commit 5426045ea02fb077b1d3c35f5c9f92c2f07facc3 Author: Alex Catarineu acat@torproject.org Date: Mon May 13 18:14:46 2019 +0200

Move to new folder structure --- src/CREDITS => CREDITS | 0 README | 23 - src/chrome.manifest => chrome.manifest | 0 {src/chrome => chrome}/content/aboutDialog.xul | 0 .../content/aboutTor/aboutTor-content.js | 0 .../content/aboutTor/aboutTor.xhtml | 0 .../content/locale/non-localized.properties | 0 .../content/menu-items-overlay.xul | 0 {src/chrome => chrome}/content/menu-overlay.xul | 0 .../content/preferences-mobile.js | 0 {src/chrome => chrome}/content/preferences.xhtml | 0 .../content/tor-circuit-display.js | 0 .../content/tor-circuit-display.xul | 0 .../content/torbutton-extensions.xul | 0 {src/chrome => chrome}/content/torbutton.js | 0 {src/chrome => chrome}/content/torbutton.xul | 0 {src/chrome => chrome}/content/torbutton_util.js | 0 {src/chrome => chrome}/locale/af/aboutTor.dtd | 0 {src/chrome => chrome}/locale/af/brand.dtd | 0 {src/chrome => chrome}/locale/af/brand.properties | 0 {src/chrome => chrome}/locale/af/torbutton.dtd | 0 .../locale/af/torbutton.properties | 0 {src/chrome => chrome}/locale/ak/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ak/brand.dtd | 0 {src/chrome => chrome}/locale/ak/brand.properties | 0 {src/chrome => chrome}/locale/ak/torbutton.dtd | 0 .../locale/ak/torbutton.properties | 0 {src/chrome => chrome}/locale/am/aboutTor.dtd | 0 {src/chrome => chrome}/locale/am/brand.dtd | 0 {src/chrome => chrome}/locale/am/brand.properties | 0 {src/chrome => chrome}/locale/am/torbutton.dtd | 0 .../locale/am/torbutton.properties | 0 {src/chrome => chrome}/locale/ar/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/ar/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/ar/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ar/brand.dtd | 0 {src/chrome => chrome}/locale/ar/brand.properties | 0 .../locale/ar/browserOnboarding.properties | 0 .../locale/ar/securityLevel.properties | 0 {src/chrome => chrome}/locale/ar/torbutton.dtd | 0 .../locale/ar/torbutton.properties | 0 {src/chrome => chrome}/locale/arn/aboutTor.dtd | 0 {src/chrome => chrome}/locale/arn/brand.dtd | 0 {src/chrome => chrome}/locale/arn/brand.properties | 0 {src/chrome => chrome}/locale/arn/torbutton.dtd | 0 .../locale/arn/torbutton.properties | 0 {src/chrome => chrome}/locale/ast/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ast/brand.dtd | 0 {src/chrome => chrome}/locale/ast/brand.properties | 0 {src/chrome => chrome}/locale/ast/torbutton.dtd | 0 .../locale/ast/torbutton.properties | 0 {src/chrome => chrome}/locale/az/aboutTor.dtd | 0 {src/chrome => chrome}/locale/az/brand.dtd | 0 {src/chrome => chrome}/locale/az/brand.properties | 0 .../locale/az/securityLevel.properties | 0 {src/chrome => chrome}/locale/az/torbutton.dtd | 0 .../locale/az/torbutton.properties | 0 {src/chrome => chrome}/locale/be/aboutTor.dtd | 0 {src/chrome => chrome}/locale/be/brand.dtd | 0 {src/chrome => chrome}/locale/be/brand.properties | 0 {src/chrome => chrome}/locale/be/torbutton.dtd | 0 .../locale/be/torbutton.properties | 0 {src/chrome => chrome}/locale/bg/aboutTor.dtd | 0 {src/chrome => chrome}/locale/bg/brand.dtd | 0 {src/chrome => chrome}/locale/bg/brand.properties | 0 .../locale/bg/securityLevel.properties | 0 {src/chrome => chrome}/locale/bg/torbutton.dtd | 0 .../locale/bg/torbutton.properties | 0 {src/chrome => chrome}/locale/bms/aboutTor.dtd | 0 .../locale/bms/securityLevel.properties | 0 {src/chrome => chrome}/locale/bms/torbutton.dtd | 0 .../locale/bms/torbutton.properties | 0 .../chrome => chrome}/locale/bn-BD/aboutDialog.dtd | 0 .../locale/bn-BD/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/bn-BD/aboutTor.dtd | 0 {src/chrome => chrome}/locale/bn-BD/brand.dtd | 0 .../locale/bn-BD/brand.properties | 0 .../locale/bn-BD/browserOnboarding.properties | 0 .../locale/bn-BD/securityLevel.properties | 0 {src/chrome => chrome}/locale/bn-BD/torbutton.dtd | 0 .../locale/bn-BD/torbutton.properties | 0 {src/chrome => chrome}/locale/bn-IN/aboutTor.dtd | 0 {src/chrome => chrome}/locale/bn-IN/brand.dtd | 0 .../locale/bn-IN/brand.properties | 0 {src/chrome => chrome}/locale/bn-IN/torbutton.dtd | 0 .../locale/bn-IN/torbutton.properties | 0 {src/chrome => chrome}/locale/bn/aboutTor.dtd | 0 {src/chrome => chrome}/locale/bn/brand.dtd | 0 {src/chrome => chrome}/locale/bn/brand.properties | 0 {src/chrome => chrome}/locale/bn/torbutton.dtd | 0 .../locale/bn/torbutton.properties | 0 {src/chrome => chrome}/locale/bo/aboutTor.dtd | 0 {src/chrome => chrome}/locale/bo/brand.dtd | 0 {src/chrome => chrome}/locale/bo/brand.properties | 0 {src/chrome => chrome}/locale/bo/torbutton.dtd | 0 .../locale/bo/torbutton.properties | 0 {src/chrome => chrome}/locale/br/aboutTor.dtd | 0 {src/chrome => chrome}/locale/br/brand.dtd | 0 {src/chrome => chrome}/locale/br/brand.properties | 0 {src/chrome => chrome}/locale/br/torbutton.dtd | 0 .../locale/br/torbutton.properties | 0 {src/chrome => chrome}/locale/bs/aboutTor.dtd | 0 {src/chrome => chrome}/locale/bs/brand.dtd | 0 {src/chrome => chrome}/locale/bs/brand.properties | 0 .../locale/bs/securityLevel.properties | 0 {src/chrome => chrome}/locale/bs/torbutton.dtd | 0 .../locale/bs/torbutton.properties | 0 {src/chrome => chrome}/locale/ca/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/ca/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/ca/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ca/brand.dtd | 0 {src/chrome => chrome}/locale/ca/brand.properties | 0 .../locale/ca/browserOnboarding.properties | 0 .../locale/ca/securityLevel.properties | 0 {src/chrome => chrome}/locale/ca/torbutton.dtd | 0 .../locale/ca/torbutton.properties | 0 {src/chrome => chrome}/locale/cs/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/cs/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/cs/aboutTor.dtd | 0 {src/chrome => chrome}/locale/cs/brand.dtd | 0 {src/chrome => chrome}/locale/cs/brand.properties | 0 .../locale/cs/browserOnboarding.properties | 0 .../locale/cs/securityLevel.properties | 0 {src/chrome => chrome}/locale/cs/torbutton.dtd | 0 .../locale/cs/torbutton.properties | 0 {src/chrome => chrome}/locale/csb/aboutTor.dtd | 0 {src/chrome => chrome}/locale/csb/brand.dtd | 0 {src/chrome => chrome}/locale/csb/brand.properties | 0 {src/chrome => chrome}/locale/csb/torbutton.dtd | 0 .../locale/csb/torbutton.properties | 0 {src/chrome => chrome}/locale/cy/aboutTor.dtd | 0 {src/chrome => chrome}/locale/cy/brand.dtd | 0 {src/chrome => chrome}/locale/cy/brand.properties | 0 {src/chrome => chrome}/locale/cy/torbutton.dtd | 0 .../locale/cy/torbutton.properties | 0 {src/chrome => chrome}/locale/da/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/da/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/da/aboutTor.dtd | 0 {src/chrome => chrome}/locale/da/brand.dtd | 0 {src/chrome => chrome}/locale/da/brand.properties | 0 .../locale/da/browserOnboarding.properties | 0 .../locale/da/securityLevel.properties | 0 {src/chrome => chrome}/locale/da/torbutton.dtd | 0 .../locale/da/torbutton.properties | 0 {src/chrome => chrome}/locale/de/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/de/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/de/aboutTor.dtd | 0 {src/chrome => chrome}/locale/de/brand.dtd | 0 {src/chrome => chrome}/locale/de/brand.properties | 0 .../locale/de/browserOnboarding.properties | 0 .../locale/de/securityLevel.properties | 0 {src/chrome => chrome}/locale/de/torbutton.dtd | 0 .../locale/de/torbutton.properties | 0 {src/chrome => chrome}/locale/dz/aboutTor.dtd | 0 {src/chrome => chrome}/locale/dz/brand.dtd | 0 {src/chrome => chrome}/locale/dz/brand.properties | 0 {src/chrome => chrome}/locale/dz/torbutton.dtd | 0 .../locale/dz/torbutton.properties | 0 {src/chrome => chrome}/locale/el/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/el/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/el/aboutTor.dtd | 0 {src/chrome => chrome}/locale/el/brand.dtd | 0 {src/chrome => chrome}/locale/el/brand.properties | 0 .../locale/el/browserOnboarding.properties | 0 .../locale/el/securityLevel.properties | 0 {src/chrome => chrome}/locale/el/torbutton.dtd | 0 .../locale/el/torbutton.properties | 0 .../chrome => chrome}/locale/en-US/aboutDialog.dtd | 0 .../locale/en-US/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/en-US/aboutTor.dtd | 0 {src/chrome => chrome}/locale/en-US/brand.dtd | 0 .../locale/en-US/brand.properties | 0 .../locale/en-US/browserOnboarding.properties | 0 .../locale/en-US/securityLevel.properties | 0 {src/chrome => chrome}/locale/en-US/torbutton.dtd | 0 .../locale/en-US/torbutton.properties | 0 {src/chrome => chrome}/locale/eo/aboutTor.dtd | 0 {src/chrome => chrome}/locale/eo/brand.dtd | 0 {src/chrome => chrome}/locale/eo/brand.properties | 0 .../locale/eo/securityLevel.properties | 0 {src/chrome => chrome}/locale/eo/torbutton.dtd | 0 .../locale/eo/torbutton.properties | 0 .../chrome => chrome}/locale/es-AR/aboutDialog.dtd | 0 .../locale/es-AR/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/es-AR/aboutTor.dtd | 0 {src/chrome => chrome}/locale/es-AR/brand.dtd | 0 .../locale/es-AR/brand.properties | 0 .../locale/es-AR/browserOnboarding.properties | 0 .../locale/es-AR/securityLevel.properties | 0 {src/chrome => chrome}/locale/es-AR/torbutton.dtd | 0 .../locale/es-AR/torbutton.properties | 0 .../chrome => chrome}/locale/es-ES/aboutDialog.dtd | 0 .../locale/es-ES/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/es-ES/aboutTor.dtd | 0 {src/chrome => chrome}/locale/es-ES/brand.dtd | 0 .../locale/es-ES/brand.properties | 0 .../locale/es-ES/browserOnboarding.properties | 0 .../locale/es-ES/securityLevel.properties | 0 {src/chrome => chrome}/locale/es-ES/torbutton.dtd | 0 .../locale/es-ES/torbutton.properties | 0 {src/chrome => chrome}/locale/et/aboutTor.dtd | 0 {src/chrome => chrome}/locale/et/brand.dtd | 0 {src/chrome => chrome}/locale/et/brand.properties | 0 {src/chrome => chrome}/locale/et/torbutton.dtd | 0 .../locale/et/torbutton.properties | 0 {src/chrome => chrome}/locale/eu/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/eu/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/eu/aboutTor.dtd | 0 {src/chrome => chrome}/locale/eu/brand.dtd | 0 {src/chrome => chrome}/locale/eu/brand.properties | 0 .../locale/eu/browserOnboarding.properties | 0 .../locale/eu/securityLevel.properties | 0 {src/chrome => chrome}/locale/eu/torbutton.dtd | 0 .../locale/eu/torbutton.properties | 0 {src/chrome => chrome}/locale/fa/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/fa/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/fa/aboutTor.dtd | 0 {src/chrome => chrome}/locale/fa/brand.dtd | 0 {src/chrome => chrome}/locale/fa/brand.properties | 0 .../locale/fa/browserOnboarding.properties | 0 .../locale/fa/securityLevel.properties | 0 {src/chrome => chrome}/locale/fa/torbutton.dtd | 0 .../locale/fa/torbutton.properties | 0 {src/chrome => chrome}/locale/fi/aboutTor.dtd | 0 {src/chrome => chrome}/locale/fi/brand.dtd | 0 {src/chrome => chrome}/locale/fi/brand.properties | 0 .../locale/fi/securityLevel.properties | 0 {src/chrome => chrome}/locale/fi/torbutton.dtd | 0 .../locale/fi/torbutton.properties | 0 {src/chrome => chrome}/locale/fil/aboutTor.dtd | 0 {src/chrome => chrome}/locale/fil/brand.dtd | 0 {src/chrome => chrome}/locale/fil/brand.properties | 0 {src/chrome => chrome}/locale/fil/torbutton.dtd | 0 .../locale/fil/torbutton.properties | 0 {src/chrome => chrome}/locale/fo/aboutTor.dtd | 0 {src/chrome => chrome}/locale/fo/brand.dtd | 0 {src/chrome => chrome}/locale/fo/brand.properties | 0 {src/chrome => chrome}/locale/fo/torbutton.dtd | 0 .../locale/fo/torbutton.properties | 0 {src/chrome => chrome}/locale/fr/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/fr/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/fr/aboutTor.dtd | 0 {src/chrome => chrome}/locale/fr/brand.dtd | 0 {src/chrome => chrome}/locale/fr/brand.properties | 0 .../locale/fr/browserOnboarding.properties | 0 .../locale/fr/securityLevel.properties | 0 {src/chrome => chrome}/locale/fr/torbutton.dtd | 0 .../locale/fr/torbutton.properties | 0 {src/chrome => chrome}/locale/fur/aboutTor.dtd | 0 {src/chrome => chrome}/locale/fur/brand.dtd | 0 {src/chrome => chrome}/locale/fur/brand.properties | 0 {src/chrome => chrome}/locale/fur/torbutton.dtd | 0 .../locale/fur/torbutton.properties | 0 {src/chrome => chrome}/locale/fy/aboutTor.dtd | 0 {src/chrome => chrome}/locale/fy/brand.dtd | 0 {src/chrome => chrome}/locale/fy/brand.properties | 0 {src/chrome => chrome}/locale/fy/torbutton.dtd | 0 .../locale/fy/torbutton.properties | 0 .../chrome => chrome}/locale/ga-IE/aboutDialog.dtd | 0 .../locale/ga-IE/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/ga-IE/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ga-IE/brand.dtd | 0 .../locale/ga-IE/brand.properties | 0 .../locale/ga-IE/browserOnboarding.properties | 0 .../locale/ga-IE/securityLevel.properties | 0 {src/chrome => chrome}/locale/ga-IE/torbutton.dtd | 0 .../locale/ga-IE/torbutton.properties | 0 {src/chrome => chrome}/locale/gl/aboutTor.dtd | 0 {src/chrome => chrome}/locale/gl/brand.dtd | 0 {src/chrome => chrome}/locale/gl/brand.properties | 0 .../locale/gl/securityLevel.properties | 0 {src/chrome => chrome}/locale/gl/torbutton.dtd | 0 .../locale/gl/torbutton.properties | 0 {src/chrome => chrome}/locale/gu/aboutTor.dtd | 0 {src/chrome => chrome}/locale/gu/brand.dtd | 0 {src/chrome => chrome}/locale/gu/brand.properties | 0 .../locale/gu/securityLevel.properties | 0 {src/chrome => chrome}/locale/gu/torbutton.dtd | 0 .../locale/gu/torbutton.properties | 0 {src/chrome => chrome}/locale/gun/aboutTor.dtd | 0 {src/chrome => chrome}/locale/gun/brand.dtd | 0 {src/chrome => chrome}/locale/gun/brand.properties | 0 {src/chrome => chrome}/locale/gun/torbutton.dtd | 0 .../locale/gun/torbutton.properties | 0 {src/chrome => chrome}/locale/ha/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ha/brand.dtd | 0 {src/chrome => chrome}/locale/ha/brand.properties | 0 {src/chrome => chrome}/locale/ha/torbutton.dtd | 0 .../locale/ha/torbutton.properties | 0 {src/chrome => chrome}/locale/he/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/he/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/he/aboutTor.dtd | 0 {src/chrome => chrome}/locale/he/brand.dtd | 0 {src/chrome => chrome}/locale/he/brand.properties | 0 .../locale/he/browserOnboarding.properties | 0 .../locale/he/securityLevel.properties | 0 {src/chrome => chrome}/locale/he/torbutton.dtd | 0 .../locale/he/torbutton.properties | 0 {src/chrome => chrome}/locale/hi/aboutTor.dtd | 0 {src/chrome => chrome}/locale/hi/brand.dtd | 0 {src/chrome => chrome}/locale/hi/brand.properties | 0 {src/chrome => chrome}/locale/hi/torbutton.dtd | 0 .../locale/hi/torbutton.properties | 0 {src/chrome => chrome}/locale/hr/aboutTor.dtd | 0 {src/chrome => chrome}/locale/hr/brand.dtd | 0 {src/chrome => chrome}/locale/hr/brand.properties | 0 {src/chrome => chrome}/locale/hr/torbutton.dtd | 0 .../locale/hr/torbutton.properties | 0 {src/chrome => chrome}/locale/ht/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ht/brand.dtd | 0 {src/chrome => chrome}/locale/ht/brand.properties | 0 {src/chrome => chrome}/locale/ht/torbutton.dtd | 0 .../locale/ht/torbutton.properties | 0 {src/chrome => chrome}/locale/hu/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/hu/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/hu/aboutTor.dtd | 0 {src/chrome => chrome}/locale/hu/brand.dtd | 0 {src/chrome => chrome}/locale/hu/brand.properties | 0 .../locale/hu/browserOnboarding.properties | 0 .../locale/hu/securityLevel.properties | 0 {src/chrome => chrome}/locale/hu/torbutton.dtd | 0 .../locale/hu/torbutton.properties | 0 {src/chrome => chrome}/locale/hy/aboutTor.dtd | 0 {src/chrome => chrome}/locale/hy/brand.dtd | 0 {src/chrome => chrome}/locale/hy/brand.properties | 0 {src/chrome => chrome}/locale/hy/torbutton.dtd | 0 .../locale/hy/torbutton.properties | 0 {src/chrome => chrome}/locale/id/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/id/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/id/aboutTor.dtd | 0 {src/chrome => chrome}/locale/id/brand.dtd | 0 {src/chrome => chrome}/locale/id/brand.properties | 0 .../locale/id/browserOnboarding.properties | 0 .../locale/id/securityLevel.properties | 0 {src/chrome => chrome}/locale/id/torbutton.dtd | 0 .../locale/id/torbutton.properties | 0 {src/chrome => chrome}/locale/is/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/is/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/is/aboutTor.dtd | 0 {src/chrome => chrome}/locale/is/brand.dtd | 0 {src/chrome => chrome}/locale/is/brand.properties | 0 .../locale/is/browserOnboarding.properties | 0 .../locale/is/securityLevel.properties | 0 {src/chrome => chrome}/locale/is/torbutton.dtd | 0 .../locale/is/torbutton.properties | 0 {src/chrome => chrome}/locale/it/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/it/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/it/aboutTor.dtd | 0 {src/chrome => chrome}/locale/it/brand.dtd | 0 {src/chrome => chrome}/locale/it/brand.properties | 0 .../locale/it/browserOnboarding.properties | 0 .../locale/it/securityLevel.properties | 0 {src/chrome => chrome}/locale/it/torbutton.dtd | 0 .../locale/it/torbutton.properties | 0 {src/chrome => chrome}/locale/ja/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/ja/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/ja/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ja/brand.dtd | 0 {src/chrome => chrome}/locale/ja/brand.properties | 0 .../locale/ja/browserOnboarding.properties | 0 .../locale/ja/securityLevel.properties | 0 {src/chrome => chrome}/locale/ja/torbutton.dtd | 0 .../locale/ja/torbutton.properties | 0 {src/chrome => chrome}/locale/jv/aboutTor.dtd | 0 {src/chrome => chrome}/locale/jv/brand.dtd | 0 {src/chrome => chrome}/locale/jv/brand.properties | 0 {src/chrome => chrome}/locale/jv/torbutton.dtd | 0 .../locale/jv/torbutton.properties | 0 {src/chrome => chrome}/locale/ka/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/ka/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/ka/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ka/brand.dtd | 0 {src/chrome => chrome}/locale/ka/brand.properties | 0 .../locale/ka/browserOnboarding.properties | 0 .../locale/ka/securityLevel.properties | 0 {src/chrome => chrome}/locale/ka/torbutton.dtd | 0 .../locale/ka/torbutton.properties | 0 {src/chrome => chrome}/locale/km/aboutTor.dtd | 0 {src/chrome => chrome}/locale/km/brand.dtd | 0 {src/chrome => chrome}/locale/km/brand.properties | 0 {src/chrome => chrome}/locale/km/torbutton.dtd | 0 .../locale/km/torbutton.properties | 0 {src/chrome => chrome}/locale/kn/aboutTor.dtd | 0 {src/chrome => chrome}/locale/kn/brand.dtd | 0 {src/chrome => chrome}/locale/kn/brand.properties | 0 {src/chrome => chrome}/locale/kn/torbutton.dtd | 0 .../locale/kn/torbutton.properties | 0 {src/chrome => chrome}/locale/ko/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/ko/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/ko/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ko/brand.dtd | 0 {src/chrome => chrome}/locale/ko/brand.properties | 0 .../locale/ko/browserOnboarding.properties | 0 .../locale/ko/securityLevel.properties | 0 {src/chrome => chrome}/locale/ko/torbutton.dtd | 0 .../locale/ko/torbutton.properties | 0 {src/chrome => chrome}/locale/ku/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ku/brand.dtd | 0 {src/chrome => chrome}/locale/ku/brand.properties | 0 {src/chrome => chrome}/locale/ku/torbutton.dtd | 0 .../locale/ku/torbutton.properties | 0 {src/chrome => chrome}/locale/kw/aboutTor.dtd | 0 {src/chrome => chrome}/locale/kw/brand.dtd | 0 {src/chrome => chrome}/locale/kw/brand.properties | 0 {src/chrome => chrome}/locale/kw/torbutton.dtd | 0 .../locale/kw/torbutton.properties | 0 {src/chrome => chrome}/locale/ky/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ky/brand.dtd | 0 {src/chrome => chrome}/locale/ky/brand.properties | 0 {src/chrome => chrome}/locale/ky/torbutton.dtd | 0 .../locale/ky/torbutton.properties | 0 {src/chrome => chrome}/locale/lb/aboutTor.dtd | 0 {src/chrome => chrome}/locale/lb/brand.dtd | 0 {src/chrome => chrome}/locale/lb/brand.properties | 0 {src/chrome => chrome}/locale/lb/torbutton.dtd | 0 .../locale/lb/torbutton.properties | 0 {src/chrome => chrome}/locale/lg/aboutTor.dtd | 0 {src/chrome => chrome}/locale/lg/torbutton.dtd | 0 .../locale/lg/torbutton.properties | 0 {src/chrome => chrome}/locale/ln/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ln/brand.dtd | 0 {src/chrome => chrome}/locale/ln/brand.properties | 0 {src/chrome => chrome}/locale/ln/torbutton.dtd | 0 .../locale/ln/torbutton.properties | 0 {src/chrome => chrome}/locale/lo/aboutTor.dtd | 0 {src/chrome => chrome}/locale/lo/brand.dtd | 0 {src/chrome => chrome}/locale/lo/brand.properties | 0 {src/chrome => chrome}/locale/lo/torbutton.dtd | 0 .../locale/lo/torbutton.properties | 0 {src/chrome => chrome}/locale/lt/aboutTor.dtd | 0 {src/chrome => chrome}/locale/lt/brand.dtd | 0 {src/chrome => chrome}/locale/lt/brand.properties | 0 .../locale/lt/securityLevel.properties | 0 {src/chrome => chrome}/locale/lt/torbutton.dtd | 0 .../locale/lt/torbutton.properties | 0 {src/chrome => chrome}/locale/lv/aboutTor.dtd | 0 {src/chrome => chrome}/locale/lv/brand.dtd | 0 {src/chrome => chrome}/locale/lv/brand.properties | 0 .../locale/lv/securityLevel.properties | 0 {src/chrome => chrome}/locale/lv/torbutton.dtd | 0 .../locale/lv/torbutton.properties | 0 {src/chrome => chrome}/locale/mg/aboutTor.dtd | 0 {src/chrome => chrome}/locale/mg/brand.dtd | 0 {src/chrome => chrome}/locale/mg/brand.properties | 0 {src/chrome => chrome}/locale/mg/torbutton.dtd | 0 .../locale/mg/torbutton.properties | 0 {src/chrome => chrome}/locale/mi/aboutTor.dtd | 0 {src/chrome => chrome}/locale/mi/brand.dtd | 0 {src/chrome => chrome}/locale/mi/brand.properties | 0 {src/chrome => chrome}/locale/mi/torbutton.dtd | 0 .../locale/mi/torbutton.properties | 0 {src/chrome => chrome}/locale/mk/aboutTor.dtd | 0 {src/chrome => chrome}/locale/mk/brand.dtd | 0 {src/chrome => chrome}/locale/mk/brand.properties | 0 .../locale/mk/securityLevel.properties | 0 {src/chrome => chrome}/locale/mk/torbutton.dtd | 0 .../locale/mk/torbutton.properties | 0 {src/chrome => chrome}/locale/ml/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ml/brand.dtd | 0 {src/chrome => chrome}/locale/ml/brand.properties | 0 {src/chrome => chrome}/locale/ml/torbutton.dtd | 0 .../locale/ml/torbutton.properties | 0 {src/chrome => chrome}/locale/mn/aboutTor.dtd | 0 {src/chrome => chrome}/locale/mn/brand.dtd | 0 {src/chrome => chrome}/locale/mn/brand.properties | 0 {src/chrome => chrome}/locale/mn/torbutton.dtd | 0 .../locale/mn/torbutton.properties | 0 {src/chrome => chrome}/locale/mr/aboutTor.dtd | 0 {src/chrome => chrome}/locale/mr/brand.dtd | 0 {src/chrome => chrome}/locale/mr/brand.properties | 0 {src/chrome => chrome}/locale/mr/torbutton.dtd | 0 .../locale/mr/torbutton.properties | 0 {src/chrome => chrome}/locale/ms/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ms/brand.dtd | 0 {src/chrome => chrome}/locale/ms/brand.properties | 0 {src/chrome => chrome}/locale/ms/torbutton.dtd | 0 .../locale/ms/torbutton.properties | 0 {src/chrome => chrome}/locale/mt/aboutTor.dtd | 0 {src/chrome => chrome}/locale/mt/brand.dtd | 0 {src/chrome => chrome}/locale/mt/brand.properties | 0 {src/chrome => chrome}/locale/mt/torbutton.dtd | 0 .../locale/mt/torbutton.properties | 0 {src/chrome => chrome}/locale/my/aboutTor.dtd | 0 {src/chrome => chrome}/locale/my/brand.dtd | 0 {src/chrome => chrome}/locale/my/brand.properties | 0 .../locale/my/securityLevel.properties | 0 {src/chrome => chrome}/locale/my/torbutton.dtd | 0 .../locale/my/torbutton.properties | 0 {src/chrome => chrome}/locale/nah/aboutTor.dtd | 0 {src/chrome => chrome}/locale/nah/brand.dtd | 0 {src/chrome => chrome}/locale/nah/brand.properties | 0 {src/chrome => chrome}/locale/nah/torbutton.dtd | 0 .../locale/nah/torbutton.properties | 0 {src/chrome => chrome}/locale/nap/aboutTor.dtd | 0 {src/chrome => chrome}/locale/nap/brand.dtd | 0 {src/chrome => chrome}/locale/nap/brand.properties | 0 {src/chrome => chrome}/locale/nap/torbutton.dtd | 0 .../locale/nap/torbutton.properties | 0 .../chrome => chrome}/locale/nb-NO/aboutDialog.dtd | 0 .../locale/nb-NO/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/nb-NO/aboutTor.dtd | 0 {src/chrome => chrome}/locale/nb-NO/brand.dtd | 0 .../locale/nb-NO/brand.properties | 0 .../locale/nb-NO/browserOnboarding.properties | 0 .../locale/nb-NO/securityLevel.properties | 0 {src/chrome => chrome}/locale/nb-NO/torbutton.dtd | 0 .../locale/nb-NO/torbutton.properties | 0 {src/chrome => chrome}/locale/ne/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ne/brand.dtd | 0 {src/chrome => chrome}/locale/ne/brand.properties | 0 {src/chrome => chrome}/locale/ne/torbutton.dtd | 0 .../locale/ne/torbutton.properties | 0 {src/chrome => chrome}/locale/nl/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/nl/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/nl/aboutTor.dtd | 0 {src/chrome => chrome}/locale/nl/brand.dtd | 0 {src/chrome => chrome}/locale/nl/brand.properties | 0 .../locale/nl/browserOnboarding.properties | 0 .../locale/nl/securityLevel.properties | 0 {src/chrome => chrome}/locale/nl/torbutton.dtd | 0 .../locale/nl/torbutton.properties | 0 {src/chrome => chrome}/locale/nn/aboutTor.dtd | 0 {src/chrome => chrome}/locale/nn/brand.dtd | 0 {src/chrome => chrome}/locale/nn/brand.properties | 0 {src/chrome => chrome}/locale/nn/torbutton.dtd | 0 .../locale/nn/torbutton.properties | 0 {src/chrome => chrome}/locale/nso/aboutTor.dtd | 0 {src/chrome => chrome}/locale/nso/brand.dtd | 0 {src/chrome => chrome}/locale/nso/brand.properties | 0 {src/chrome => chrome}/locale/nso/torbutton.dtd | 0 .../locale/nso/torbutton.properties | 0 {src/chrome => chrome}/locale/oc/aboutTor.dtd | 0 {src/chrome => chrome}/locale/oc/brand.dtd | 0 {src/chrome => chrome}/locale/oc/brand.properties | 0 {src/chrome => chrome}/locale/oc/torbutton.dtd | 0 .../locale/oc/torbutton.properties | 0 {src/chrome => chrome}/locale/or/aboutTor.dtd | 0 {src/chrome => chrome}/locale/or/brand.dtd | 0 {src/chrome => chrome}/locale/or/brand.properties | 0 {src/chrome => chrome}/locale/or/torbutton.dtd | 0 .../locale/or/torbutton.properties | 0 {src/chrome => chrome}/locale/pa/aboutTor.dtd | 0 {src/chrome => chrome}/locale/pa/brand.dtd | 0 {src/chrome => chrome}/locale/pa/brand.properties | 0 {src/chrome => chrome}/locale/pa/torbutton.dtd | 0 .../locale/pa/torbutton.properties | 0 {src/chrome => chrome}/locale/pap/aboutTor.dtd | 0 {src/chrome => chrome}/locale/pap/brand.dtd | 0 {src/chrome => chrome}/locale/pap/brand.properties | 0 {src/chrome => chrome}/locale/pap/torbutton.dtd | 0 .../locale/pap/torbutton.properties | 0 {src/chrome => chrome}/locale/pl/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/pl/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/pl/aboutTor.dtd | 0 {src/chrome => chrome}/locale/pl/brand.dtd | 0 {src/chrome => chrome}/locale/pl/brand.properties | 0 .../locale/pl/browserOnboarding.properties | 0 .../locale/pl/securityLevel.properties | 0 {src/chrome => chrome}/locale/pl/torbutton.dtd | 0 .../locale/pl/torbutton.properties | 0 {src/chrome => chrome}/locale/pms/aboutTor.dtd | 0 {src/chrome => chrome}/locale/pms/brand.dtd | 0 {src/chrome => chrome}/locale/pms/brand.properties | 0 {src/chrome => chrome}/locale/pms/torbutton.dtd | 0 .../locale/pms/torbutton.properties | 0 {src/chrome => chrome}/locale/ps/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ps/brand.dtd | 0 {src/chrome => chrome}/locale/ps/brand.properties | 0 {src/chrome => chrome}/locale/ps/torbutton.dtd | 0 .../locale/ps/torbutton.properties | 0 .../chrome => chrome}/locale/pt-BR/aboutDialog.dtd | 0 .../locale/pt-BR/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/pt-BR/aboutTor.dtd | 0 {src/chrome => chrome}/locale/pt-BR/brand.dtd | 0 .../locale/pt-BR/brand.properties | 0 .../locale/pt-BR/browserOnboarding.properties | 0 .../locale/pt-BR/securityLevel.properties | 0 {src/chrome => chrome}/locale/pt-BR/torbutton.dtd | 0 .../locale/pt-BR/torbutton.properties | 0 {src/chrome => chrome}/locale/pt/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/pt/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/pt/aboutTor.dtd | 0 {src/chrome => chrome}/locale/pt/brand.dtd | 0 {src/chrome => chrome}/locale/pt/brand.properties | 0 .../locale/pt/securityLevel.properties | 0 {src/chrome => chrome}/locale/pt/torbutton.dtd | 0 .../locale/pt/torbutton.properties | 0 {src/chrome => chrome}/locale/ro/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ro/brand.dtd | 0 {src/chrome => chrome}/locale/ro/brand.properties | 0 .../locale/ro/securityLevel.properties | 0 {src/chrome => chrome}/locale/ro/torbutton.dtd | 0 .../locale/ro/torbutton.properties | 0 {src/chrome => chrome}/locale/ru/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/ru/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/ru/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ru/brand.dtd | 0 {src/chrome => chrome}/locale/ru/brand.properties | 0 .../locale/ru/browserOnboarding.properties | 0 .../locale/ru/securityLevel.properties | 0 {src/chrome => chrome}/locale/ru/torbutton.dtd | 0 .../locale/ru/torbutton.properties | 0 {src/chrome => chrome}/locale/sco/aboutTor.dtd | 0 {src/chrome => chrome}/locale/sco/brand.dtd | 0 {src/chrome => chrome}/locale/sco/brand.properties | 0 {src/chrome => chrome}/locale/sco/torbutton.dtd | 0 .../locale/sco/torbutton.properties | 0 {src/chrome => chrome}/locale/sk/aboutTor.dtd | 0 {src/chrome => chrome}/locale/sk/brand.dtd | 0 {src/chrome => chrome}/locale/sk/brand.properties | 0 .../locale/sk/securityLevel.properties | 0 {src/chrome => chrome}/locale/sk/torbutton.dtd | 0 .../locale/sk/torbutton.properties | 0 {src/chrome => chrome}/locale/sl/aboutTor.dtd | 0 {src/chrome => chrome}/locale/sl/brand.dtd | 0 {src/chrome => chrome}/locale/sl/brand.properties | 0 .../locale/sl/securityLevel.properties | 0 {src/chrome => chrome}/locale/sl/torbutton.dtd | 0 .../locale/sl/torbutton.properties | 0 {src/chrome => chrome}/locale/so/aboutTor.dtd | 0 {src/chrome => chrome}/locale/so/brand.dtd | 0 {src/chrome => chrome}/locale/so/brand.properties | 0 {src/chrome => chrome}/locale/so/torbutton.dtd | 0 .../locale/so/torbutton.properties | 0 {src/chrome => chrome}/locale/son/aboutTor.dtd | 0 {src/chrome => chrome}/locale/son/brand.dtd | 0 {src/chrome => chrome}/locale/son/brand.properties | 0 {src/chrome => chrome}/locale/son/torbutton.dtd | 0 .../locale/son/torbutton.properties | 0 {src/chrome => chrome}/locale/sq/aboutTor.dtd | 0 {src/chrome => chrome}/locale/sq/brand.dtd | 0 {src/chrome => chrome}/locale/sq/brand.properties | 0 {src/chrome => chrome}/locale/sq/torbutton.dtd | 0 .../locale/sq/torbutton.properties | 0 {src/chrome => chrome}/locale/sr/aboutTor.dtd | 0 {src/chrome => chrome}/locale/sr/brand.dtd | 0 {src/chrome => chrome}/locale/sr/brand.properties | 0 .../locale/sr/securityLevel.properties | 0 {src/chrome => chrome}/locale/sr/torbutton.dtd | 0 .../locale/sr/torbutton.properties | 0 {src/chrome => chrome}/locale/st/aboutTor.dtd | 0 {src/chrome => chrome}/locale/st/brand.dtd | 0 {src/chrome => chrome}/locale/st/brand.properties | 0 {src/chrome => chrome}/locale/st/torbutton.dtd | 0 .../locale/st/torbutton.properties | 0 {src/chrome => chrome}/locale/su/aboutTor.dtd | 0 {src/chrome => chrome}/locale/su/brand.dtd | 0 {src/chrome => chrome}/locale/su/brand.properties | 0 {src/chrome => chrome}/locale/su/torbutton.dtd | 0 .../locale/su/torbutton.properties | 0 .../chrome => chrome}/locale/sv-SE/aboutDialog.dtd | 0 .../locale/sv-SE/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/sv-SE/aboutTor.dtd | 0 {src/chrome => chrome}/locale/sv-SE/brand.dtd | 0 .../locale/sv-SE/brand.properties | 0 .../locale/sv-SE/browserOnboarding.properties | 0 .../locale/sv-SE/securityLevel.properties | 0 {src/chrome => chrome}/locale/sv-SE/torbutton.dtd | 0 .../locale/sv-SE/torbutton.properties | 0 {src/chrome => chrome}/locale/sw/aboutTor.dtd | 0 {src/chrome => chrome}/locale/sw/brand.dtd | 0 {src/chrome => chrome}/locale/sw/brand.properties | 0 {src/chrome => chrome}/locale/sw/torbutton.dtd | 0 .../locale/sw/torbutton.properties | 0 {src/chrome => chrome}/locale/ta/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ta/brand.dtd | 0 {src/chrome => chrome}/locale/ta/brand.properties | 0 {src/chrome => chrome}/locale/ta/torbutton.dtd | 0 .../locale/ta/torbutton.properties | 0 {src/chrome => chrome}/locale/te/aboutTor.dtd | 0 {src/chrome => chrome}/locale/te/brand.dtd | 0 {src/chrome => chrome}/locale/te/brand.properties | 0 {src/chrome => chrome}/locale/te/torbutton.dtd | 0 .../locale/te/torbutton.properties | 0 {src/chrome => chrome}/locale/tg/aboutTor.dtd | 0 {src/chrome => chrome}/locale/tg/brand.dtd | 0 {src/chrome => chrome}/locale/tg/brand.properties | 0 {src/chrome => chrome}/locale/tg/torbutton.dtd | 0 .../locale/tg/torbutton.properties | 0 {src/chrome => chrome}/locale/th/aboutTor.dtd | 0 {src/chrome => chrome}/locale/th/brand.dtd | 0 {src/chrome => chrome}/locale/th/brand.properties | 0 {src/chrome => chrome}/locale/th/torbutton.dtd | 0 .../locale/th/torbutton.properties | 0 {src/chrome => chrome}/locale/ti/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ti/brand.dtd | 0 {src/chrome => chrome}/locale/ti/brand.properties | 0 {src/chrome => chrome}/locale/ti/torbutton.dtd | 0 .../locale/ti/torbutton.properties | 0 {src/chrome => chrome}/locale/tk/aboutTor.dtd | 0 {src/chrome => chrome}/locale/tk/brand.dtd | 0 {src/chrome => chrome}/locale/tk/brand.properties | 0 {src/chrome => chrome}/locale/tk/torbutton.dtd | 0 .../locale/tk/torbutton.properties | 0 {src/chrome => chrome}/locale/tr/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/tr/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/tr/aboutTor.dtd | 0 {src/chrome => chrome}/locale/tr/brand.dtd | 0 {src/chrome => chrome}/locale/tr/brand.properties | 0 .../locale/tr/browserOnboarding.properties | 0 .../locale/tr/securityLevel.properties | 0 {src/chrome => chrome}/locale/tr/torbutton.dtd | 0 .../locale/tr/torbutton.properties | 0 {src/chrome => chrome}/locale/uk/aboutTor.dtd | 0 {src/chrome => chrome}/locale/uk/brand.dtd | 0 {src/chrome => chrome}/locale/uk/brand.properties | 0 .../locale/uk/securityLevel.properties | 0 {src/chrome => chrome}/locale/uk/torbutton.dtd | 0 .../locale/uk/torbutton.properties | 0 {src/chrome => chrome}/locale/ur/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ur/brand.dtd | 0 {src/chrome => chrome}/locale/ur/brand.properties | 0 {src/chrome => chrome}/locale/ur/torbutton.dtd | 0 .../locale/ur/torbutton.properties | 0 {src/chrome => chrome}/locale/ve/aboutTor.dtd | 0 {src/chrome => chrome}/locale/ve/brand.dtd | 0 {src/chrome => chrome}/locale/ve/brand.properties | 0 {src/chrome => chrome}/locale/ve/torbutton.dtd | 0 .../locale/ve/torbutton.properties | 0 {src/chrome => chrome}/locale/vi/aboutDialog.dtd | 0 {src/chrome => chrome}/locale/vi/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/vi/aboutTor.dtd | 0 {src/chrome => chrome}/locale/vi/brand.dtd | 0 {src/chrome => chrome}/locale/vi/brand.properties | 0 .../locale/vi/browserOnboarding.properties | 0 .../locale/vi/securityLevel.properties | 0 {src/chrome => chrome}/locale/vi/torbutton.dtd | 0 .../locale/vi/torbutton.properties | 0 {src/chrome => chrome}/locale/wa/aboutTor.dtd | 0 {src/chrome => chrome}/locale/wa/brand.dtd | 0 {src/chrome => chrome}/locale/wa/brand.properties | 0 {src/chrome => chrome}/locale/wa/torbutton.dtd | 0 .../locale/wa/torbutton.properties | 0 {src/chrome => chrome}/locale/wo/aboutTor.dtd | 0 {src/chrome => chrome}/locale/wo/brand.dtd | 0 {src/chrome => chrome}/locale/wo/brand.properties | 0 {src/chrome => chrome}/locale/wo/torbutton.dtd | 0 .../locale/wo/torbutton.properties | 0 .../chrome => chrome}/locale/zh-CN/aboutDialog.dtd | 0 .../locale/zh-CN/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/zh-CN/aboutTor.dtd | 0 {src/chrome => chrome}/locale/zh-CN/brand.dtd | 0 .../locale/zh-CN/brand.properties | 0 .../locale/zh-CN/browserOnboarding.properties | 0 .../locale/zh-CN/securityLevel.properties | 0 {src/chrome => chrome}/locale/zh-CN/torbutton.dtd | 0 .../locale/zh-CN/torbutton.properties | 0 {src/chrome => chrome}/locale/zh-HK/aboutTor.dtd | 0 {src/chrome => chrome}/locale/zh-HK/brand.dtd | 0 .../locale/zh-HK/brand.properties | 0 {src/chrome => chrome}/locale/zh-HK/torbutton.dtd | 0 .../locale/zh-HK/torbutton.properties | 0 .../chrome => chrome}/locale/zh-TW/aboutDialog.dtd | 0 .../locale/zh-TW/aboutTBUpdate.dtd | 0 {src/chrome => chrome}/locale/zh-TW/aboutTor.dtd | 0 {src/chrome => chrome}/locale/zh-TW/brand.dtd | 0 .../locale/zh-TW/brand.properties | 0 .../locale/zh-TW/browserOnboarding.properties | 0 .../locale/zh-TW/securityLevel.properties | 0 {src/chrome => chrome}/locale/zh-TW/torbutton.dtd | 0 .../locale/zh-TW/torbutton.properties | 0 {src/chrome => chrome}/locale/zu/aboutTor.dtd | 0 {src/chrome => chrome}/locale/zu/brand.dtd | 0 {src/chrome => chrome}/locale/zu/brand.properties | 0 {src/chrome => chrome}/locale/zu/torbutton.dtd | 0 .../locale/zu/torbutton.properties | 0 {src/chrome => chrome}/skin/about-wordmark.png | Bin {src/chrome => chrome}/skin/aboutDialog.css | 0 {src/chrome => chrome}/skin/aboutTor.css | 0 {src/chrome => chrome}/skin/forwardArrow.png | Bin {src/chrome => chrome}/skin/icon-newsletter.png | Bin {src/chrome => chrome}/skin/new_circuit.svg | 0 {src/chrome => chrome}/skin/preferences-mobile.css | 0 {src/chrome => chrome}/skin/preferences.css | 0 {src/chrome => chrome}/skin/searchLogo.png | Bin .../chrome => chrome}/skin/tor-circuit-display.css | 0 {src/chrome => chrome}/skin/tor.png | Bin .../skin/torbrowser_mobile_logo.png | Bin .../skin/torbutton-update-needed.svg | 0 {src/chrome => chrome}/skin/torbutton.css | 0 {src/chrome => chrome}/skin/torbutton.svg | 0 {src/components => components}/aboutTor.js | 0 .../cookie-jar-selector.js | 0 {src/components => components}/domain-isolator.js | 0 {src/components => components}/dragDropFilter.js | 0 .../external-app-blocker.js | 0 {src/components => components}/startup-observer.js | 0 {src/components => components}/torCheckService.js | 0 {src/components => components}/torbutton-logger.js | 0 .../preferences/preferences.js | 0 ...mport-translations.sh => import-translations.sh | 2 +- src/jar.mn => jar.mn | 0 {src/modules => modules}/default-prefs.js | 0 {src/modules => modules}/noscript-control.js | 0 {src/modules => modules}/security-prefs.js | 0 {src/modules => modules}/tor-control-port.js | 0 {src/modules => modules}/utils.js | 0 moz.build | 4 +- src/CHANGELOG | 1366 --------- src/LICENSE | 53 - src/install.rdf | 24 - trans_tools/old/mkmoz.sh | 20 - trans_tools/old/mkpo.sh | 20 - trans_tools/old/mvmoz.sh | 6 - trans_tools/old/new_tb_strings.sh | 20 - trans_tools/old/validate.py | 94 - trans_tools/old/validate_all.sh | 7 - website/design/CHROME_NOTES | 120 - website/design/FF35_AUDIT | 195 -- website/design/FF40_AUDIT | 50 - website/design/MozillaBrownBag.odp | Bin 47062 -> 0 bytes website/design/MozillaBrownBag.pdf | Bin 117892 -> 0 bytes website/design/build.sh | 1 - website/design/design.xml | 2901 -------------------- website/design/index.html.en | 1453 ---------- website/gimpy.css | 3 - website/index.html.en | 532 ---- website/update.rdf | 173 -- 818 files changed, 3 insertions(+), 7064 deletions(-)

