features as a priority? </div><div><br></div><div>Further to that, if we did get more users as a result of usability improvements and at the cost of slightly reduced privacy, would the increased aggregate privacy of a larger user base make up for this slight reduction in privacy?</div><div><br></div><div>What about users who have no choice but to use Tor Browser? How can we justify any compromise for them? </div><div><br></div><div>As you can see from all these questions, there is plenty for us to figure out still and we found out that this was not the sort of discussion we could hash out in just one session. As such, we'll be announcing a follow up session in a couple of weeks time. </div><div><br></div><div>You can find the full meeting logs for this first session here[1].</div><div><br></div><div>Thanks!</div><div><br></div><div>Pili</div><div><br></div><div>[1] http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-02-08-19.59.log.html</div> </div> <div><br></div> </div> <div id=""> <div> <div style="font-family:Helvetica;color:#000;font-size:13px;">—<div><span style="caret-color: rgb(96, 108, 118); color: rgb(96, 108, 118); font-family: -apple-system, "Helvetica Neue", Helvetica, Arial, sans-serif; letter-spacing: 0.12999999523162842px;">Project Manager: Tor Browser, UX and Community teams</span></div><div><font color="#606c76" face="-apple-system, Helvetica Neue, Helvetica, Arial, sans-serif"><span style="caret-color: rgb(96, 108, 118); letter-spacing: 0.12999999523162842px;">pili at torproject dot org </span></font></div><div><font color="#606c76" face="-apple-system, Helvetica Neue, Helvetica, Arial, sans-serif"><span style="caret-color: rgb(96, 108, 118); letter-spacing: 0.12999999523162842px;">gpg </span></font><font color="#4d5862">3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45</font></div></div> <div><br></div> </div> </div> <div id="CanaryDropbox"> </div> <blockquote id=""> <div> <div>On Thursday, Feb 07, 2019 at 10:17 AM, Pili Guerra <<a href="mailto:pili@torproject.org">pili@torproject.org</a>> wrote:<br></div> <div style="font-family:Helvetica;color:#000000;font-size:13px;"> <div id=""> <div> Hi everyone,</div><div><br></div><div>We’ll be holding a brainstorming session this Friday 8th February @ 20:00 UTC over on #tor-meeting to discuss our joint vision for the Tor Browser in the near future.</div><div><br></div><div>Please join us! We would love to hear your views.</div><div><br></div><div>Thanks!</div><div><br></div><div>Pili </div> <div><br></div> </div> <div id=""> <div> <div style="font-family:Helvetica;color:#000;font-size:13px;">—<div><span style="caret-color: rgb(96, 108, 118); color: rgb(96, 108, 118); font-family: -apple-system, "Helvetica Neue", Helvetica, Arial, sans-serif; letter-spacing: 0.12999999523162842px;">Project Manager: Tor Browser, UX and Community teams</span></div><div><font color="#606c76" face="-apple-system, Helvetica Neue, Helvetica, Arial, sans-serif"><span style="caret-color: rgb(96, 108, 118); letter-spacing: 0.12999999523162842px;">pili at torproject dot org </span></font></div><div><font color="#606c76" face="-apple-system, Helvetica Neue, Helvetica, Arial, sans-serif"><span style="caret-color: rgb(96, 108, 118); letter-spacing: 0.12999999523162842px;">gpg </span></font><font color="#4d5862">3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45</font></div></div> <div><br></div> </div> </div> <div id="CanaryDropbox"> </div> _______________________________________________<br>tor-project mailing list<br>tor-project@lists.torproject.org<br>https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project<br></div> </div> </blockquote> _______________________________________________<br>tor-project mailing list<br>tor-project@lists.torproject.org<br>https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project<br></div> </div> </blockquote> </body></html>