diff --git a/src/CREDITS b/CREDITS similarity index 100% rename from src/CREDITS rename to CREDITS diff --git a/README b/README deleted file mode 100644 index f4dc12d4..00000000 --- a/README +++ /dev/null @@ -1,23 +0,0 @@ -Torbutton comes pre-installed with Tor Browser and we urge you not to change it. -We do not recommend to install it to Firefox because this is not a sufficient -way to surf anonymously. - -Torbutton guarantees that DNS requests are sent through the Tor instance that -comes with Tor Browser. You should not change the proxy settings. - -It’s strongly discouraged to install new Add-ons in Tor Browser, because they -can compromise both your privacy and your security. Plus, Tor Browser already -comes installed with two add-ons — HTTPS Everywhere and NoScript — which give -you a lot of added protection. - -You can read more about it here: -https://www.torproject.org/projects/torbrowser/design/ - -Also have a look at this page for already answered questions: -https://trac.torproject.org/projects/tor/wiki/org/teams/CommunityTeam/Suppor... - -For other issues you should know about have a look at this blog post: -https://blog.torproject.org/toggle-or-not-toggle-end-torbutton - -For a list of all torbutton announcements see -https://blog.torproject.org/category/tags/torbutton diff --git a/src/chrome.manifest b/chrome.manifest similarity index 100% rename from src/chrome.manifest rename to chrome.manifest diff --git a/src/chrome/content/aboutDialog.xul b/chrome/content/aboutDialog.xul similarity index 100% rename from src/chrome/content/aboutDialog.xul rename to chrome/content/aboutDialog.xul diff --git a/src/chrome/content/aboutTor/aboutTor-content.js b/chrome/content/aboutTor/aboutTor-content.js similarity index 100% rename from src/chrome/content/aboutTor/aboutTor-content.js rename to chrome/content/aboutTor/aboutTor-content.js diff --git a/src/chrome/content/aboutTor/aboutTor.xhtml b/chrome/content/aboutTor/aboutTor.xhtml similarity index 100% rename from src/chrome/content/aboutTor/aboutTor.xhtml rename to chrome/content/aboutTor/aboutTor.xhtml diff --git a/src/chrome/content/locale/non-localized.properties b/chrome/content/locale/non-localized.properties similarity index 100% rename from src/chrome/content/locale/non-localized.properties rename to chrome/content/locale/non-localized.properties diff --git a/src/chrome/content/menu-items-overlay.xul b/chrome/content/menu-items-overlay.xul similarity index 100% rename from src/chrome/content/menu-items-overlay.xul rename to chrome/content/menu-items-overlay.xul diff --git a/src/chrome/content/menu-overlay.xul b/chrome/content/menu-overlay.xul similarity index 100% rename from src/chrome/content/menu-overlay.xul rename to chrome/content/menu-overlay.xul diff --git a/src/chrome/content/preferences-mobile.js b/chrome/content/preferences-mobile.js similarity index 100% rename from src/chrome/content/preferences-mobile.js rename to chrome/content/preferences-mobile.js diff --git a/src/chrome/content/preferences.xhtml b/chrome/content/preferences.xhtml similarity index 100% rename from src/chrome/content/preferences.xhtml rename to chrome/content/preferences.xhtml diff --git a/src/chrome/content/tor-circuit-display.js b/chrome/content/tor-circuit-display.js similarity index 100% rename from src/chrome/content/tor-circuit-display.js rename to chrome/content/tor-circuit-display.js diff --git a/src/chrome/content/tor-circuit-display.xul b/chrome/content/tor-circuit-display.xul similarity index 100% rename from src/chrome/content/tor-circuit-display.xul rename to chrome/content/tor-circuit-display.xul diff --git a/src/chrome/content/torbutton-extensions.xul b/chrome/content/torbutton-extensions.xul similarity index 100% rename from src/chrome/content/torbutton-extensions.xul rename to chrome/content/torbutton-extensions.xul diff --git a/src/chrome/content/torbutton.js b/chrome/content/torbutton.js similarity index 100% rename from src/chrome/content/torbutton.js rename to chrome/content/torbutton.js diff --git a/src/chrome/content/torbutton.xul b/chrome/content/torbutton.xul similarity index 100% rename from src/chrome/content/torbutton.xul rename to chrome/content/torbutton.xul diff --git a/src/chrome/content/torbutton_util.js b/chrome/content/torbutton_util.js similarity index 100% rename from src/chrome/content/torbutton_util.js rename to chrome/content/torbutton_util.js diff --git a/src/chrome/locale/af/aboutTor.dtd b/chrome/locale/af/aboutTor.dtd similarity index 100% rename from src/chrome/locale/af/aboutTor.dtd rename to chrome/locale/af/aboutTor.dtd diff --git a/src/chrome/locale/af/brand.dtd b/chrome/locale/af/brand.dtd similarity index 100% rename from src/chrome/locale/af/brand.dtd rename to chrome/locale/af/brand.dtd diff --git a/src/chrome/locale/af/brand.properties b/chrome/locale/af/brand.properties similarity index 100% rename from src/chrome/locale/af/brand.properties rename to chrome/locale/af/brand.properties diff --git a/src/chrome/locale/af/torbutton.dtd b/chrome/locale/af/torbutton.dtd similarity index 100% rename from src/chrome/locale/af/torbutton.dtd rename to chrome/locale/af/torbutton.dtd diff --git a/src/chrome/locale/af/torbutton.properties b/chrome/locale/af/torbutton.properties similarity index 100% rename from src/chrome/locale/af/torbutton.properties rename to chrome/locale/af/torbutton.properties diff --git a/src/chrome/locale/ak/aboutTor.dtd b/chrome/locale/ak/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ak/aboutTor.dtd rename to chrome/locale/ak/aboutTor.dtd diff --git a/src/chrome/locale/ak/brand.dtd b/chrome/locale/ak/brand.dtd similarity index 100% rename from src/chrome/locale/ak/brand.dtd rename to chrome/locale/ak/brand.dtd diff --git a/src/chrome/locale/ak/brand.properties b/chrome/locale/ak/brand.properties similarity index 100% rename from src/chrome/locale/ak/brand.properties rename to chrome/locale/ak/brand.properties diff --git a/src/chrome/locale/ak/torbutton.dtd b/chrome/locale/ak/torbutton.dtd similarity index 100% rename from src/chrome/locale/ak/torbutton.dtd rename to chrome/locale/ak/torbutton.dtd diff --git a/src/chrome/locale/ak/torbutton.properties b/chrome/locale/ak/torbutton.properties similarity index 100% rename from src/chrome/locale/ak/torbutton.properties rename to chrome/locale/ak/torbutton.properties diff --git a/src/chrome/locale/am/aboutTor.dtd b/chrome/locale/am/aboutTor.dtd similarity index 100% rename from src/chrome/locale/am/aboutTor.dtd rename to chrome/locale/am/aboutTor.dtd diff --git a/src/chrome/locale/am/brand.dtd b/chrome/locale/am/brand.dtd similarity index 100% rename from src/chrome/locale/am/brand.dtd rename to chrome/locale/am/brand.dtd diff --git a/src/chrome/locale/am/brand.properties b/chrome/locale/am/brand.properties similarity index 100% rename from src/chrome/locale/am/brand.properties rename to chrome/locale/am/brand.properties diff --git a/src/chrome/locale/am/torbutton.dtd b/chrome/locale/am/torbutton.dtd similarity index 100% rename from src/chrome/locale/am/torbutton.dtd rename to chrome/locale/am/torbutton.dtd diff --git a/src/chrome/locale/am/torbutton.properties b/chrome/locale/am/torbutton.properties similarity index 100% rename from src/chrome/locale/am/torbutton.properties rename to chrome/locale/am/torbutton.properties diff --git a/src/chrome/locale/ar/aboutDialog.dtd b/chrome/locale/ar/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/ar/aboutDialog.dtd rename to chrome/locale/ar/aboutDialog.dtd diff --git a/src/chrome/locale/ar/aboutTBUpdate.dtd b/chrome/locale/ar/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/ar/aboutTBUpdate.dtd rename to chrome/locale/ar/aboutTBUpdate.dtd diff --git a/src/chrome/locale/ar/aboutTor.dtd b/chrome/locale/ar/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ar/aboutTor.dtd rename to chrome/locale/ar/aboutTor.dtd diff --git a/src/chrome/locale/ar/brand.dtd b/chrome/locale/ar/brand.dtd similarity index 100% rename from src/chrome/locale/ar/brand.dtd rename to chrome/locale/ar/brand.dtd diff --git a/src/chrome/locale/ar/brand.properties b/chrome/locale/ar/brand.properties similarity index 100% rename from src/chrome/locale/ar/brand.properties rename to chrome/locale/ar/brand.properties diff --git a/src/chrome/locale/ar/browserOnboarding.properties b/chrome/locale/ar/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/ar/browserOnboarding.properties rename to chrome/locale/ar/browserOnboarding.properties diff --git a/src/chrome/locale/ar/securityLevel.properties b/chrome/locale/ar/securityLevel.properties similarity index 100% rename from src/chrome/locale/ar/securityLevel.properties rename to chrome/locale/ar/securityLevel.properties diff --git a/src/chrome/locale/ar/torbutton.dtd b/chrome/locale/ar/torbutton.dtd similarity index 100% rename from src/chrome/locale/ar/torbutton.dtd rename to chrome/locale/ar/torbutton.dtd diff --git a/src/chrome/locale/ar/torbutton.properties b/chrome/locale/ar/torbutton.properties similarity index 100% rename from src/chrome/locale/ar/torbutton.properties rename to chrome/locale/ar/torbutton.properties diff --git a/src/chrome/locale/arn/aboutTor.dtd b/chrome/locale/arn/aboutTor.dtd similarity index 100% rename from src/chrome/locale/arn/aboutTor.dtd rename to chrome/locale/arn/aboutTor.dtd diff --git a/src/chrome/locale/arn/brand.dtd b/chrome/locale/arn/brand.dtd similarity index 100% rename from src/chrome/locale/arn/brand.dtd rename to chrome/locale/arn/brand.dtd diff --git a/src/chrome/locale/arn/brand.properties b/chrome/locale/arn/brand.properties similarity index 100% rename from src/chrome/locale/arn/brand.properties rename to chrome/locale/arn/brand.properties diff --git a/src/chrome/locale/arn/torbutton.dtd b/chrome/locale/arn/torbutton.dtd similarity index 100% rename from src/chrome/locale/arn/torbutton.dtd rename to chrome/locale/arn/torbutton.dtd diff --git a/src/chrome/locale/arn/torbutton.properties b/chrome/locale/arn/torbutton.properties similarity index 100% rename from src/chrome/locale/arn/torbutton.properties rename to chrome/locale/arn/torbutton.properties diff --git a/src/chrome/locale/ast/aboutTor.dtd b/chrome/locale/ast/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ast/aboutTor.dtd rename to chrome/locale/ast/aboutTor.dtd diff --git a/src/chrome/locale/ast/brand.dtd b/chrome/locale/ast/brand.dtd similarity index 100% rename from src/chrome/locale/ast/brand.dtd rename to chrome/locale/ast/brand.dtd diff --git a/src/chrome/locale/ast/brand.properties b/chrome/locale/ast/brand.properties similarity index 100% rename from src/chrome/locale/ast/brand.properties rename to chrome/locale/ast/brand.properties diff --git a/src/chrome/locale/ast/torbutton.dtd b/chrome/locale/ast/torbutton.dtd similarity index 100% rename from src/chrome/locale/ast/torbutton.dtd rename to chrome/locale/ast/torbutton.dtd diff --git a/src/chrome/locale/ast/torbutton.properties b/chrome/locale/ast/torbutton.properties similarity index 100% rename from src/chrome/locale/ast/torbutton.properties rename to chrome/locale/ast/torbutton.properties diff --git a/src/chrome/locale/az/aboutTor.dtd b/chrome/locale/az/aboutTor.dtd similarity index 100% rename from src/chrome/locale/az/aboutTor.dtd rename to chrome/locale/az/aboutTor.dtd diff --git a/src/chrome/locale/az/brand.dtd b/chrome/locale/az/brand.dtd similarity index 100% rename from src/chrome/locale/az/brand.dtd rename to chrome/locale/az/brand.dtd diff --git a/src/chrome/locale/az/brand.properties b/chrome/locale/az/brand.properties similarity index 100% rename from src/chrome/locale/az/brand.properties rename to chrome/locale/az/brand.properties diff --git a/src/chrome/locale/az/securityLevel.properties b/chrome/locale/az/securityLevel.properties similarity index 100% rename from src/chrome/locale/az/securityLevel.properties rename to chrome/locale/az/securityLevel.properties diff --git a/src/chrome/locale/az/torbutton.dtd b/chrome/locale/az/torbutton.dtd similarity index 100% rename from src/chrome/locale/az/torbutton.dtd rename to chrome/locale/az/torbutton.dtd diff --git a/src/chrome/locale/az/torbutton.properties b/chrome/locale/az/torbutton.properties similarity index 100% rename from src/chrome/locale/az/torbutton.properties rename to chrome/locale/az/torbutton.properties diff --git a/src/chrome/locale/be/aboutTor.dtd b/chrome/locale/be/aboutTor.dtd similarity index 100% rename from src/chrome/locale/be/aboutTor.dtd rename to chrome/locale/be/aboutTor.dtd diff --git a/src/chrome/locale/be/brand.dtd b/chrome/locale/be/brand.dtd similarity index 100% rename from src/chrome/locale/be/brand.dtd rename to chrome/locale/be/brand.dtd diff --git a/src/chrome/locale/be/brand.properties b/chrome/locale/be/brand.properties similarity index 100% rename from src/chrome/locale/be/brand.properties rename to chrome/locale/be/brand.properties diff --git a/src/chrome/locale/be/torbutton.dtd b/chrome/locale/be/torbutton.dtd similarity index 100% rename from src/chrome/locale/be/torbutton.dtd rename to chrome/locale/be/torbutton.dtd diff --git a/src/chrome/locale/be/torbutton.properties b/chrome/locale/be/torbutton.properties similarity index 100% rename from src/chrome/locale/be/torbutton.properties rename to chrome/locale/be/torbutton.properties diff --git a/src/chrome/locale/bg/aboutTor.dtd b/chrome/locale/bg/aboutTor.dtd similarity index 100% rename from src/chrome/locale/bg/aboutTor.dtd rename to chrome/locale/bg/aboutTor.dtd diff --git a/src/chrome/locale/bg/brand.dtd b/chrome/locale/bg/brand.dtd similarity index 100% rename from src/chrome/locale/bg/brand.dtd rename to chrome/locale/bg/brand.dtd diff --git a/src/chrome/locale/bg/brand.properties b/chrome/locale/bg/brand.properties similarity index 100% rename from src/chrome/locale/bg/brand.properties rename to chrome/locale/bg/brand.properties diff --git a/src/chrome/locale/bg/securityLevel.properties b/chrome/locale/bg/securityLevel.properties similarity index 100% rename from src/chrome/locale/bg/securityLevel.properties rename to chrome/locale/bg/securityLevel.properties diff --git a/src/chrome/locale/bg/torbutton.dtd b/chrome/locale/bg/torbutton.dtd similarity index 100% rename from src/chrome/locale/bg/torbutton.dtd rename to chrome/locale/bg/torbutton.dtd diff --git a/src/chrome/locale/bg/torbutton.properties b/chrome/locale/bg/torbutton.properties similarity index 100% rename from src/chrome/locale/bg/torbutton.properties rename to chrome/locale/bg/torbutton.properties diff --git a/src/chrome/locale/bms/aboutTor.dtd b/chrome/locale/bms/aboutTor.dtd similarity index 100% rename from src/chrome/locale/bms/aboutTor.dtd rename to chrome/locale/bms/aboutTor.dtd diff --git a/src/chrome/locale/bms/securityLevel.properties b/chrome/locale/bms/securityLevel.properties similarity index 100% rename from src/chrome/locale/bms/securityLevel.properties rename to chrome/locale/bms/securityLevel.properties diff --git a/src/chrome/locale/bms/torbutton.dtd b/chrome/locale/bms/torbutton.dtd similarity index 100% rename from src/chrome/locale/bms/torbutton.dtd rename to chrome/locale/bms/torbutton.dtd diff --git a/src/chrome/locale/bms/torbutton.properties b/chrome/locale/bms/torbutton.properties similarity index 100% rename from src/chrome/locale/bms/torbutton.properties rename to chrome/locale/bms/torbutton.properties diff --git a/src/chrome/locale/bn-BD/aboutDialog.dtd b/chrome/locale/bn-BD/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/bn-BD/aboutDialog.dtd rename to chrome/locale/bn-BD/aboutDialog.dtd diff --git a/src/chrome/locale/bn-BD/aboutTBUpdate.dtd b/chrome/locale/bn-BD/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/bn-BD/aboutTBUpdate.dtd rename to chrome/locale/bn-BD/aboutTBUpdate.dtd diff --git a/src/chrome/locale/bn-BD/aboutTor.dtd b/chrome/locale/bn-BD/aboutTor.dtd similarity index 100% rename from src/chrome/locale/bn-BD/aboutTor.dtd rename to chrome/locale/bn-BD/aboutTor.dtd diff --git a/src/chrome/locale/bn-BD/brand.dtd b/chrome/locale/bn-BD/brand.dtd similarity index 100% rename from src/chrome/locale/bn-BD/brand.dtd rename to chrome/locale/bn-BD/brand.dtd diff --git a/src/chrome/locale/bn-BD/brand.properties b/chrome/locale/bn-BD/brand.properties similarity index 100% rename from src/chrome/locale/bn-BD/brand.properties rename to chrome/locale/bn-BD/brand.properties diff --git a/src/chrome/locale/bn-BD/browserOnboarding.properties b/chrome/locale/bn-BD/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/bn-BD/browserOnboarding.properties rename to chrome/locale/bn-BD/browserOnboarding.properties diff --git a/src/chrome/locale/bn-BD/securityLevel.properties b/chrome/locale/bn-BD/securityLevel.properties similarity index 100% rename from src/chrome/locale/bn-BD/securityLevel.properties rename to chrome/locale/bn-BD/securityLevel.properties diff --git a/src/chrome/locale/bn-BD/torbutton.dtd b/chrome/locale/bn-BD/torbutton.dtd similarity index 100% rename from src/chrome/locale/bn-BD/torbutton.dtd rename to chrome/locale/bn-BD/torbutton.dtd diff --git a/src/chrome/locale/bn-BD/torbutton.properties b/chrome/locale/bn-BD/torbutton.properties similarity index 100% rename from src/chrome/locale/bn-BD/torbutton.properties rename to chrome/locale/bn-BD/torbutton.properties diff --git a/src/chrome/locale/bn-IN/aboutTor.dtd b/chrome/locale/bn-IN/aboutTor.dtd similarity index 100% rename from src/chrome/locale/bn-IN/aboutTor.dtd rename to chrome/locale/bn-IN/aboutTor.dtd diff --git a/src/chrome/locale/bn-IN/brand.dtd b/chrome/locale/bn-IN/brand.dtd similarity index 100% rename from src/chrome/locale/bn-IN/brand.dtd rename to chrome/locale/bn-IN/brand.dtd diff --git a/src/chrome/locale/bn-IN/brand.properties b/chrome/locale/bn-IN/brand.properties similarity index 100% rename from src/chrome/locale/bn-IN/brand.properties rename to chrome/locale/bn-IN/brand.properties diff --git a/src/chrome/locale/bn-IN/torbutton.dtd b/chrome/locale/bn-IN/torbutton.dtd similarity index 100% rename from src/chrome/locale/bn-IN/torbutton.dtd rename to chrome/locale/bn-IN/torbutton.dtd diff --git a/src/chrome/locale/bn-IN/torbutton.properties b/chrome/locale/bn-IN/torbutton.properties similarity index 100% rename from src/chrome/locale/bn-IN/torbutton.properties rename to chrome/locale/bn-IN/torbutton.properties diff --git a/src/chrome/locale/bn/aboutTor.dtd b/chrome/locale/bn/aboutTor.dtd similarity index 100% rename from src/chrome/locale/bn/aboutTor.dtd rename to chrome/locale/bn/aboutTor.dtd diff --git a/src/chrome/locale/bn/brand.dtd b/chrome/locale/bn/brand.dtd similarity index 100% rename from src/chrome/locale/bn/brand.dtd rename to chrome/locale/bn/brand.dtd diff --git a/src/chrome/locale/bn/brand.properties b/chrome/locale/bn/brand.properties similarity index 100% rename from src/chrome/locale/bn/brand.properties rename to chrome/locale/bn/brand.properties diff --git a/src/chrome/locale/bn/torbutton.dtd b/chrome/locale/bn/torbutton.dtd similarity index 100% rename from src/chrome/locale/bn/torbutton.dtd rename to chrome/locale/bn/torbutton.dtd diff --git a/src/chrome/locale/bn/torbutton.properties b/chrome/locale/bn/torbutton.properties similarity index 100% rename from src/chrome/locale/bn/torbutton.properties rename to chrome/locale/bn/torbutton.properties diff --git a/src/chrome/locale/bo/aboutTor.dtd b/chrome/locale/bo/aboutTor.dtd similarity index 100% rename from src/chrome/locale/bo/aboutTor.dtd rename to chrome/locale/bo/aboutTor.dtd diff --git a/src/chrome/locale/bo/brand.dtd b/chrome/locale/bo/brand.dtd similarity index 100% rename from src/chrome/locale/bo/brand.dtd rename to chrome/locale/bo/brand.dtd diff --git a/src/chrome/locale/bo/brand.properties b/chrome/locale/bo/brand.properties similarity index 100% rename from src/chrome/locale/bo/brand.properties rename to chrome/locale/bo/brand.properties diff --git a/src/chrome/locale/bo/torbutton.dtd b/chrome/locale/bo/torbutton.dtd similarity index 100% rename from src/chrome/locale/bo/torbutton.dtd rename to chrome/locale/bo/torbutton.dtd diff --git a/src/chrome/locale/bo/torbutton.properties b/chrome/locale/bo/torbutton.properties similarity index 100% rename from src/chrome/locale/bo/torbutton.properties rename to chrome/locale/bo/torbutton.properties diff --git a/src/chrome/locale/br/aboutTor.dtd b/chrome/locale/br/aboutTor.dtd similarity index 100% rename from src/chrome/locale/br/aboutTor.dtd rename to chrome/locale/br/aboutTor.dtd diff --git a/src/chrome/locale/br/brand.dtd b/chrome/locale/br/brand.dtd similarity index 100% rename from src/chrome/locale/br/brand.dtd rename to chrome/locale/br/brand.dtd diff --git a/src/chrome/locale/br/brand.properties b/chrome/locale/br/brand.properties similarity index 100% rename from src/chrome/locale/br/brand.properties rename to chrome/locale/br/brand.properties diff --git a/src/chrome/locale/br/torbutton.dtd b/chrome/locale/br/torbutton.dtd similarity index 100% rename from src/chrome/locale/br/torbutton.dtd rename to chrome/locale/br/torbutton.dtd diff --git a/src/chrome/locale/br/torbutton.properties b/chrome/locale/br/torbutton.properties similarity index 100% rename from src/chrome/locale/br/torbutton.properties rename to chrome/locale/br/torbutton.properties diff --git a/src/chrome/locale/bs/aboutTor.dtd b/chrome/locale/bs/aboutTor.dtd similarity index 100% rename from src/chrome/locale/bs/aboutTor.dtd rename to chrome/locale/bs/aboutTor.dtd diff --git a/src/chrome/locale/bs/brand.dtd b/chrome/locale/bs/brand.dtd similarity index 100% rename from src/chrome/locale/bs/brand.dtd rename to chrome/locale/bs/brand.dtd diff --git a/src/chrome/locale/bs/brand.properties b/chrome/locale/bs/brand.properties similarity index 100% rename from src/chrome/locale/bs/brand.properties rename to chrome/locale/bs/brand.properties diff --git a/src/chrome/locale/bs/securityLevel.properties b/chrome/locale/bs/securityLevel.properties similarity index 100% rename from src/chrome/locale/bs/securityLevel.properties rename to chrome/locale/bs/securityLevel.properties diff --git a/src/chrome/locale/bs/torbutton.dtd b/chrome/locale/bs/torbutton.dtd similarity index 100% rename from src/chrome/locale/bs/torbutton.dtd rename to chrome/locale/bs/torbutton.dtd diff --git a/src/chrome/locale/bs/torbutton.properties b/chrome/locale/bs/torbutton.properties similarity index 100% rename from src/chrome/locale/bs/torbutton.properties rename to chrome/locale/bs/torbutton.properties diff --git a/src/chrome/locale/ca/aboutDialog.dtd b/chrome/locale/ca/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/ca/aboutDialog.dtd rename to chrome/locale/ca/aboutDialog.dtd diff --git a/src/chrome/locale/ca/aboutTBUpdate.dtd b/chrome/locale/ca/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/ca/aboutTBUpdate.dtd rename to chrome/locale/ca/aboutTBUpdate.dtd diff --git a/src/chrome/locale/ca/aboutTor.dtd b/chrome/locale/ca/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ca/aboutTor.dtd rename to chrome/locale/ca/aboutTor.dtd diff --git a/src/chrome/locale/ca/brand.dtd b/chrome/locale/ca/brand.dtd similarity index 100% rename from src/chrome/locale/ca/brand.dtd rename to chrome/locale/ca/brand.dtd diff --git a/src/chrome/locale/ca/brand.properties b/chrome/locale/ca/brand.properties similarity index 100% rename from src/chrome/locale/ca/brand.properties rename to chrome/locale/ca/brand.properties diff --git a/src/chrome/locale/ca/browserOnboarding.properties b/chrome/locale/ca/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/ca/browserOnboarding.properties rename to chrome/locale/ca/browserOnboarding.properties diff --git a/src/chrome/locale/ca/securityLevel.properties b/chrome/locale/ca/securityLevel.properties similarity index 100% rename from src/chrome/locale/ca/securityLevel.properties rename to chrome/locale/ca/securityLevel.properties diff --git a/src/chrome/locale/ca/torbutton.dtd b/chrome/locale/ca/torbutton.dtd similarity index 100% rename from src/chrome/locale/ca/torbutton.dtd rename to chrome/locale/ca/torbutton.dtd diff --git a/src/chrome/locale/ca/torbutton.properties b/chrome/locale/ca/torbutton.properties similarity index 100% rename from src/chrome/locale/ca/torbutton.properties rename to chrome/locale/ca/torbutton.properties diff --git a/src/chrome/locale/cs/aboutDialog.dtd b/chrome/locale/cs/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/cs/aboutDialog.dtd rename to chrome/locale/cs/aboutDialog.dtd diff --git a/src/chrome/locale/cs/aboutTBUpdate.dtd b/chrome/locale/cs/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/cs/aboutTBUpdate.dtd rename to chrome/locale/cs/aboutTBUpdate.dtd diff --git a/src/chrome/locale/cs/aboutTor.dtd b/chrome/locale/cs/aboutTor.dtd similarity index 100% rename from src/chrome/locale/cs/aboutTor.dtd rename to chrome/locale/cs/aboutTor.dtd diff --git a/src/chrome/locale/cs/brand.dtd b/chrome/locale/cs/brand.dtd similarity index 100% rename from src/chrome/locale/cs/brand.dtd rename to chrome/locale/cs/brand.dtd diff --git a/src/chrome/locale/cs/brand.properties b/chrome/locale/cs/brand.properties similarity index 100% rename from src/chrome/locale/cs/brand.properties rename to chrome/locale/cs/brand.properties diff --git a/src/chrome/locale/cs/browserOnboarding.properties b/chrome/locale/cs/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/cs/browserOnboarding.properties rename to chrome/locale/cs/browserOnboarding.properties diff --git a/src/chrome/locale/cs/securityLevel.properties b/chrome/locale/cs/securityLevel.properties similarity index 100% rename from src/chrome/locale/cs/securityLevel.properties rename to chrome/locale/cs/securityLevel.properties diff --git a/src/chrome/locale/cs/torbutton.dtd b/chrome/locale/cs/torbutton.dtd similarity index 100% rename from src/chrome/locale/cs/torbutton.dtd rename to chrome/locale/cs/torbutton.dtd diff --git a/src/chrome/locale/cs/torbutton.properties b/chrome/locale/cs/torbutton.properties similarity index 100% rename from src/chrome/locale/cs/torbutton.properties rename to chrome/locale/cs/torbutton.properties diff --git a/src/chrome/locale/csb/aboutTor.dtd b/chrome/locale/csb/aboutTor.dtd similarity index 100% rename from src/chrome/locale/csb/aboutTor.dtd rename to chrome/locale/csb/aboutTor.dtd diff --git a/src/chrome/locale/csb/brand.dtd b/chrome/locale/csb/brand.dtd similarity index 100% rename from src/chrome/locale/csb/brand.dtd rename to chrome/locale/csb/brand.dtd diff --git a/src/chrome/locale/csb/brand.properties b/chrome/locale/csb/brand.properties similarity index 100% rename from src/chrome/locale/csb/brand.properties rename to chrome/locale/csb/brand.properties diff --git a/src/chrome/locale/csb/torbutton.dtd b/chrome/locale/csb/torbutton.dtd similarity index 100% rename from src/chrome/locale/csb/torbutton.dtd rename to chrome/locale/csb/torbutton.dtd diff --git a/src/chrome/locale/csb/torbutton.properties b/chrome/locale/csb/torbutton.properties similarity index 100% rename from src/chrome/locale/csb/torbutton.properties rename to chrome/locale/csb/torbutton.properties diff --git a/src/chrome/locale/cy/aboutTor.dtd b/chrome/locale/cy/aboutTor.dtd similarity index 100% rename from src/chrome/locale/cy/aboutTor.dtd rename to chrome/locale/cy/aboutTor.dtd diff --git a/src/chrome/locale/cy/brand.dtd b/chrome/locale/cy/brand.dtd similarity index 100% rename from src/chrome/locale/cy/brand.dtd rename to chrome/locale/cy/brand.dtd diff --git a/src/chrome/locale/cy/brand.properties b/chrome/locale/cy/brand.properties similarity index 100% rename from src/chrome/locale/cy/brand.properties rename to chrome/locale/cy/brand.properties diff --git a/src/chrome/locale/cy/torbutton.dtd b/chrome/locale/cy/torbutton.dtd similarity index 100% rename from src/chrome/locale/cy/torbutton.dtd rename to chrome/locale/cy/torbutton.dtd diff --git a/src/chrome/locale/cy/torbutton.properties b/chrome/locale/cy/torbutton.properties similarity index 100% rename from src/chrome/locale/cy/torbutton.properties rename to chrome/locale/cy/torbutton.properties diff --git a/src/chrome/locale/da/aboutDialog.dtd b/chrome/locale/da/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/da/aboutDialog.dtd rename to chrome/locale/da/aboutDialog.dtd diff --git a/src/chrome/locale/da/aboutTBUpdate.dtd b/chrome/locale/da/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/da/aboutTBUpdate.dtd rename to chrome/locale/da/aboutTBUpdate.dtd diff --git a/src/chrome/locale/da/aboutTor.dtd b/chrome/locale/da/aboutTor.dtd similarity index 100% rename from src/chrome/locale/da/aboutTor.dtd rename to chrome/locale/da/aboutTor.dtd diff --git a/src/chrome/locale/da/brand.dtd b/chrome/locale/da/brand.dtd similarity index 100% rename from src/chrome/locale/da/brand.dtd rename to chrome/locale/da/brand.dtd diff --git a/src/chrome/locale/da/brand.properties b/chrome/locale/da/brand.properties similarity index 100% rename from src/chrome/locale/da/brand.properties rename to chrome/locale/da/brand.properties diff --git a/src/chrome/locale/da/browserOnboarding.properties b/chrome/locale/da/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/da/browserOnboarding.properties rename to chrome/locale/da/browserOnboarding.properties diff --git a/src/chrome/locale/da/securityLevel.properties b/chrome/locale/da/securityLevel.properties similarity index 100% rename from src/chrome/locale/da/securityLevel.properties rename to chrome/locale/da/securityLevel.properties diff --git a/src/chrome/locale/da/torbutton.dtd b/chrome/locale/da/torbutton.dtd similarity index 100% rename from src/chrome/locale/da/torbutton.dtd rename to chrome/locale/da/torbutton.dtd diff --git a/src/chrome/locale/da/torbutton.properties b/chrome/locale/da/torbutton.properties similarity index 100% rename from src/chrome/locale/da/torbutton.properties rename to chrome/locale/da/torbutton.properties diff --git a/src/chrome/locale/de/aboutDialog.dtd b/chrome/locale/de/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/de/aboutDialog.dtd rename to chrome/locale/de/aboutDialog.dtd diff --git a/src/chrome/locale/de/aboutTBUpdate.dtd b/chrome/locale/de/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/de/aboutTBUpdate.dtd rename to chrome/locale/de/aboutTBUpdate.dtd diff --git a/src/chrome/locale/de/aboutTor.dtd b/chrome/locale/de/aboutTor.dtd similarity index 100% rename from src/chrome/locale/de/aboutTor.dtd rename to chrome/locale/de/aboutTor.dtd diff --git a/src/chrome/locale/de/brand.dtd b/chrome/locale/de/brand.dtd similarity index 100% rename from src/chrome/locale/de/brand.dtd rename to chrome/locale/de/brand.dtd diff --git a/src/chrome/locale/de/brand.properties b/chrome/locale/de/brand.properties similarity index 100% rename from src/chrome/locale/de/brand.properties rename to chrome/locale/de/brand.properties diff --git a/src/chrome/locale/de/browserOnboarding.properties b/chrome/locale/de/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/de/browserOnboarding.properties rename to chrome/locale/de/browserOnboarding.properties diff --git a/src/chrome/locale/de/securityLevel.properties b/chrome/locale/de/securityLevel.properties similarity index 100% rename from src/chrome/locale/de/securityLevel.properties rename to chrome/locale/de/securityLevel.properties diff --git a/src/chrome/locale/de/torbutton.dtd b/chrome/locale/de/torbutton.dtd similarity index 100% rename from src/chrome/locale/de/torbutton.dtd rename to chrome/locale/de/torbutton.dtd diff --git a/src/chrome/locale/de/torbutton.properties b/chrome/locale/de/torbutton.properties similarity index 100% rename from src/chrome/locale/de/torbutton.properties rename to chrome/locale/de/torbutton.properties diff --git a/src/chrome/locale/dz/aboutTor.dtd b/chrome/locale/dz/aboutTor.dtd similarity index 100% rename from src/chrome/locale/dz/aboutTor.dtd rename to chrome/locale/dz/aboutTor.dtd diff --git a/src/chrome/locale/dz/brand.dtd b/chrome/locale/dz/brand.dtd similarity index 100% rename from src/chrome/locale/dz/brand.dtd rename to chrome/locale/dz/brand.dtd diff --git a/src/chrome/locale/dz/brand.properties b/chrome/locale/dz/brand.properties similarity index 100% rename from src/chrome/locale/dz/brand.properties rename to chrome/locale/dz/brand.properties diff --git a/src/chrome/locale/dz/torbutton.dtd b/chrome/locale/dz/torbutton.dtd similarity index 100% rename from src/chrome/locale/dz/torbutton.dtd rename to chrome/locale/dz/torbutton.dtd diff --git a/src/chrome/locale/dz/torbutton.properties b/chrome/locale/dz/torbutton.properties similarity index 100% rename from src/chrome/locale/dz/torbutton.properties rename to chrome/locale/dz/torbutton.properties diff --git a/src/chrome/locale/el/aboutDialog.dtd b/chrome/locale/el/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/el/aboutDialog.dtd rename to chrome/locale/el/aboutDialog.dtd diff --git a/src/chrome/locale/el/aboutTBUpdate.dtd b/chrome/locale/el/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/el/aboutTBUpdate.dtd rename to chrome/locale/el/aboutTBUpdate.dtd diff --git a/src/chrome/locale/el/aboutTor.dtd b/chrome/locale/el/aboutTor.dtd similarity index 100% rename from src/chrome/locale/el/aboutTor.dtd rename to chrome/locale/el/aboutTor.dtd diff --git a/src/chrome/locale/el/brand.dtd b/chrome/locale/el/brand.dtd similarity index 100% rename from src/chrome/locale/el/brand.dtd rename to chrome/locale/el/brand.dtd diff --git a/src/chrome/locale/el/brand.properties b/chrome/locale/el/brand.properties similarity index 100% rename from src/chrome/locale/el/brand.properties rename to chrome/locale/el/brand.properties diff --git a/src/chrome/locale/el/browserOnboarding.properties b/chrome/locale/el/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/el/browserOnboarding.properties rename to chrome/locale/el/browserOnboarding.properties diff --git a/src/chrome/locale/el/securityLevel.properties b/chrome/locale/el/securityLevel.properties similarity index 100% rename from src/chrome/locale/el/securityLevel.properties rename to chrome/locale/el/securityLevel.properties diff --git a/src/chrome/locale/el/torbutton.dtd b/chrome/locale/el/torbutton.dtd similarity index 100% rename from src/chrome/locale/el/torbutton.dtd rename to chrome/locale/el/torbutton.dtd diff --git a/src/chrome/locale/el/torbutton.properties b/chrome/locale/el/torbutton.properties similarity index 100% rename from src/chrome/locale/el/torbutton.properties rename to chrome/locale/el/torbutton.properties diff --git a/src/chrome/locale/en-US/aboutDialog.dtd b/chrome/locale/en-US/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/en-US/aboutDialog.dtd rename to chrome/locale/en-US/aboutDialog.dtd diff --git a/src/chrome/locale/en-US/aboutTBUpdate.dtd b/chrome/locale/en-US/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/en-US/aboutTBUpdate.dtd rename to chrome/locale/en-US/aboutTBUpdate.dtd diff --git a/src/chrome/locale/en-US/aboutTor.dtd b/chrome/locale/en-US/aboutTor.dtd similarity index 100% rename from src/chrome/locale/en-US/aboutTor.dtd rename to chrome/locale/en-US/aboutTor.dtd diff --git a/src/chrome/locale/en-US/brand.dtd b/chrome/locale/en-US/brand.dtd similarity index 100% rename from src/chrome/locale/en-US/brand.dtd rename to chrome/locale/en-US/brand.dtd diff --git a/src/chrome/locale/en-US/brand.properties b/chrome/locale/en-US/brand.properties similarity index 100% rename from src/chrome/locale/en-US/brand.properties rename to chrome/locale/en-US/brand.properties diff --git a/src/chrome/locale/en-US/browserOnboarding.properties b/chrome/locale/en-US/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/en-US/browserOnboarding.properties rename to chrome/locale/en-US/browserOnboarding.properties diff --git a/src/chrome/locale/en-US/securityLevel.properties b/chrome/locale/en-US/securityLevel.properties similarity index 100% rename from src/chrome/locale/en-US/securityLevel.properties rename to chrome/locale/en-US/securityLevel.properties diff --git a/src/chrome/locale/en-US/torbutton.dtd b/chrome/locale/en-US/torbutton.dtd similarity index 100% rename from src/chrome/locale/en-US/torbutton.dtd rename to chrome/locale/en-US/torbutton.dtd diff --git a/src/chrome/locale/en-US/torbutton.properties b/chrome/locale/en-US/torbutton.properties similarity index 100% rename from src/chrome/locale/en-US/torbutton.properties rename to chrome/locale/en-US/torbutton.properties diff --git a/src/chrome/locale/eo/aboutTor.dtd b/chrome/locale/eo/aboutTor.dtd similarity index 100% rename from src/chrome/locale/eo/aboutTor.dtd rename to chrome/locale/eo/aboutTor.dtd diff --git a/src/chrome/locale/eo/brand.dtd b/chrome/locale/eo/brand.dtd similarity index 100% rename from src/chrome/locale/eo/brand.dtd rename to chrome/locale/eo/brand.dtd diff --git a/src/chrome/locale/eo/brand.properties b/chrome/locale/eo/brand.properties similarity index 100% rename from src/chrome/locale/eo/brand.properties rename to chrome/locale/eo/brand.properties diff --git a/src/chrome/locale/eo/securityLevel.properties b/chrome/locale/eo/securityLevel.properties similarity index 100% rename from src/chrome/locale/eo/securityLevel.properties rename to chrome/locale/eo/securityLevel.properties diff --git a/src/chrome/locale/eo/torbutton.dtd b/chrome/locale/eo/torbutton.dtd similarity index 100% rename from src/chrome/locale/eo/torbutton.dtd rename to chrome/locale/eo/torbutton.dtd diff --git a/src/chrome/locale/eo/torbutton.properties b/chrome/locale/eo/torbutton.properties similarity index 100% rename from src/chrome/locale/eo/torbutton.properties rename to chrome/locale/eo/torbutton.properties diff --git a/src/chrome/locale/es-AR/aboutDialog.dtd b/chrome/locale/es-AR/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/es-AR/aboutDialog.dtd rename to chrome/locale/es-AR/aboutDialog.dtd diff --git a/src/chrome/locale/es-AR/aboutTBUpdate.dtd b/chrome/locale/es-AR/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/es-AR/aboutTBUpdate.dtd rename to chrome/locale/es-AR/aboutTBUpdate.dtd diff --git a/src/chrome/locale/es-AR/aboutTor.dtd b/chrome/locale/es-AR/aboutTor.dtd similarity index 100% rename from src/chrome/locale/es-AR/aboutTor.dtd rename to chrome/locale/es-AR/aboutTor.dtd diff --git a/src/chrome/locale/es-AR/brand.dtd b/chrome/locale/es-AR/brand.dtd similarity index 100% rename from src/chrome/locale/es-AR/brand.dtd rename to chrome/locale/es-AR/brand.dtd diff --git a/src/chrome/locale/es-AR/brand.properties b/chrome/locale/es-AR/brand.properties similarity index 100% rename from src/chrome/locale/es-AR/brand.properties rename to chrome/locale/es-AR/brand.properties diff --git a/src/chrome/locale/es-AR/browserOnboarding.properties b/chrome/locale/es-AR/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/es-AR/browserOnboarding.properties rename to chrome/locale/es-AR/browserOnboarding.properties diff --git a/src/chrome/locale/es-AR/securityLevel.properties b/chrome/locale/es-AR/securityLevel.properties similarity index 100% rename from src/chrome/locale/es-AR/securityLevel.properties rename to chrome/locale/es-AR/securityLevel.properties diff --git a/src/chrome/locale/es-AR/torbutton.dtd b/chrome/locale/es-AR/torbutton.dtd similarity index 100% rename from src/chrome/locale/es-AR/torbutton.dtd rename to chrome/locale/es-AR/torbutton.dtd diff --git a/src/chrome/locale/es-AR/torbutton.properties b/chrome/locale/es-AR/torbutton.properties similarity index 100% rename from src/chrome/locale/es-AR/torbutton.properties rename to chrome/locale/es-AR/torbutton.properties diff --git a/src/chrome/locale/es-ES/aboutDialog.dtd b/chrome/locale/es-ES/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/es-ES/aboutDialog.dtd rename to chrome/locale/es-ES/aboutDialog.dtd diff --git a/src/chrome/locale/es-ES/aboutTBUpdate.dtd b/chrome/locale/es-ES/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/es-ES/aboutTBUpdate.dtd rename to chrome/locale/es-ES/aboutTBUpdate.dtd diff --git a/src/chrome/locale/es-ES/aboutTor.dtd b/chrome/locale/es-ES/aboutTor.dtd similarity index 100% rename from src/chrome/locale/es-ES/aboutTor.dtd rename to chrome/locale/es-ES/aboutTor.dtd diff --git a/src/chrome/locale/es-ES/brand.dtd b/chrome/locale/es-ES/brand.dtd similarity index 100% rename from src/chrome/locale/es-ES/brand.dtd rename to chrome/locale/es-ES/brand.dtd diff --git a/src/chrome/locale/es-ES/brand.properties b/chrome/locale/es-ES/brand.properties similarity index 100% rename from src/chrome/locale/es-ES/brand.properties rename to chrome/locale/es-ES/brand.properties diff --git a/src/chrome/locale/es-ES/browserOnboarding.properties b/chrome/locale/es-ES/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/es-ES/browserOnboarding.properties rename to chrome/locale/es-ES/browserOnboarding.properties diff --git a/src/chrome/locale/es-ES/securityLevel.properties b/chrome/locale/es-ES/securityLevel.properties similarity index 100% rename from src/chrome/locale/es-ES/securityLevel.properties rename to chrome/locale/es-ES/securityLevel.properties diff --git a/src/chrome/locale/es-ES/torbutton.dtd b/chrome/locale/es-ES/torbutton.dtd similarity index 100% rename from src/chrome/locale/es-ES/torbutton.dtd rename to chrome/locale/es-ES/torbutton.dtd diff --git a/src/chrome/locale/es-ES/torbutton.properties b/chrome/locale/es-ES/torbutton.properties similarity index 100% rename from src/chrome/locale/es-ES/torbutton.properties rename to chrome/locale/es-ES/torbutton.properties diff --git a/src/chrome/locale/et/aboutTor.dtd b/chrome/locale/et/aboutTor.dtd similarity index 100% rename from src/chrome/locale/et/aboutTor.dtd rename to chrome/locale/et/aboutTor.dtd diff --git a/src/chrome/locale/et/brand.dtd b/chrome/locale/et/brand.dtd similarity index 100% rename from src/chrome/locale/et/brand.dtd rename to chrome/locale/et/brand.dtd diff --git a/src/chrome/locale/et/brand.properties b/chrome/locale/et/brand.properties similarity index 100% rename from src/chrome/locale/et/brand.properties rename to chrome/locale/et/brand.properties diff --git a/src/chrome/locale/et/torbutton.dtd b/chrome/locale/et/torbutton.dtd similarity index 100% rename from src/chrome/locale/et/torbutton.dtd rename to chrome/locale/et/torbutton.dtd diff --git a/src/chrome/locale/et/torbutton.properties b/chrome/locale/et/torbutton.properties similarity index 100% rename from src/chrome/locale/et/torbutton.properties rename to chrome/locale/et/torbutton.properties diff --git a/src/chrome/locale/eu/aboutDialog.dtd b/chrome/locale/eu/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/eu/aboutDialog.dtd rename to chrome/locale/eu/aboutDialog.dtd diff --git a/src/chrome/locale/eu/aboutTBUpdate.dtd b/chrome/locale/eu/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/eu/aboutTBUpdate.dtd rename to chrome/locale/eu/aboutTBUpdate.dtd diff --git a/src/chrome/locale/eu/aboutTor.dtd b/chrome/locale/eu/aboutTor.dtd similarity index 100% rename from src/chrome/locale/eu/aboutTor.dtd rename to chrome/locale/eu/aboutTor.dtd diff --git a/src/chrome/locale/eu/brand.dtd b/chrome/locale/eu/brand.dtd similarity index 100% rename from src/chrome/locale/eu/brand.dtd rename to chrome/locale/eu/brand.dtd diff --git a/src/chrome/locale/eu/brand.properties b/chrome/locale/eu/brand.properties similarity index 100% rename from src/chrome/locale/eu/brand.properties rename to chrome/locale/eu/brand.properties diff --git a/src/chrome/locale/eu/browserOnboarding.properties b/chrome/locale/eu/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/eu/browserOnboarding.properties rename to chrome/locale/eu/browserOnboarding.properties diff --git a/src/chrome/locale/eu/securityLevel.properties b/chrome/locale/eu/securityLevel.properties similarity index 100% rename from src/chrome/locale/eu/securityLevel.properties rename to chrome/locale/eu/securityLevel.properties diff --git a/src/chrome/locale/eu/torbutton.dtd b/chrome/locale/eu/torbutton.dtd similarity index 100% rename from src/chrome/locale/eu/torbutton.dtd rename to chrome/locale/eu/torbutton.dtd diff --git a/src/chrome/locale/eu/torbutton.properties b/chrome/locale/eu/torbutton.properties similarity index 100% rename from src/chrome/locale/eu/torbutton.properties rename to chrome/locale/eu/torbutton.properties diff --git a/src/chrome/locale/fa/aboutDialog.dtd b/chrome/locale/fa/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/fa/aboutDialog.dtd rename to chrome/locale/fa/aboutDialog.dtd diff --git a/src/chrome/locale/fa/aboutTBUpdate.dtd b/chrome/locale/fa/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/fa/aboutTBUpdate.dtd rename to chrome/locale/fa/aboutTBUpdate.dtd diff --git a/src/chrome/locale/fa/aboutTor.dtd b/chrome/locale/fa/aboutTor.dtd similarity index 100% rename from src/chrome/locale/fa/aboutTor.dtd rename to chrome/locale/fa/aboutTor.dtd diff --git a/src/chrome/locale/fa/brand.dtd b/chrome/locale/fa/brand.dtd similarity index 100% rename from src/chrome/locale/fa/brand.dtd rename to chrome/locale/fa/brand.dtd diff --git a/src/chrome/locale/fa/brand.properties b/chrome/locale/fa/brand.properties similarity index 100% rename from src/chrome/locale/fa/brand.properties rename to chrome/locale/fa/brand.properties diff --git a/src/chrome/locale/fa/browserOnboarding.properties b/chrome/locale/fa/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/fa/browserOnboarding.properties rename to chrome/locale/fa/browserOnboarding.properties diff --git a/src/chrome/locale/fa/securityLevel.properties b/chrome/locale/fa/securityLevel.properties similarity index 100% rename from src/chrome/locale/fa/securityLevel.properties rename to chrome/locale/fa/securityLevel.properties diff --git a/src/chrome/locale/fa/torbutton.dtd b/chrome/locale/fa/torbutton.dtd similarity index 100% rename from src/chrome/locale/fa/torbutton.dtd rename to chrome/locale/fa/torbutton.dtd diff --git a/src/chrome/locale/fa/torbutton.properties b/chrome/locale/fa/torbutton.properties similarity index 100% rename from src/chrome/locale/fa/torbutton.properties rename to chrome/locale/fa/torbutton.properties diff --git a/src/chrome/locale/fi/aboutTor.dtd b/chrome/locale/fi/aboutTor.dtd similarity index 100% rename from src/chrome/locale/fi/aboutTor.dtd rename to chrome/locale/fi/aboutTor.dtd diff --git a/src/chrome/locale/fi/brand.dtd b/chrome/locale/fi/brand.dtd similarity index 100% rename from src/chrome/locale/fi/brand.dtd rename to chrome/locale/fi/brand.dtd diff --git a/src/chrome/locale/fi/brand.properties b/chrome/locale/fi/brand.properties similarity index 100% rename from src/chrome/locale/fi/brand.properties rename to chrome/locale/fi/brand.properties diff --git a/src/chrome/locale/fi/securityLevel.properties b/chrome/locale/fi/securityLevel.properties similarity index 100% rename from src/chrome/locale/fi/securityLevel.properties rename to chrome/locale/fi/securityLevel.properties diff --git a/src/chrome/locale/fi/torbutton.dtd b/chrome/locale/fi/torbutton.dtd similarity index 100% rename from src/chrome/locale/fi/torbutton.dtd rename to chrome/locale/fi/torbutton.dtd diff --git a/src/chrome/locale/fi/torbutton.properties b/chrome/locale/fi/torbutton.properties similarity index 100% rename from src/chrome/locale/fi/torbutton.properties rename to chrome/locale/fi/torbutton.properties diff --git a/src/chrome/locale/fil/aboutTor.dtd b/chrome/locale/fil/aboutTor.dtd similarity index 100% rename from src/chrome/locale/fil/aboutTor.dtd rename to chrome/locale/fil/aboutTor.dtd diff --git a/src/chrome/locale/fil/brand.dtd b/chrome/locale/fil/brand.dtd similarity index 100% rename from src/chrome/locale/fil/brand.dtd rename to chrome/locale/fil/brand.dtd diff --git a/src/chrome/locale/fil/brand.properties b/chrome/locale/fil/brand.properties similarity index 100% rename from src/chrome/locale/fil/brand.properties rename to chrome/locale/fil/brand.properties diff --git a/src/chrome/locale/fil/torbutton.dtd b/chrome/locale/fil/torbutton.dtd similarity index 100% rename from src/chrome/locale/fil/torbutton.dtd rename to chrome/locale/fil/torbutton.dtd diff --git a/src/chrome/locale/fil/torbutton.properties b/chrome/locale/fil/torbutton.properties similarity index 100% rename from src/chrome/locale/fil/torbutton.properties rename to chrome/locale/fil/torbutton.properties diff --git a/src/chrome/locale/fo/aboutTor.dtd b/chrome/locale/fo/aboutTor.dtd similarity index 100% rename from src/chrome/locale/fo/aboutTor.dtd rename to chrome/locale/fo/aboutTor.dtd diff --git a/src/chrome/locale/fo/brand.dtd b/chrome/locale/fo/brand.dtd similarity index 100% rename from src/chrome/locale/fo/brand.dtd rename to chrome/locale/fo/brand.dtd diff --git a/src/chrome/locale/fo/brand.properties b/chrome/locale/fo/brand.properties similarity index 100% rename from src/chrome/locale/fo/brand.properties rename to chrome/locale/fo/brand.properties diff --git a/src/chrome/locale/fo/torbutton.dtd b/chrome/locale/fo/torbutton.dtd similarity index 100% rename from src/chrome/locale/fo/torbutton.dtd rename to chrome/locale/fo/torbutton.dtd diff --git a/src/chrome/locale/fo/torbutton.properties b/chrome/locale/fo/torbutton.properties similarity index 100% rename from src/chrome/locale/fo/torbutton.properties rename to chrome/locale/fo/torbutton.properties diff --git a/src/chrome/locale/fr/aboutDialog.dtd b/chrome/locale/fr/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/fr/aboutDialog.dtd rename to chrome/locale/fr/aboutDialog.dtd diff --git a/src/chrome/locale/fr/aboutTBUpdate.dtd b/chrome/locale/fr/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/fr/aboutTBUpdate.dtd rename to chrome/locale/fr/aboutTBUpdate.dtd diff --git a/src/chrome/locale/fr/aboutTor.dtd b/chrome/locale/fr/aboutTor.dtd similarity index 100% rename from src/chrome/locale/fr/aboutTor.dtd rename to chrome/locale/fr/aboutTor.dtd diff --git a/src/chrome/locale/fr/brand.dtd b/chrome/locale/fr/brand.dtd similarity index 100% rename from src/chrome/locale/fr/brand.dtd rename to chrome/locale/fr/brand.dtd diff --git a/src/chrome/locale/fr/brand.properties b/chrome/locale/fr/brand.properties similarity index 100% rename from src/chrome/locale/fr/brand.properties rename to chrome/locale/fr/brand.properties diff --git a/src/chrome/locale/fr/browserOnboarding.properties b/chrome/locale/fr/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/fr/browserOnboarding.properties rename to chrome/locale/fr/browserOnboarding.properties diff --git a/src/chrome/locale/fr/securityLevel.properties b/chrome/locale/fr/securityLevel.properties similarity index 100% rename from src/chrome/locale/fr/securityLevel.properties rename to chrome/locale/fr/securityLevel.properties diff --git a/src/chrome/locale/fr/torbutton.dtd b/chrome/locale/fr/torbutton.dtd similarity index 100% rename from src/chrome/locale/fr/torbutton.dtd rename to chrome/locale/fr/torbutton.dtd diff --git a/src/chrome/locale/fr/torbutton.properties b/chrome/locale/fr/torbutton.properties similarity index 100% rename from src/chrome/locale/fr/torbutton.properties rename to chrome/locale/fr/torbutton.properties diff --git a/src/chrome/locale/fur/aboutTor.dtd b/chrome/locale/fur/aboutTor.dtd similarity index 100% rename from src/chrome/locale/fur/aboutTor.dtd rename to chrome/locale/fur/aboutTor.dtd diff --git a/src/chrome/locale/fur/brand.dtd b/chrome/locale/fur/brand.dtd similarity index 100% rename from src/chrome/locale/fur/brand.dtd rename to chrome/locale/fur/brand.dtd diff --git a/src/chrome/locale/fur/brand.properties b/chrome/locale/fur/brand.properties similarity index 100% rename from src/chrome/locale/fur/brand.properties rename to chrome/locale/fur/brand.properties diff --git a/src/chrome/locale/fur/torbutton.dtd b/chrome/locale/fur/torbutton.dtd similarity index 100% rename from src/chrome/locale/fur/torbutton.dtd rename to chrome/locale/fur/torbutton.dtd diff --git a/src/chrome/locale/fur/torbutton.properties b/chrome/locale/fur/torbutton.properties similarity index 100% rename from src/chrome/locale/fur/torbutton.properties rename to chrome/locale/fur/torbutton.properties diff --git a/src/chrome/locale/fy/aboutTor.dtd b/chrome/locale/fy/aboutTor.dtd similarity index 100% rename from src/chrome/locale/fy/aboutTor.dtd rename to chrome/locale/fy/aboutTor.dtd diff --git a/src/chrome/locale/fy/brand.dtd b/chrome/locale/fy/brand.dtd similarity index 100% rename from src/chrome/locale/fy/brand.dtd rename to chrome/locale/fy/brand.dtd diff --git a/src/chrome/locale/fy/brand.properties b/chrome/locale/fy/brand.properties similarity index 100% rename from src/chrome/locale/fy/brand.properties rename to chrome/locale/fy/brand.properties diff --git a/src/chrome/locale/fy/torbutton.dtd b/chrome/locale/fy/torbutton.dtd similarity index 100% rename from src/chrome/locale/fy/torbutton.dtd rename to chrome/locale/fy/torbutton.dtd diff --git a/src/chrome/locale/fy/torbutton.properties b/chrome/locale/fy/torbutton.properties similarity index 100% rename from src/chrome/locale/fy/torbutton.properties rename to chrome/locale/fy/torbutton.properties diff --git a/src/chrome/locale/ga-IE/aboutDialog.dtd b/chrome/locale/ga-IE/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/ga-IE/aboutDialog.dtd rename to chrome/locale/ga-IE/aboutDialog.dtd diff --git a/src/chrome/locale/ga-IE/aboutTBUpdate.dtd b/chrome/locale/ga-IE/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/ga-IE/aboutTBUpdate.dtd rename to chrome/locale/ga-IE/aboutTBUpdate.dtd diff --git a/src/chrome/locale/ga-IE/aboutTor.dtd b/chrome/locale/ga-IE/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ga-IE/aboutTor.dtd rename to chrome/locale/ga-IE/aboutTor.dtd diff --git a/src/chrome/locale/ga-IE/brand.dtd b/chrome/locale/ga-IE/brand.dtd similarity index 100% rename from src/chrome/locale/ga-IE/brand.dtd rename to chrome/locale/ga-IE/brand.dtd diff --git a/src/chrome/locale/ga-IE/brand.properties b/chrome/locale/ga-IE/brand.properties similarity index 100% rename from src/chrome/locale/ga-IE/brand.properties rename to chrome/locale/ga-IE/brand.properties diff --git a/src/chrome/locale/ga-IE/browserOnboarding.properties b/chrome/locale/ga-IE/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/ga-IE/browserOnboarding.properties rename to chrome/locale/ga-IE/browserOnboarding.properties diff --git a/src/chrome/locale/ga-IE/securityLevel.properties b/chrome/locale/ga-IE/securityLevel.properties similarity index 100% rename from src/chrome/locale/ga-IE/securityLevel.properties rename to chrome/locale/ga-IE/securityLevel.properties diff --git a/src/chrome/locale/ga-IE/torbutton.dtd b/chrome/locale/ga-IE/torbutton.dtd similarity index 100% rename from src/chrome/locale/ga-IE/torbutton.dtd rename to chrome/locale/ga-IE/torbutton.dtd diff --git a/src/chrome/locale/ga-IE/torbutton.properties b/chrome/locale/ga-IE/torbutton.properties similarity index 100% rename from src/chrome/locale/ga-IE/torbutton.properties rename to chrome/locale/ga-IE/torbutton.properties diff --git a/src/chrome/locale/gl/aboutTor.dtd b/chrome/locale/gl/aboutTor.dtd similarity index 100% rename from src/chrome/locale/gl/aboutTor.dtd rename to chrome/locale/gl/aboutTor.dtd diff --git a/src/chrome/locale/gl/brand.dtd b/chrome/locale/gl/brand.dtd similarity index 100% rename from src/chrome/locale/gl/brand.dtd rename to chrome/locale/gl/brand.dtd diff --git a/src/chrome/locale/gl/brand.properties b/chrome/locale/gl/brand.properties similarity index 100% rename from src/chrome/locale/gl/brand.properties rename to chrome/locale/gl/brand.properties diff --git a/src/chrome/locale/gl/securityLevel.properties b/chrome/locale/gl/securityLevel.properties similarity index 100% rename from src/chrome/locale/gl/securityLevel.properties rename to chrome/locale/gl/securityLevel.properties diff --git a/src/chrome/locale/gl/torbutton.dtd b/chrome/locale/gl/torbutton.dtd similarity index 100% rename from src/chrome/locale/gl/torbutton.dtd rename to chrome/locale/gl/torbutton.dtd diff --git a/src/chrome/locale/gl/torbutton.properties b/chrome/locale/gl/torbutton.properties similarity index 100% rename from src/chrome/locale/gl/torbutton.properties rename to chrome/locale/gl/torbutton.properties diff --git a/src/chrome/locale/gu/aboutTor.dtd b/chrome/locale/gu/aboutTor.dtd similarity index 100% rename from src/chrome/locale/gu/aboutTor.dtd rename to chrome/locale/gu/aboutTor.dtd diff --git a/src/chrome/locale/gu/brand.dtd b/chrome/locale/gu/brand.dtd similarity index 100% rename from src/chrome/locale/gu/brand.dtd rename to chrome/locale/gu/brand.dtd diff --git a/src/chrome/locale/gu/brand.properties b/chrome/locale/gu/brand.properties similarity index 100% rename from src/chrome/locale/gu/brand.properties rename to chrome/locale/gu/brand.properties diff --git a/src/chrome/locale/gu/securityLevel.properties b/chrome/locale/gu/securityLevel.properties similarity index 100% rename from src/chrome/locale/gu/securityLevel.properties rename to chrome/locale/gu/securityLevel.properties diff --git a/src/chrome/locale/gu/torbutton.dtd b/chrome/locale/gu/torbutton.dtd similarity index 100% rename from src/chrome/locale/gu/torbutton.dtd rename to chrome/locale/gu/torbutton.dtd diff --git a/src/chrome/locale/gu/torbutton.properties b/chrome/locale/gu/torbutton.properties similarity index 100% rename from src/chrome/locale/gu/torbutton.properties rename to chrome/locale/gu/torbutton.properties diff --git a/src/chrome/locale/gun/aboutTor.dtd b/chrome/locale/gun/aboutTor.dtd similarity index 100% rename from src/chrome/locale/gun/aboutTor.dtd rename to chrome/locale/gun/aboutTor.dtd diff --git a/src/chrome/locale/gun/brand.dtd b/chrome/locale/gun/brand.dtd similarity index 100% rename from src/chrome/locale/gun/brand.dtd rename to chrome/locale/gun/brand.dtd diff --git a/src/chrome/locale/gun/brand.properties b/chrome/locale/gun/brand.properties similarity index 100% rename from src/chrome/locale/gun/brand.properties rename to chrome/locale/gun/brand.properties diff --git a/src/chrome/locale/gun/torbutton.dtd b/chrome/locale/gun/torbutton.dtd similarity index 100% rename from src/chrome/locale/gun/torbutton.dtd rename to chrome/locale/gun/torbutton.dtd diff --git a/src/chrome/locale/gun/torbutton.properties b/chrome/locale/gun/torbutton.properties similarity index 100% rename from src/chrome/locale/gun/torbutton.properties rename to chrome/locale/gun/torbutton.properties diff --git a/src/chrome/locale/ha/aboutTor.dtd b/chrome/locale/ha/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ha/aboutTor.dtd rename to chrome/locale/ha/aboutTor.dtd diff --git a/src/chrome/locale/ha/brand.dtd b/chrome/locale/ha/brand.dtd similarity index 100% rename from src/chrome/locale/ha/brand.dtd rename to chrome/locale/ha/brand.dtd diff --git a/src/chrome/locale/ha/brand.properties b/chrome/locale/ha/brand.properties similarity index 100% rename from src/chrome/locale/ha/brand.properties rename to chrome/locale/ha/brand.properties diff --git a/src/chrome/locale/ha/torbutton.dtd b/chrome/locale/ha/torbutton.dtd similarity index 100% rename from src/chrome/locale/ha/torbutton.dtd rename to chrome/locale/ha/torbutton.dtd diff --git a/src/chrome/locale/ha/torbutton.properties b/chrome/locale/ha/torbutton.properties similarity index 100% rename from src/chrome/locale/ha/torbutton.properties rename to chrome/locale/ha/torbutton.properties diff --git a/src/chrome/locale/he/aboutDialog.dtd b/chrome/locale/he/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/he/aboutDialog.dtd rename to chrome/locale/he/aboutDialog.dtd diff --git a/src/chrome/locale/he/aboutTBUpdate.dtd b/chrome/locale/he/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/he/aboutTBUpdate.dtd rename to chrome/locale/he/aboutTBUpdate.dtd diff --git a/src/chrome/locale/he/aboutTor.dtd b/chrome/locale/he/aboutTor.dtd similarity index 100% rename from src/chrome/locale/he/aboutTor.dtd rename to chrome/locale/he/aboutTor.dtd diff --git a/src/chrome/locale/he/brand.dtd b/chrome/locale/he/brand.dtd similarity index 100% rename from src/chrome/locale/he/brand.dtd rename to chrome/locale/he/brand.dtd diff --git a/src/chrome/locale/he/brand.properties b/chrome/locale/he/brand.properties similarity index 100% rename from src/chrome/locale/he/brand.properties rename to chrome/locale/he/brand.properties diff --git a/src/chrome/locale/he/browserOnboarding.properties b/chrome/locale/he/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/he/browserOnboarding.properties rename to chrome/locale/he/browserOnboarding.properties diff --git a/src/chrome/locale/he/securityLevel.properties b/chrome/locale/he/securityLevel.properties similarity index 100% rename from src/chrome/locale/he/securityLevel.properties rename to chrome/locale/he/securityLevel.properties diff --git a/src/chrome/locale/he/torbutton.dtd b/chrome/locale/he/torbutton.dtd similarity index 100% rename from src/chrome/locale/he/torbutton.dtd rename to chrome/locale/he/torbutton.dtd diff --git a/src/chrome/locale/he/torbutton.properties b/chrome/locale/he/torbutton.properties similarity index 100% rename from src/chrome/locale/he/torbutton.properties rename to chrome/locale/he/torbutton.properties diff --git a/src/chrome/locale/hi/aboutTor.dtd b/chrome/locale/hi/aboutTor.dtd similarity index 100% rename from src/chrome/locale/hi/aboutTor.dtd rename to chrome/locale/hi/aboutTor.dtd diff --git a/src/chrome/locale/hi/brand.dtd b/chrome/locale/hi/brand.dtd similarity index 100% rename from src/chrome/locale/hi/brand.dtd rename to chrome/locale/hi/brand.dtd diff --git a/src/chrome/locale/hi/brand.properties b/chrome/locale/hi/brand.properties similarity index 100% rename from src/chrome/locale/hi/brand.properties rename to chrome/locale/hi/brand.properties diff --git a/src/chrome/locale/hi/torbutton.dtd b/chrome/locale/hi/torbutton.dtd similarity index 100% rename from src/chrome/locale/hi/torbutton.dtd rename to chrome/locale/hi/torbutton.dtd diff --git a/src/chrome/locale/hi/torbutton.properties b/chrome/locale/hi/torbutton.properties similarity index 100% rename from src/chrome/locale/hi/torbutton.properties rename to chrome/locale/hi/torbutton.properties diff --git a/src/chrome/locale/hr/aboutTor.dtd b/chrome/locale/hr/aboutTor.dtd similarity index 100% rename from src/chrome/locale/hr/aboutTor.dtd rename to chrome/locale/hr/aboutTor.dtd diff --git a/src/chrome/locale/hr/brand.dtd b/chrome/locale/hr/brand.dtd similarity index 100% rename from src/chrome/locale/hr/brand.dtd rename to chrome/locale/hr/brand.dtd diff --git a/src/chrome/locale/hr/brand.properties b/chrome/locale/hr/brand.properties similarity index 100% rename from src/chrome/locale/hr/brand.properties rename to chrome/locale/hr/brand.properties diff --git a/src/chrome/locale/hr/torbutton.dtd b/chrome/locale/hr/torbutton.dtd similarity index 100% rename from src/chrome/locale/hr/torbutton.dtd rename to chrome/locale/hr/torbutton.dtd diff --git a/src/chrome/locale/hr/torbutton.properties b/chrome/locale/hr/torbutton.properties similarity index 100% rename from src/chrome/locale/hr/torbutton.properties rename to chrome/locale/hr/torbutton.properties diff --git a/src/chrome/locale/ht/aboutTor.dtd b/chrome/locale/ht/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ht/aboutTor.dtd rename to chrome/locale/ht/aboutTor.dtd diff --git a/src/chrome/locale/ht/brand.dtd b/chrome/locale/ht/brand.dtd similarity index 100% rename from src/chrome/locale/ht/brand.dtd rename to chrome/locale/ht/brand.dtd diff --git a/src/chrome/locale/ht/brand.properties b/chrome/locale/ht/brand.properties similarity index 100% rename from src/chrome/locale/ht/brand.properties rename to chrome/locale/ht/brand.properties diff --git a/src/chrome/locale/ht/torbutton.dtd b/chrome/locale/ht/torbutton.dtd similarity index 100% rename from src/chrome/locale/ht/torbutton.dtd rename to chrome/locale/ht/torbutton.dtd diff --git a/src/chrome/locale/ht/torbutton.properties b/chrome/locale/ht/torbutton.properties similarity index 100% rename from src/chrome/locale/ht/torbutton.properties rename to chrome/locale/ht/torbutton.properties diff --git a/src/chrome/locale/hu/aboutDialog.dtd b/chrome/locale/hu/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/hu/aboutDialog.dtd rename to chrome/locale/hu/aboutDialog.dtd diff --git a/src/chrome/locale/hu/aboutTBUpdate.dtd b/chrome/locale/hu/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/hu/aboutTBUpdate.dtd rename to chrome/locale/hu/aboutTBUpdate.dtd diff --git a/src/chrome/locale/hu/aboutTor.dtd b/chrome/locale/hu/aboutTor.dtd similarity index 100% rename from src/chrome/locale/hu/aboutTor.dtd rename to chrome/locale/hu/aboutTor.dtd diff --git a/src/chrome/locale/hu/brand.dtd b/chrome/locale/hu/brand.dtd similarity index 100% rename from src/chrome/locale/hu/brand.dtd rename to chrome/locale/hu/brand.dtd diff --git a/src/chrome/locale/hu/brand.properties b/chrome/locale/hu/brand.properties similarity index 100% rename from src/chrome/locale/hu/brand.properties rename to chrome/locale/hu/brand.properties diff --git a/src/chrome/locale/hu/browserOnboarding.properties b/chrome/locale/hu/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/hu/browserOnboarding.properties rename to chrome/locale/hu/browserOnboarding.properties diff --git a/src/chrome/locale/hu/securityLevel.properties b/chrome/locale/hu/securityLevel.properties similarity index 100% rename from src/chrome/locale/hu/securityLevel.properties rename to chrome/locale/hu/securityLevel.properties diff --git a/src/chrome/locale/hu/torbutton.dtd b/chrome/locale/hu/torbutton.dtd similarity index 100% rename from src/chrome/locale/hu/torbutton.dtd rename to chrome/locale/hu/torbutton.dtd diff --git a/src/chrome/locale/hu/torbutton.properties b/chrome/locale/hu/torbutton.properties similarity index 100% rename from src/chrome/locale/hu/torbutton.properties rename to chrome/locale/hu/torbutton.properties diff --git a/src/chrome/locale/hy/aboutTor.dtd b/chrome/locale/hy/aboutTor.dtd similarity index 100% rename from src/chrome/locale/hy/aboutTor.dtd rename to chrome/locale/hy/aboutTor.dtd diff --git a/src/chrome/locale/hy/brand.dtd b/chrome/locale/hy/brand.dtd similarity index 100% rename from src/chrome/locale/hy/brand.dtd rename to chrome/locale/hy/brand.dtd diff --git a/src/chrome/locale/hy/brand.properties b/chrome/locale/hy/brand.properties similarity index 100% rename from src/chrome/locale/hy/brand.properties rename to chrome/locale/hy/brand.properties diff --git a/src/chrome/locale/hy/torbutton.dtd b/chrome/locale/hy/torbutton.dtd similarity index 100% rename from src/chrome/locale/hy/torbutton.dtd rename to chrome/locale/hy/torbutton.dtd diff --git a/src/chrome/locale/hy/torbutton.properties b/chrome/locale/hy/torbutton.properties similarity index 100% rename from src/chrome/locale/hy/torbutton.properties rename to chrome/locale/hy/torbutton.properties diff --git a/src/chrome/locale/id/aboutDialog.dtd b/chrome/locale/id/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/id/aboutDialog.dtd rename to chrome/locale/id/aboutDialog.dtd diff --git a/src/chrome/locale/id/aboutTBUpdate.dtd b/chrome/locale/id/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/id/aboutTBUpdate.dtd rename to chrome/locale/id/aboutTBUpdate.dtd diff --git a/src/chrome/locale/id/aboutTor.dtd b/chrome/locale/id/aboutTor.dtd similarity index 100% rename from src/chrome/locale/id/aboutTor.dtd rename to chrome/locale/id/aboutTor.dtd diff --git a/src/chrome/locale/id/brand.dtd b/chrome/locale/id/brand.dtd similarity index 100% rename from src/chrome/locale/id/brand.dtd rename to chrome/locale/id/brand.dtd diff --git a/src/chrome/locale/id/brand.properties b/chrome/locale/id/brand.properties similarity index 100% rename from src/chrome/locale/id/brand.properties rename to chrome/locale/id/brand.properties diff --git a/src/chrome/locale/id/browserOnboarding.properties b/chrome/locale/id/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/id/browserOnboarding.properties rename to chrome/locale/id/browserOnboarding.properties diff --git a/src/chrome/locale/id/securityLevel.properties b/chrome/locale/id/securityLevel.properties similarity index 100% rename from src/chrome/locale/id/securityLevel.properties rename to chrome/locale/id/securityLevel.properties diff --git a/src/chrome/locale/id/torbutton.dtd b/chrome/locale/id/torbutton.dtd similarity index 100% rename from src/chrome/locale/id/torbutton.dtd rename to chrome/locale/id/torbutton.dtd diff --git a/src/chrome/locale/id/torbutton.properties b/chrome/locale/id/torbutton.properties similarity index 100% rename from src/chrome/locale/id/torbutton.properties rename to chrome/locale/id/torbutton.properties diff --git a/src/chrome/locale/is/aboutDialog.dtd b/chrome/locale/is/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/is/aboutDialog.dtd rename to chrome/locale/is/aboutDialog.dtd diff --git a/src/chrome/locale/is/aboutTBUpdate.dtd b/chrome/locale/is/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/is/aboutTBUpdate.dtd rename to chrome/locale/is/aboutTBUpdate.dtd diff --git a/src/chrome/locale/is/aboutTor.dtd b/chrome/locale/is/aboutTor.dtd similarity index 100% rename from src/chrome/locale/is/aboutTor.dtd rename to chrome/locale/is/aboutTor.dtd diff --git a/src/chrome/locale/is/brand.dtd b/chrome/locale/is/brand.dtd similarity index 100% rename from src/chrome/locale/is/brand.dtd rename to chrome/locale/is/brand.dtd diff --git a/src/chrome/locale/is/brand.properties b/chrome/locale/is/brand.properties similarity index 100% rename from src/chrome/locale/is/brand.properties rename to chrome/locale/is/brand.properties diff --git a/src/chrome/locale/is/browserOnboarding.properties b/chrome/locale/is/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/is/browserOnboarding.properties rename to chrome/locale/is/browserOnboarding.properties diff --git a/src/chrome/locale/is/securityLevel.properties b/chrome/locale/is/securityLevel.properties similarity index 100% rename from src/chrome/locale/is/securityLevel.properties rename to chrome/locale/is/securityLevel.properties diff --git a/src/chrome/locale/is/torbutton.dtd b/chrome/locale/is/torbutton.dtd similarity index 100% rename from src/chrome/locale/is/torbutton.dtd rename to chrome/locale/is/torbutton.dtd diff --git a/src/chrome/locale/is/torbutton.properties b/chrome/locale/is/torbutton.properties similarity index 100% rename from src/chrome/locale/is/torbutton.properties rename to chrome/locale/is/torbutton.properties diff --git a/src/chrome/locale/it/aboutDialog.dtd b/chrome/locale/it/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/it/aboutDialog.dtd rename to chrome/locale/it/aboutDialog.dtd diff --git a/src/chrome/locale/it/aboutTBUpdate.dtd b/chrome/locale/it/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/it/aboutTBUpdate.dtd rename to chrome/locale/it/aboutTBUpdate.dtd diff --git a/src/chrome/locale/it/aboutTor.dtd b/chrome/locale/it/aboutTor.dtd similarity index 100% rename from src/chrome/locale/it/aboutTor.dtd rename to chrome/locale/it/aboutTor.dtd diff --git a/src/chrome/locale/it/brand.dtd b/chrome/locale/it/brand.dtd similarity index 100% rename from src/chrome/locale/it/brand.dtd rename to chrome/locale/it/brand.dtd diff --git a/src/chrome/locale/it/brand.properties b/chrome/locale/it/brand.properties similarity index 100% rename from src/chrome/locale/it/brand.properties rename to chrome/locale/it/brand.properties diff --git a/src/chrome/locale/it/browserOnboarding.properties b/chrome/locale/it/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/it/browserOnboarding.properties rename to chrome/locale/it/browserOnboarding.properties diff --git a/src/chrome/locale/it/securityLevel.properties b/chrome/locale/it/securityLevel.properties similarity index 100% rename from src/chrome/locale/it/securityLevel.properties rename to chrome/locale/it/securityLevel.properties diff --git a/src/chrome/locale/it/torbutton.dtd b/chrome/locale/it/torbutton.dtd similarity index 100% rename from src/chrome/locale/it/torbutton.dtd rename to chrome/locale/it/torbutton.dtd diff --git a/src/chrome/locale/it/torbutton.properties b/chrome/locale/it/torbutton.properties similarity index 100% rename from src/chrome/locale/it/torbutton.properties rename to chrome/locale/it/torbutton.properties diff --git a/src/chrome/locale/ja/aboutDialog.dtd b/chrome/locale/ja/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/ja/aboutDialog.dtd rename to chrome/locale/ja/aboutDialog.dtd diff --git a/src/chrome/locale/ja/aboutTBUpdate.dtd b/chrome/locale/ja/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/ja/aboutTBUpdate.dtd rename to chrome/locale/ja/aboutTBUpdate.dtd diff --git a/src/chrome/locale/ja/aboutTor.dtd b/chrome/locale/ja/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ja/aboutTor.dtd rename to chrome/locale/ja/aboutTor.dtd diff --git a/src/chrome/locale/ja/brand.dtd b/chrome/locale/ja/brand.dtd similarity index 100% rename from src/chrome/locale/ja/brand.dtd rename to chrome/locale/ja/brand.dtd diff --git a/src/chrome/locale/ja/brand.properties b/chrome/locale/ja/brand.properties similarity index 100% rename from src/chrome/locale/ja/brand.properties rename to chrome/locale/ja/brand.properties diff --git a/src/chrome/locale/ja/browserOnboarding.properties b/chrome/locale/ja/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/ja/browserOnboarding.properties rename to chrome/locale/ja/browserOnboarding.properties diff --git a/src/chrome/locale/ja/securityLevel.properties b/chrome/locale/ja/securityLevel.properties similarity index 100% rename from src/chrome/locale/ja/securityLevel.properties rename to chrome/locale/ja/securityLevel.properties diff --git a/src/chrome/locale/ja/torbutton.dtd b/chrome/locale/ja/torbutton.dtd similarity index 100% rename from src/chrome/locale/ja/torbutton.dtd rename to chrome/locale/ja/torbutton.dtd diff --git a/src/chrome/locale/ja/torbutton.properties b/chrome/locale/ja/torbutton.properties similarity index 100% rename from src/chrome/locale/ja/torbutton.properties rename to chrome/locale/ja/torbutton.properties diff --git a/src/chrome/locale/jv/aboutTor.dtd b/chrome/locale/jv/aboutTor.dtd similarity index 100% rename from src/chrome/locale/jv/aboutTor.dtd rename to chrome/locale/jv/aboutTor.dtd diff --git a/src/chrome/locale/jv/brand.dtd b/chrome/locale/jv/brand.dtd similarity index 100% rename from src/chrome/locale/jv/brand.dtd rename to chrome/locale/jv/brand.dtd diff --git a/src/chrome/locale/jv/brand.properties b/chrome/locale/jv/brand.properties similarity index 100% rename from src/chrome/locale/jv/brand.properties rename to chrome/locale/jv/brand.properties diff --git a/src/chrome/locale/jv/torbutton.dtd b/chrome/locale/jv/torbutton.dtd similarity index 100% rename from src/chrome/locale/jv/torbutton.dtd rename to chrome/locale/jv/torbutton.dtd diff --git a/src/chrome/locale/jv/torbutton.properties b/chrome/locale/jv/torbutton.properties similarity index 100% rename from src/chrome/locale/jv/torbutton.properties rename to chrome/locale/jv/torbutton.properties diff --git a/src/chrome/locale/ka/aboutDialog.dtd b/chrome/locale/ka/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/ka/aboutDialog.dtd rename to chrome/locale/ka/aboutDialog.dtd diff --git a/src/chrome/locale/ka/aboutTBUpdate.dtd b/chrome/locale/ka/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/ka/aboutTBUpdate.dtd rename to chrome/locale/ka/aboutTBUpdate.dtd diff --git a/src/chrome/locale/ka/aboutTor.dtd b/chrome/locale/ka/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ka/aboutTor.dtd rename to chrome/locale/ka/aboutTor.dtd diff --git a/src/chrome/locale/ka/brand.dtd b/chrome/locale/ka/brand.dtd similarity index 100% rename from src/chrome/locale/ka/brand.dtd rename to chrome/locale/ka/brand.dtd diff --git a/src/chrome/locale/ka/brand.properties b/chrome/locale/ka/brand.properties similarity index 100% rename from src/chrome/locale/ka/brand.properties rename to chrome/locale/ka/brand.properties diff --git a/src/chrome/locale/ka/browserOnboarding.properties b/chrome/locale/ka/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/ka/browserOnboarding.properties rename to chrome/locale/ka/browserOnboarding.properties diff --git a/src/chrome/locale/ka/securityLevel.properties b/chrome/locale/ka/securityLevel.properties similarity index 100% rename from src/chrome/locale/ka/securityLevel.properties rename to chrome/locale/ka/securityLevel.properties diff --git a/src/chrome/locale/ka/torbutton.dtd b/chrome/locale/ka/torbutton.dtd similarity index 100% rename from src/chrome/locale/ka/torbutton.dtd rename to chrome/locale/ka/torbutton.dtd diff --git a/src/chrome/locale/ka/torbutton.properties b/chrome/locale/ka/torbutton.properties similarity index 100% rename from src/chrome/locale/ka/torbutton.properties rename to chrome/locale/ka/torbutton.properties diff --git a/src/chrome/locale/km/aboutTor.dtd b/chrome/locale/km/aboutTor.dtd similarity index 100% rename from src/chrome/locale/km/aboutTor.dtd rename to chrome/locale/km/aboutTor.dtd diff --git a/src/chrome/locale/km/brand.dtd b/chrome/locale/km/brand.dtd similarity index 100% rename from src/chrome/locale/km/brand.dtd rename to chrome/locale/km/brand.dtd diff --git a/src/chrome/locale/km/brand.properties b/chrome/locale/km/brand.properties similarity index 100% rename from src/chrome/locale/km/brand.properties rename to chrome/locale/km/brand.properties diff --git a/src/chrome/locale/km/torbutton.dtd b/chrome/locale/km/torbutton.dtd similarity index 100% rename from src/chrome/locale/km/torbutton.dtd rename to chrome/locale/km/torbutton.dtd diff --git a/src/chrome/locale/km/torbutton.properties b/chrome/locale/km/torbutton.properties similarity index 100% rename from src/chrome/locale/km/torbutton.properties rename to chrome/locale/km/torbutton.properties diff --git a/src/chrome/locale/kn/aboutTor.dtd b/chrome/locale/kn/aboutTor.dtd similarity index 100% rename from src/chrome/locale/kn/aboutTor.dtd rename to chrome/locale/kn/aboutTor.dtd diff --git a/src/chrome/locale/kn/brand.dtd b/chrome/locale/kn/brand.dtd similarity index 100% rename from src/chrome/locale/kn/brand.dtd rename to chrome/locale/kn/brand.dtd diff --git a/src/chrome/locale/kn/brand.properties b/chrome/locale/kn/brand.properties similarity index 100% rename from src/chrome/locale/kn/brand.properties rename to chrome/locale/kn/brand.properties diff --git a/src/chrome/locale/kn/torbutton.dtd b/chrome/locale/kn/torbutton.dtd similarity index 100% rename from src/chrome/locale/kn/torbutton.dtd rename to chrome/locale/kn/torbutton.dtd diff --git a/src/chrome/locale/kn/torbutton.properties b/chrome/locale/kn/torbutton.properties similarity index 100% rename from src/chrome/locale/kn/torbutton.properties rename to chrome/locale/kn/torbutton.properties diff --git a/src/chrome/locale/ko/aboutDialog.dtd b/chrome/locale/ko/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/ko/aboutDialog.dtd rename to chrome/locale/ko/aboutDialog.dtd diff --git a/src/chrome/locale/ko/aboutTBUpdate.dtd b/chrome/locale/ko/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/ko/aboutTBUpdate.dtd rename to chrome/locale/ko/aboutTBUpdate.dtd diff --git a/src/chrome/locale/ko/aboutTor.dtd b/chrome/locale/ko/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ko/aboutTor.dtd rename to chrome/locale/ko/aboutTor.dtd diff --git a/src/chrome/locale/ko/brand.dtd b/chrome/locale/ko/brand.dtd similarity index 100% rename from src/chrome/locale/ko/brand.dtd rename to chrome/locale/ko/brand.dtd diff --git a/src/chrome/locale/ko/brand.properties b/chrome/locale/ko/brand.properties similarity index 100% rename from src/chrome/locale/ko/brand.properties rename to chrome/locale/ko/brand.properties diff --git a/src/chrome/locale/ko/browserOnboarding.properties b/chrome/locale/ko/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/ko/browserOnboarding.properties rename to chrome/locale/ko/browserOnboarding.properties diff --git a/src/chrome/locale/ko/securityLevel.properties b/chrome/locale/ko/securityLevel.properties similarity index 100% rename from src/chrome/locale/ko/securityLevel.properties rename to chrome/locale/ko/securityLevel.properties diff --git a/src/chrome/locale/ko/torbutton.dtd b/chrome/locale/ko/torbutton.dtd similarity index 100% rename from src/chrome/locale/ko/torbutton.dtd rename to chrome/locale/ko/torbutton.dtd diff --git a/src/chrome/locale/ko/torbutton.properties b/chrome/locale/ko/torbutton.properties similarity index 100% rename from src/chrome/locale/ko/torbutton.properties rename to chrome/locale/ko/torbutton.properties diff --git a/src/chrome/locale/ku/aboutTor.dtd b/chrome/locale/ku/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ku/aboutTor.dtd rename to chrome/locale/ku/aboutTor.dtd diff --git a/src/chrome/locale/ku/brand.dtd b/chrome/locale/ku/brand.dtd similarity index 100% rename from src/chrome/locale/ku/brand.dtd rename to chrome/locale/ku/brand.dtd diff --git a/src/chrome/locale/ku/brand.properties b/chrome/locale/ku/brand.properties similarity index 100% rename from src/chrome/locale/ku/brand.properties rename to chrome/locale/ku/brand.properties diff --git a/src/chrome/locale/ku/torbutton.dtd b/chrome/locale/ku/torbutton.dtd similarity index 100% rename from src/chrome/locale/ku/torbutton.dtd rename to chrome/locale/ku/torbutton.dtd diff --git a/src/chrome/locale/ku/torbutton.properties b/chrome/locale/ku/torbutton.properties similarity index 100% rename from src/chrome/locale/ku/torbutton.properties rename to chrome/locale/ku/torbutton.properties diff --git a/src/chrome/locale/kw/aboutTor.dtd b/chrome/locale/kw/aboutTor.dtd similarity index 100% rename from src/chrome/locale/kw/aboutTor.dtd rename to chrome/locale/kw/aboutTor.dtd diff --git a/src/chrome/locale/kw/brand.dtd b/chrome/locale/kw/brand.dtd similarity index 100% rename from src/chrome/locale/kw/brand.dtd rename to chrome/locale/kw/brand.dtd diff --git a/src/chrome/locale/kw/brand.properties b/chrome/locale/kw/brand.properties similarity index 100% rename from src/chrome/locale/kw/brand.properties rename to chrome/locale/kw/brand.properties diff --git a/src/chrome/locale/kw/torbutton.dtd b/chrome/locale/kw/torbutton.dtd similarity index 100% rename from src/chrome/locale/kw/torbutton.dtd rename to chrome/locale/kw/torbutton.dtd diff --git a/src/chrome/locale/kw/torbutton.properties b/chrome/locale/kw/torbutton.properties similarity index 100% rename from src/chrome/locale/kw/torbutton.properties rename to chrome/locale/kw/torbutton.properties diff --git a/src/chrome/locale/ky/aboutTor.dtd b/chrome/locale/ky/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ky/aboutTor.dtd rename to chrome/locale/ky/aboutTor.dtd diff --git a/src/chrome/locale/ky/brand.dtd b/chrome/locale/ky/brand.dtd similarity index 100% rename from src/chrome/locale/ky/brand.dtd rename to chrome/locale/ky/brand.dtd diff --git a/src/chrome/locale/ky/brand.properties b/chrome/locale/ky/brand.properties similarity index 100% rename from src/chrome/locale/ky/brand.properties rename to chrome/locale/ky/brand.properties diff --git a/src/chrome/locale/ky/torbutton.dtd b/chrome/locale/ky/torbutton.dtd similarity index 100% rename from src/chrome/locale/ky/torbutton.dtd rename to chrome/locale/ky/torbutton.dtd diff --git a/src/chrome/locale/ky/torbutton.properties b/chrome/locale/ky/torbutton.properties similarity index 100% rename from src/chrome/locale/ky/torbutton.properties rename to chrome/locale/ky/torbutton.properties diff --git a/src/chrome/locale/lb/aboutTor.dtd b/chrome/locale/lb/aboutTor.dtd similarity index 100% rename from src/chrome/locale/lb/aboutTor.dtd rename to chrome/locale/lb/aboutTor.dtd diff --git a/src/chrome/locale/lb/brand.dtd b/chrome/locale/lb/brand.dtd similarity index 100% rename from src/chrome/locale/lb/brand.dtd rename to chrome/locale/lb/brand.dtd diff --git a/src/chrome/locale/lb/brand.properties b/chrome/locale/lb/brand.properties similarity index 100% rename from src/chrome/locale/lb/brand.properties rename to chrome/locale/lb/brand.properties diff --git a/src/chrome/locale/lb/torbutton.dtd b/chrome/locale/lb/torbutton.dtd similarity index 100% rename from src/chrome/locale/lb/torbutton.dtd rename to chrome/locale/lb/torbutton.dtd diff --git a/src/chrome/locale/lb/torbutton.properties b/chrome/locale/lb/torbutton.properties similarity index 100% rename from src/chrome/locale/lb/torbutton.properties rename to chrome/locale/lb/torbutton.properties diff --git a/src/chrome/locale/lg/aboutTor.dtd b/chrome/locale/lg/aboutTor.dtd similarity index 100% rename from src/chrome/locale/lg/aboutTor.dtd rename to chrome/locale/lg/aboutTor.dtd diff --git a/src/chrome/locale/lg/torbutton.dtd b/chrome/locale/lg/torbutton.dtd similarity index 100% rename from src/chrome/locale/lg/torbutton.dtd rename to chrome/locale/lg/torbutton.dtd diff --git a/src/chrome/locale/lg/torbutton.properties b/chrome/locale/lg/torbutton.properties similarity index 100% rename from src/chrome/locale/lg/torbutton.properties rename to chrome/locale/lg/torbutton.properties diff --git a/src/chrome/locale/ln/aboutTor.dtd b/chrome/locale/ln/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ln/aboutTor.dtd rename to chrome/locale/ln/aboutTor.dtd diff --git a/src/chrome/locale/ln/brand.dtd b/chrome/locale/ln/brand.dtd similarity index 100% rename from src/chrome/locale/ln/brand.dtd rename to chrome/locale/ln/brand.dtd diff --git a/src/chrome/locale/ln/brand.properties b/chrome/locale/ln/brand.properties similarity index 100% rename from src/chrome/locale/ln/brand.properties rename to chrome/locale/ln/brand.properties diff --git a/src/chrome/locale/ln/torbutton.dtd b/chrome/locale/ln/torbutton.dtd similarity index 100% rename from src/chrome/locale/ln/torbutton.dtd rename to chrome/locale/ln/torbutton.dtd diff --git a/src/chrome/locale/ln/torbutton.properties b/chrome/locale/ln/torbutton.properties similarity index 100% rename from src/chrome/locale/ln/torbutton.properties rename to chrome/locale/ln/torbutton.properties diff --git a/src/chrome/locale/lo/aboutTor.dtd b/chrome/locale/lo/aboutTor.dtd similarity index 100% rename from src/chrome/locale/lo/aboutTor.dtd rename to chrome/locale/lo/aboutTor.dtd diff --git a/src/chrome/locale/lo/brand.dtd b/chrome/locale/lo/brand.dtd similarity index 100% rename from src/chrome/locale/lo/brand.dtd rename to chrome/locale/lo/brand.dtd diff --git a/src/chrome/locale/lo/brand.properties b/chrome/locale/lo/brand.properties similarity index 100% rename from src/chrome/locale/lo/brand.properties rename to chrome/locale/lo/brand.properties diff --git a/src/chrome/locale/lo/torbutton.dtd b/chrome/locale/lo/torbutton.dtd similarity index 100% rename from src/chrome/locale/lo/torbutton.dtd rename to chrome/locale/lo/torbutton.dtd diff --git a/src/chrome/locale/lo/torbutton.properties b/chrome/locale/lo/torbutton.properties similarity index 100% rename from src/chrome/locale/lo/torbutton.properties rename to chrome/locale/lo/torbutton.properties diff --git a/src/chrome/locale/lt/aboutTor.dtd b/chrome/locale/lt/aboutTor.dtd similarity index 100% rename from src/chrome/locale/lt/aboutTor.dtd rename to chrome/locale/lt/aboutTor.dtd diff --git a/src/chrome/locale/lt/brand.dtd b/chrome/locale/lt/brand.dtd similarity index 100% rename from src/chrome/locale/lt/brand.dtd rename to chrome/locale/lt/brand.dtd diff --git a/src/chrome/locale/lt/brand.properties b/chrome/locale/lt/brand.properties similarity index 100% rename from src/chrome/locale/lt/brand.properties rename to chrome/locale/lt/brand.properties diff --git a/src/chrome/locale/lt/securityLevel.properties b/chrome/locale/lt/securityLevel.properties similarity index 100% rename from src/chrome/locale/lt/securityLevel.properties rename to chrome/locale/lt/securityLevel.properties diff --git a/src/chrome/locale/lt/torbutton.dtd b/chrome/locale/lt/torbutton.dtd similarity index 100% rename from src/chrome/locale/lt/torbutton.dtd rename to chrome/locale/lt/torbutton.dtd diff --git a/src/chrome/locale/lt/torbutton.properties b/chrome/locale/lt/torbutton.properties similarity index 100% rename from src/chrome/locale/lt/torbutton.properties rename to chrome/locale/lt/torbutton.properties diff --git a/src/chrome/locale/lv/aboutTor.dtd b/chrome/locale/lv/aboutTor.dtd similarity index 100% rename from src/chrome/locale/lv/aboutTor.dtd rename to chrome/locale/lv/aboutTor.dtd diff --git a/src/chrome/locale/lv/brand.dtd b/chrome/locale/lv/brand.dtd similarity index 100% rename from src/chrome/locale/lv/brand.dtd rename to chrome/locale/lv/brand.dtd diff --git a/src/chrome/locale/lv/brand.properties b/chrome/locale/lv/brand.properties similarity index 100% rename from src/chrome/locale/lv/brand.properties rename to chrome/locale/lv/brand.properties diff --git a/src/chrome/locale/lv/securityLevel.properties b/chrome/locale/lv/securityLevel.properties similarity index 100% rename from src/chrome/locale/lv/securityLevel.properties rename to chrome/locale/lv/securityLevel.properties diff --git a/src/chrome/locale/lv/torbutton.dtd b/chrome/locale/lv/torbutton.dtd similarity index 100% rename from src/chrome/locale/lv/torbutton.dtd rename to chrome/locale/lv/torbutton.dtd diff --git a/src/chrome/locale/lv/torbutton.properties b/chrome/locale/lv/torbutton.properties similarity index 100% rename from src/chrome/locale/lv/torbutton.properties rename to chrome/locale/lv/torbutton.properties diff --git a/src/chrome/locale/mg/aboutTor.dtd b/chrome/locale/mg/aboutTor.dtd similarity index 100% rename from src/chrome/locale/mg/aboutTor.dtd rename to chrome/locale/mg/aboutTor.dtd diff --git a/src/chrome/locale/mg/brand.dtd b/chrome/locale/mg/brand.dtd similarity index 100% rename from src/chrome/locale/mg/brand.dtd rename to chrome/locale/mg/brand.dtd diff --git a/src/chrome/locale/mg/brand.properties b/chrome/locale/mg/brand.properties similarity index 100% rename from src/chrome/locale/mg/brand.properties rename to chrome/locale/mg/brand.properties diff --git a/src/chrome/locale/mg/torbutton.dtd b/chrome/locale/mg/torbutton.dtd similarity index 100% rename from src/chrome/locale/mg/torbutton.dtd rename to chrome/locale/mg/torbutton.dtd diff --git a/src/chrome/locale/mg/torbutton.properties b/chrome/locale/mg/torbutton.properties similarity index 100% rename from src/chrome/locale/mg/torbutton.properties rename to chrome/locale/mg/torbutton.properties diff --git a/src/chrome/locale/mi/aboutTor.dtd b/chrome/locale/mi/aboutTor.dtd similarity index 100% rename from src/chrome/locale/mi/aboutTor.dtd rename to chrome/locale/mi/aboutTor.dtd diff --git a/src/chrome/locale/mi/brand.dtd b/chrome/locale/mi/brand.dtd similarity index 100% rename from src/chrome/locale/mi/brand.dtd rename to chrome/locale/mi/brand.dtd diff --git a/src/chrome/locale/mi/brand.properties b/chrome/locale/mi/brand.properties similarity index 100% rename from src/chrome/locale/mi/brand.properties rename to chrome/locale/mi/brand.properties diff --git a/src/chrome/locale/mi/torbutton.dtd b/chrome/locale/mi/torbutton.dtd similarity index 100% rename from src/chrome/locale/mi/torbutton.dtd rename to chrome/locale/mi/torbutton.dtd diff --git a/src/chrome/locale/mi/torbutton.properties b/chrome/locale/mi/torbutton.properties similarity index 100% rename from src/chrome/locale/mi/torbutton.properties rename to chrome/locale/mi/torbutton.properties diff --git a/src/chrome/locale/mk/aboutTor.dtd b/chrome/locale/mk/aboutTor.dtd similarity index 100% rename from src/chrome/locale/mk/aboutTor.dtd rename to chrome/locale/mk/aboutTor.dtd diff --git a/src/chrome/locale/mk/brand.dtd b/chrome/locale/mk/brand.dtd similarity index 100% rename from src/chrome/locale/mk/brand.dtd rename to chrome/locale/mk/brand.dtd diff --git a/src/chrome/locale/mk/brand.properties b/chrome/locale/mk/brand.properties similarity index 100% rename from src/chrome/locale/mk/brand.properties rename to chrome/locale/mk/brand.properties diff --git a/src/chrome/locale/mk/securityLevel.properties b/chrome/locale/mk/securityLevel.properties similarity index 100% rename from src/chrome/locale/mk/securityLevel.properties rename to chrome/locale/mk/securityLevel.properties diff --git a/src/chrome/locale/mk/torbutton.dtd b/chrome/locale/mk/torbutton.dtd similarity index 100% rename from src/chrome/locale/mk/torbutton.dtd rename to chrome/locale/mk/torbutton.dtd diff --git a/src/chrome/locale/mk/torbutton.properties b/chrome/locale/mk/torbutton.properties similarity index 100% rename from src/chrome/locale/mk/torbutton.properties rename to chrome/locale/mk/torbutton.properties diff --git a/src/chrome/locale/ml/aboutTor.dtd b/chrome/locale/ml/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ml/aboutTor.dtd rename to chrome/locale/ml/aboutTor.dtd diff --git a/src/chrome/locale/ml/brand.dtd b/chrome/locale/ml/brand.dtd similarity index 100% rename from src/chrome/locale/ml/brand.dtd rename to chrome/locale/ml/brand.dtd diff --git a/src/chrome/locale/ml/brand.properties b/chrome/locale/ml/brand.properties similarity index 100% rename from src/chrome/locale/ml/brand.properties rename to chrome/locale/ml/brand.properties diff --git a/src/chrome/locale/ml/torbutton.dtd b/chrome/locale/ml/torbutton.dtd similarity index 100% rename from src/chrome/locale/ml/torbutton.dtd rename to chrome/locale/ml/torbutton.dtd diff --git a/src/chrome/locale/ml/torbutton.properties b/chrome/locale/ml/torbutton.properties similarity index 100% rename from src/chrome/locale/ml/torbutton.properties rename to chrome/locale/ml/torbutton.properties diff --git a/src/chrome/locale/mn/aboutTor.dtd b/chrome/locale/mn/aboutTor.dtd similarity index 100% rename from src/chrome/locale/mn/aboutTor.dtd rename to chrome/locale/mn/aboutTor.dtd diff --git a/src/chrome/locale/mn/brand.dtd b/chrome/locale/mn/brand.dtd similarity index 100% rename from src/chrome/locale/mn/brand.dtd rename to chrome/locale/mn/brand.dtd diff --git a/src/chrome/locale/mn/brand.properties b/chrome/locale/mn/brand.properties similarity index 100% rename from src/chrome/locale/mn/brand.properties rename to chrome/locale/mn/brand.properties diff --git a/src/chrome/locale/mn/torbutton.dtd b/chrome/locale/mn/torbutton.dtd similarity index 100% rename from src/chrome/locale/mn/torbutton.dtd rename to chrome/locale/mn/torbutton.dtd diff --git a/src/chrome/locale/mn/torbutton.properties b/chrome/locale/mn/torbutton.properties similarity index 100% rename from src/chrome/locale/mn/torbutton.properties rename to chrome/locale/mn/torbutton.properties diff --git a/src/chrome/locale/mr/aboutTor.dtd b/chrome/locale/mr/aboutTor.dtd similarity index 100% rename from src/chrome/locale/mr/aboutTor.dtd rename to chrome/locale/mr/aboutTor.dtd diff --git a/src/chrome/locale/mr/brand.dtd b/chrome/locale/mr/brand.dtd similarity index 100% rename from src/chrome/locale/mr/brand.dtd rename to chrome/locale/mr/brand.dtd diff --git a/src/chrome/locale/mr/brand.properties b/chrome/locale/mr/brand.properties similarity index 100% rename from src/chrome/locale/mr/brand.properties rename to chrome/locale/mr/brand.properties diff --git a/src/chrome/locale/mr/torbutton.dtd b/chrome/locale/mr/torbutton.dtd similarity index 100% rename from src/chrome/locale/mr/torbutton.dtd rename to chrome/locale/mr/torbutton.dtd diff --git a/src/chrome/locale/mr/torbutton.properties b/chrome/locale/mr/torbutton.properties similarity index 100% rename from src/chrome/locale/mr/torbutton.properties rename to chrome/locale/mr/torbutton.properties diff --git a/src/chrome/locale/ms/aboutTor.dtd b/chrome/locale/ms/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ms/aboutTor.dtd rename to chrome/locale/ms/aboutTor.dtd diff --git a/src/chrome/locale/ms/brand.dtd b/chrome/locale/ms/brand.dtd similarity index 100% rename from src/chrome/locale/ms/brand.dtd rename to chrome/locale/ms/brand.dtd diff --git a/src/chrome/locale/ms/brand.properties b/chrome/locale/ms/brand.properties similarity index 100% rename from src/chrome/locale/ms/brand.properties rename to chrome/locale/ms/brand.properties diff --git a/src/chrome/locale/ms/torbutton.dtd b/chrome/locale/ms/torbutton.dtd similarity index 100% rename from src/chrome/locale/ms/torbutton.dtd rename to chrome/locale/ms/torbutton.dtd diff --git a/src/chrome/locale/ms/torbutton.properties b/chrome/locale/ms/torbutton.properties similarity index 100% rename from src/chrome/locale/ms/torbutton.properties rename to chrome/locale/ms/torbutton.properties diff --git a/src/chrome/locale/mt/aboutTor.dtd b/chrome/locale/mt/aboutTor.dtd similarity index 100% rename from src/chrome/locale/mt/aboutTor.dtd rename to chrome/locale/mt/aboutTor.dtd diff --git a/src/chrome/locale/mt/brand.dtd b/chrome/locale/mt/brand.dtd similarity index 100% rename from src/chrome/locale/mt/brand.dtd rename to chrome/locale/mt/brand.dtd diff --git a/src/chrome/locale/mt/brand.properties b/chrome/locale/mt/brand.properties similarity index 100% rename from src/chrome/locale/mt/brand.properties rename to chrome/locale/mt/brand.properties diff --git a/src/chrome/locale/mt/torbutton.dtd b/chrome/locale/mt/torbutton.dtd similarity index 100% rename from src/chrome/locale/mt/torbutton.dtd rename to chrome/locale/mt/torbutton.dtd diff --git a/src/chrome/locale/mt/torbutton.properties b/chrome/locale/mt/torbutton.properties similarity index 100% rename from src/chrome/locale/mt/torbutton.properties rename to chrome/locale/mt/torbutton.properties diff --git a/src/chrome/locale/my/aboutTor.dtd b/chrome/locale/my/aboutTor.dtd similarity index 100% rename from src/chrome/locale/my/aboutTor.dtd rename to chrome/locale/my/aboutTor.dtd diff --git a/src/chrome/locale/my/brand.dtd b/chrome/locale/my/brand.dtd similarity index 100% rename from src/chrome/locale/my/brand.dtd rename to chrome/locale/my/brand.dtd diff --git a/src/chrome/locale/my/brand.properties b/chrome/locale/my/brand.properties similarity index 100% rename from src/chrome/locale/my/brand.properties rename to chrome/locale/my/brand.properties diff --git a/src/chrome/locale/my/securityLevel.properties b/chrome/locale/my/securityLevel.properties similarity index 100% rename from src/chrome/locale/my/securityLevel.properties rename to chrome/locale/my/securityLevel.properties diff --git a/src/chrome/locale/my/torbutton.dtd b/chrome/locale/my/torbutton.dtd similarity index 100% rename from src/chrome/locale/my/torbutton.dtd rename to chrome/locale/my/torbutton.dtd diff --git a/src/chrome/locale/my/torbutton.properties b/chrome/locale/my/torbutton.properties similarity index 100% rename from src/chrome/locale/my/torbutton.properties rename to chrome/locale/my/torbutton.properties diff --git a/src/chrome/locale/nah/aboutTor.dtd b/chrome/locale/nah/aboutTor.dtd similarity index 100% rename from src/chrome/locale/nah/aboutTor.dtd rename to chrome/locale/nah/aboutTor.dtd diff --git a/src/chrome/locale/nah/brand.dtd b/chrome/locale/nah/brand.dtd similarity index 100% rename from src/chrome/locale/nah/brand.dtd rename to chrome/locale/nah/brand.dtd diff --git a/src/chrome/locale/nah/brand.properties b/chrome/locale/nah/brand.properties similarity index 100% rename from src/chrome/locale/nah/brand.properties rename to chrome/locale/nah/brand.properties diff --git a/src/chrome/locale/nah/torbutton.dtd b/chrome/locale/nah/torbutton.dtd similarity index 100% rename from src/chrome/locale/nah/torbutton.dtd rename to chrome/locale/nah/torbutton.dtd diff --git a/src/chrome/locale/nah/torbutton.properties b/chrome/locale/nah/torbutton.properties similarity index 100% rename from src/chrome/locale/nah/torbutton.properties rename to chrome/locale/nah/torbutton.properties diff --git a/src/chrome/locale/nap/aboutTor.dtd b/chrome/locale/nap/aboutTor.dtd similarity index 100% rename from src/chrome/locale/nap/aboutTor.dtd rename to chrome/locale/nap/aboutTor.dtd diff --git a/src/chrome/locale/nap/brand.dtd b/chrome/locale/nap/brand.dtd similarity index 100% rename from src/chrome/locale/nap/brand.dtd rename to chrome/locale/nap/brand.dtd diff --git a/src/chrome/locale/nap/brand.properties b/chrome/locale/nap/brand.properties similarity index 100% rename from src/chrome/locale/nap/brand.properties rename to chrome/locale/nap/brand.properties diff --git a/src/chrome/locale/nap/torbutton.dtd b/chrome/locale/nap/torbutton.dtd similarity index 100% rename from src/chrome/locale/nap/torbutton.dtd rename to chrome/locale/nap/torbutton.dtd diff --git a/src/chrome/locale/nap/torbutton.properties b/chrome/locale/nap/torbutton.properties similarity index 100% rename from src/chrome/locale/nap/torbutton.properties rename to chrome/locale/nap/torbutton.properties diff --git a/src/chrome/locale/nb-NO/aboutDialog.dtd b/chrome/locale/nb-NO/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/nb-NO/aboutDialog.dtd rename to chrome/locale/nb-NO/aboutDialog.dtd diff --git a/src/chrome/locale/nb-NO/aboutTBUpdate.dtd b/chrome/locale/nb-NO/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/nb-NO/aboutTBUpdate.dtd rename to chrome/locale/nb-NO/aboutTBUpdate.dtd diff --git a/src/chrome/locale/nb-NO/aboutTor.dtd b/chrome/locale/nb-NO/aboutTor.dtd similarity index 100% rename from src/chrome/locale/nb-NO/aboutTor.dtd rename to chrome/locale/nb-NO/aboutTor.dtd diff --git a/src/chrome/locale/nb-NO/brand.dtd b/chrome/locale/nb-NO/brand.dtd similarity index 100% rename from src/chrome/locale/nb-NO/brand.dtd rename to chrome/locale/nb-NO/brand.dtd diff --git a/src/chrome/locale/nb-NO/brand.properties b/chrome/locale/nb-NO/brand.properties similarity index 100% rename from src/chrome/locale/nb-NO/brand.properties rename to chrome/locale/nb-NO/brand.properties diff --git a/src/chrome/locale/nb-NO/browserOnboarding.properties b/chrome/locale/nb-NO/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/nb-NO/browserOnboarding.properties rename to chrome/locale/nb-NO/browserOnboarding.properties diff --git a/src/chrome/locale/nb-NO/securityLevel.properties b/chrome/locale/nb-NO/securityLevel.properties similarity index 100% rename from src/chrome/locale/nb-NO/securityLevel.properties rename to chrome/locale/nb-NO/securityLevel.properties diff --git a/src/chrome/locale/nb-NO/torbutton.dtd b/chrome/locale/nb-NO/torbutton.dtd similarity index 100% rename from src/chrome/locale/nb-NO/torbutton.dtd rename to chrome/locale/nb-NO/torbutton.dtd diff --git a/src/chrome/locale/nb-NO/torbutton.properties b/chrome/locale/nb-NO/torbutton.properties similarity index 100% rename from src/chrome/locale/nb-NO/torbutton.properties rename to chrome/locale/nb-NO/torbutton.properties diff --git a/src/chrome/locale/ne/aboutTor.dtd b/chrome/locale/ne/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ne/aboutTor.dtd rename to chrome/locale/ne/aboutTor.dtd diff --git a/src/chrome/locale/ne/brand.dtd b/chrome/locale/ne/brand.dtd similarity index 100% rename from src/chrome/locale/ne/brand.dtd rename to chrome/locale/ne/brand.dtd diff --git a/src/chrome/locale/ne/brand.properties b/chrome/locale/ne/brand.properties similarity index 100% rename from src/chrome/locale/ne/brand.properties rename to chrome/locale/ne/brand.properties diff --git a/src/chrome/locale/ne/torbutton.dtd b/chrome/locale/ne/torbutton.dtd similarity index 100% rename from src/chrome/locale/ne/torbutton.dtd rename to chrome/locale/ne/torbutton.dtd diff --git a/src/chrome/locale/ne/torbutton.properties b/chrome/locale/ne/torbutton.properties similarity index 100% rename from src/chrome/locale/ne/torbutton.properties rename to chrome/locale/ne/torbutton.properties diff --git a/src/chrome/locale/nl/aboutDialog.dtd b/chrome/locale/nl/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/nl/aboutDialog.dtd rename to chrome/locale/nl/aboutDialog.dtd diff --git a/src/chrome/locale/nl/aboutTBUpdate.dtd b/chrome/locale/nl/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/nl/aboutTBUpdate.dtd rename to chrome/locale/nl/aboutTBUpdate.dtd diff --git a/src/chrome/locale/nl/aboutTor.dtd b/chrome/locale/nl/aboutTor.dtd similarity index 100% rename from src/chrome/locale/nl/aboutTor.dtd rename to chrome/locale/nl/aboutTor.dtd diff --git a/src/chrome/locale/nl/brand.dtd b/chrome/locale/nl/brand.dtd similarity index 100% rename from src/chrome/locale/nl/brand.dtd rename to chrome/locale/nl/brand.dtd diff --git a/src/chrome/locale/nl/brand.properties b/chrome/locale/nl/brand.properties similarity index 100% rename from src/chrome/locale/nl/brand.properties rename to chrome/locale/nl/brand.properties diff --git a/src/chrome/locale/nl/browserOnboarding.properties b/chrome/locale/nl/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/nl/browserOnboarding.properties rename to chrome/locale/nl/browserOnboarding.properties diff --git a/src/chrome/locale/nl/securityLevel.properties b/chrome/locale/nl/securityLevel.properties similarity index 100% rename from src/chrome/locale/nl/securityLevel.properties rename to chrome/locale/nl/securityLevel.properties diff --git a/src/chrome/locale/nl/torbutton.dtd b/chrome/locale/nl/torbutton.dtd similarity index 100% rename from src/chrome/locale/nl/torbutton.dtd rename to chrome/locale/nl/torbutton.dtd diff --git a/src/chrome/locale/nl/torbutton.properties b/chrome/locale/nl/torbutton.properties similarity index 100% rename from src/chrome/locale/nl/torbutton.properties rename to chrome/locale/nl/torbutton.properties diff --git a/src/chrome/locale/nn/aboutTor.dtd b/chrome/locale/nn/aboutTor.dtd similarity index 100% rename from src/chrome/locale/nn/aboutTor.dtd rename to chrome/locale/nn/aboutTor.dtd diff --git a/src/chrome/locale/nn/brand.dtd b/chrome/locale/nn/brand.dtd similarity index 100% rename from src/chrome/locale/nn/brand.dtd rename to chrome/locale/nn/brand.dtd diff --git a/src/chrome/locale/nn/brand.properties b/chrome/locale/nn/brand.properties similarity index 100% rename from src/chrome/locale/nn/brand.properties rename to chrome/locale/nn/brand.properties diff --git a/src/chrome/locale/nn/torbutton.dtd b/chrome/locale/nn/torbutton.dtd similarity index 100% rename from src/chrome/locale/nn/torbutton.dtd rename to chrome/locale/nn/torbutton.dtd diff --git a/src/chrome/locale/nn/torbutton.properties b/chrome/locale/nn/torbutton.properties similarity index 100% rename from src/chrome/locale/nn/torbutton.properties rename to chrome/locale/nn/torbutton.properties diff --git a/src/chrome/locale/nso/aboutTor.dtd b/chrome/locale/nso/aboutTor.dtd similarity index 100% rename from src/chrome/locale/nso/aboutTor.dtd rename to chrome/locale/nso/aboutTor.dtd diff --git a/src/chrome/locale/nso/brand.dtd b/chrome/locale/nso/brand.dtd similarity index 100% rename from src/chrome/locale/nso/brand.dtd rename to chrome/locale/nso/brand.dtd diff --git a/src/chrome/locale/nso/brand.properties b/chrome/locale/nso/brand.properties similarity index 100% rename from src/chrome/locale/nso/brand.properties rename to chrome/locale/nso/brand.properties diff --git a/src/chrome/locale/nso/torbutton.dtd b/chrome/locale/nso/torbutton.dtd similarity index 100% rename from src/chrome/locale/nso/torbutton.dtd rename to chrome/locale/nso/torbutton.dtd diff --git a/src/chrome/locale/nso/torbutton.properties b/chrome/locale/nso/torbutton.properties similarity index 100% rename from src/chrome/locale/nso/torbutton.properties rename to chrome/locale/nso/torbutton.properties diff --git a/src/chrome/locale/oc/aboutTor.dtd b/chrome/locale/oc/aboutTor.dtd similarity index 100% rename from src/chrome/locale/oc/aboutTor.dtd rename to chrome/locale/oc/aboutTor.dtd diff --git a/src/chrome/locale/oc/brand.dtd b/chrome/locale/oc/brand.dtd similarity index 100% rename from src/chrome/locale/oc/brand.dtd rename to chrome/locale/oc/brand.dtd diff --git a/src/chrome/locale/oc/brand.properties b/chrome/locale/oc/brand.properties similarity index 100% rename from src/chrome/locale/oc/brand.properties rename to chrome/locale/oc/brand.properties diff --git a/src/chrome/locale/oc/torbutton.dtd b/chrome/locale/oc/torbutton.dtd similarity index 100% rename from src/chrome/locale/oc/torbutton.dtd rename to chrome/locale/oc/torbutton.dtd diff --git a/src/chrome/locale/oc/torbutton.properties b/chrome/locale/oc/torbutton.properties similarity index 100% rename from src/chrome/locale/oc/torbutton.properties rename to chrome/locale/oc/torbutton.properties diff --git a/src/chrome/locale/or/aboutTor.dtd b/chrome/locale/or/aboutTor.dtd similarity index 100% rename from src/chrome/locale/or/aboutTor.dtd rename to chrome/locale/or/aboutTor.dtd diff --git a/src/chrome/locale/or/brand.dtd b/chrome/locale/or/brand.dtd similarity index 100% rename from src/chrome/locale/or/brand.dtd rename to chrome/locale/or/brand.dtd diff --git a/src/chrome/locale/or/brand.properties b/chrome/locale/or/brand.properties similarity index 100% rename from src/chrome/locale/or/brand.properties rename to chrome/locale/or/brand.properties diff --git a/src/chrome/locale/or/torbutton.dtd b/chrome/locale/or/torbutton.dtd similarity index 100% rename from src/chrome/locale/or/torbutton.dtd rename to chrome/locale/or/torbutton.dtd diff --git a/src/chrome/locale/or/torbutton.properties b/chrome/locale/or/torbutton.properties similarity index 100% rename from src/chrome/locale/or/torbutton.properties rename to chrome/locale/or/torbutton.properties diff --git a/src/chrome/locale/pa/aboutTor.dtd b/chrome/locale/pa/aboutTor.dtd similarity index 100% rename from src/chrome/locale/pa/aboutTor.dtd rename to chrome/locale/pa/aboutTor.dtd diff --git a/src/chrome/locale/pa/brand.dtd b/chrome/locale/pa/brand.dtd similarity index 100% rename from src/chrome/locale/pa/brand.dtd rename to chrome/locale/pa/brand.dtd diff --git a/src/chrome/locale/pa/brand.properties b/chrome/locale/pa/brand.properties similarity index 100% rename from src/chrome/locale/pa/brand.properties rename to chrome/locale/pa/brand.properties diff --git a/src/chrome/locale/pa/torbutton.dtd b/chrome/locale/pa/torbutton.dtd similarity index 100% rename from src/chrome/locale/pa/torbutton.dtd rename to chrome/locale/pa/torbutton.dtd diff --git a/src/chrome/locale/pa/torbutton.properties b/chrome/locale/pa/torbutton.properties similarity index 100% rename from src/chrome/locale/pa/torbutton.properties rename to chrome/locale/pa/torbutton.properties diff --git a/src/chrome/locale/pap/aboutTor.dtd b/chrome/locale/pap/aboutTor.dtd similarity index 100% rename from src/chrome/locale/pap/aboutTor.dtd rename to chrome/locale/pap/aboutTor.dtd diff --git a/src/chrome/locale/pap/brand.dtd b/chrome/locale/pap/brand.dtd similarity index 100% rename from src/chrome/locale/pap/brand.dtd rename to chrome/locale/pap/brand.dtd diff --git a/src/chrome/locale/pap/brand.properties b/chrome/locale/pap/brand.properties similarity index 100% rename from src/chrome/locale/pap/brand.properties rename to chrome/locale/pap/brand.properties diff --git a/src/chrome/locale/pap/torbutton.dtd b/chrome/locale/pap/torbutton.dtd similarity index 100% rename from src/chrome/locale/pap/torbutton.dtd rename to chrome/locale/pap/torbutton.dtd diff --git a/src/chrome/locale/pap/torbutton.properties b/chrome/locale/pap/torbutton.properties similarity index 100% rename from src/chrome/locale/pap/torbutton.properties rename to chrome/locale/pap/torbutton.properties diff --git a/src/chrome/locale/pl/aboutDialog.dtd b/chrome/locale/pl/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/pl/aboutDialog.dtd rename to chrome/locale/pl/aboutDialog.dtd diff --git a/src/chrome/locale/pl/aboutTBUpdate.dtd b/chrome/locale/pl/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/pl/aboutTBUpdate.dtd rename to chrome/locale/pl/aboutTBUpdate.dtd diff --git a/src/chrome/locale/pl/aboutTor.dtd b/chrome/locale/pl/aboutTor.dtd similarity index 100% rename from src/chrome/locale/pl/aboutTor.dtd rename to chrome/locale/pl/aboutTor.dtd diff --git a/src/chrome/locale/pl/brand.dtd b/chrome/locale/pl/brand.dtd similarity index 100% rename from src/chrome/locale/pl/brand.dtd rename to chrome/locale/pl/brand.dtd diff --git a/src/chrome/locale/pl/brand.properties b/chrome/locale/pl/brand.properties similarity index 100% rename from src/chrome/locale/pl/brand.properties rename to chrome/locale/pl/brand.properties diff --git a/src/chrome/locale/pl/browserOnboarding.properties b/chrome/locale/pl/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/pl/browserOnboarding.properties rename to chrome/locale/pl/browserOnboarding.properties diff --git a/src/chrome/locale/pl/securityLevel.properties b/chrome/locale/pl/securityLevel.properties similarity index 100% rename from src/chrome/locale/pl/securityLevel.properties rename to chrome/locale/pl/securityLevel.properties diff --git a/src/chrome/locale/pl/torbutton.dtd b/chrome/locale/pl/torbutton.dtd similarity index 100% rename from src/chrome/locale/pl/torbutton.dtd rename to chrome/locale/pl/torbutton.dtd diff --git a/src/chrome/locale/pl/torbutton.properties b/chrome/locale/pl/torbutton.properties similarity index 100% rename from src/chrome/locale/pl/torbutton.properties rename to chrome/locale/pl/torbutton.properties diff --git a/src/chrome/locale/pms/aboutTor.dtd b/chrome/locale/pms/aboutTor.dtd similarity index 100% rename from src/chrome/locale/pms/aboutTor.dtd rename to chrome/locale/pms/aboutTor.dtd diff --git a/src/chrome/locale/pms/brand.dtd b/chrome/locale/pms/brand.dtd similarity index 100% rename from src/chrome/locale/pms/brand.dtd rename to chrome/locale/pms/brand.dtd diff --git a/src/chrome/locale/pms/brand.properties b/chrome/locale/pms/brand.properties similarity index 100% rename from src/chrome/locale/pms/brand.properties rename to chrome/locale/pms/brand.properties diff --git a/src/chrome/locale/pms/torbutton.dtd b/chrome/locale/pms/torbutton.dtd similarity index 100% rename from src/chrome/locale/pms/torbutton.dtd rename to chrome/locale/pms/torbutton.dtd diff --git a/src/chrome/locale/pms/torbutton.properties b/chrome/locale/pms/torbutton.properties similarity index 100% rename from src/chrome/locale/pms/torbutton.properties rename to chrome/locale/pms/torbutton.properties diff --git a/src/chrome/locale/ps/aboutTor.dtd b/chrome/locale/ps/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ps/aboutTor.dtd rename to chrome/locale/ps/aboutTor.dtd diff --git a/src/chrome/locale/ps/brand.dtd b/chrome/locale/ps/brand.dtd similarity index 100% rename from src/chrome/locale/ps/brand.dtd rename to chrome/locale/ps/brand.dtd diff --git a/src/chrome/locale/ps/brand.properties b/chrome/locale/ps/brand.properties similarity index 100% rename from src/chrome/locale/ps/brand.properties rename to chrome/locale/ps/brand.properties diff --git a/src/chrome/locale/ps/torbutton.dtd b/chrome/locale/ps/torbutton.dtd similarity index 100% rename from src/chrome/locale/ps/torbutton.dtd rename to chrome/locale/ps/torbutton.dtd diff --git a/src/chrome/locale/ps/torbutton.properties b/chrome/locale/ps/torbutton.properties similarity index 100% rename from src/chrome/locale/ps/torbutton.properties rename to chrome/locale/ps/torbutton.properties diff --git a/src/chrome/locale/pt-BR/aboutDialog.dtd b/chrome/locale/pt-BR/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/pt-BR/aboutDialog.dtd rename to chrome/locale/pt-BR/aboutDialog.dtd diff --git a/src/chrome/locale/pt-BR/aboutTBUpdate.dtd b/chrome/locale/pt-BR/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/pt-BR/aboutTBUpdate.dtd rename to chrome/locale/pt-BR/aboutTBUpdate.dtd diff --git a/src/chrome/locale/pt-BR/aboutTor.dtd b/chrome/locale/pt-BR/aboutTor.dtd similarity index 100% rename from src/chrome/locale/pt-BR/aboutTor.dtd rename to chrome/locale/pt-BR/aboutTor.dtd diff --git a/src/chrome/locale/pt-BR/brand.dtd b/chrome/locale/pt-BR/brand.dtd similarity index 100% rename from src/chrome/locale/pt-BR/brand.dtd rename to chrome/locale/pt-BR/brand.dtd diff --git a/src/chrome/locale/pt-BR/brand.properties b/chrome/locale/pt-BR/brand.properties similarity index 100% rename from src/chrome/locale/pt-BR/brand.properties rename to chrome/locale/pt-BR/brand.properties diff --git a/src/chrome/locale/pt-BR/browserOnboarding.properties b/chrome/locale/pt-BR/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/pt-BR/browserOnboarding.properties rename to chrome/locale/pt-BR/browserOnboarding.properties diff --git a/src/chrome/locale/pt-BR/securityLevel.properties b/chrome/locale/pt-BR/securityLevel.properties similarity index 100% rename from src/chrome/locale/pt-BR/securityLevel.properties rename to chrome/locale/pt-BR/securityLevel.properties diff --git a/src/chrome/locale/pt-BR/torbutton.dtd b/chrome/locale/pt-BR/torbutton.dtd similarity index 100% rename from src/chrome/locale/pt-BR/torbutton.dtd rename to chrome/locale/pt-BR/torbutton.dtd diff --git a/src/chrome/locale/pt-BR/torbutton.properties b/chrome/locale/pt-BR/torbutton.properties similarity index 100% rename from src/chrome/locale/pt-BR/torbutton.properties rename to chrome/locale/pt-BR/torbutton.properties diff --git a/src/chrome/locale/pt/aboutDialog.dtd b/chrome/locale/pt/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/pt/aboutDialog.dtd rename to chrome/locale/pt/aboutDialog.dtd diff --git a/src/chrome/locale/pt/aboutTBUpdate.dtd b/chrome/locale/pt/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/pt/aboutTBUpdate.dtd rename to chrome/locale/pt/aboutTBUpdate.dtd diff --git a/src/chrome/locale/pt/aboutTor.dtd b/chrome/locale/pt/aboutTor.dtd similarity index 100% rename from src/chrome/locale/pt/aboutTor.dtd rename to chrome/locale/pt/aboutTor.dtd diff --git a/src/chrome/locale/pt/brand.dtd b/chrome/locale/pt/brand.dtd similarity index 100% rename from src/chrome/locale/pt/brand.dtd rename to chrome/locale/pt/brand.dtd diff --git a/src/chrome/locale/pt/brand.properties b/chrome/locale/pt/brand.properties similarity index 100% rename from src/chrome/locale/pt/brand.properties rename to chrome/locale/pt/brand.properties diff --git a/src/chrome/locale/pt/securityLevel.properties b/chrome/locale/pt/securityLevel.properties similarity index 100% rename from src/chrome/locale/pt/securityLevel.properties rename to chrome/locale/pt/securityLevel.properties diff --git a/src/chrome/locale/pt/torbutton.dtd b/chrome/locale/pt/torbutton.dtd similarity index 100% rename from src/chrome/locale/pt/torbutton.dtd rename to chrome/locale/pt/torbutton.dtd diff --git a/src/chrome/locale/pt/torbutton.properties b/chrome/locale/pt/torbutton.properties similarity index 100% rename from src/chrome/locale/pt/torbutton.properties rename to chrome/locale/pt/torbutton.properties diff --git a/src/chrome/locale/ro/aboutTor.dtd b/chrome/locale/ro/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ro/aboutTor.dtd rename to chrome/locale/ro/aboutTor.dtd diff --git a/src/chrome/locale/ro/brand.dtd b/chrome/locale/ro/brand.dtd similarity index 100% rename from src/chrome/locale/ro/brand.dtd rename to chrome/locale/ro/brand.dtd diff --git a/src/chrome/locale/ro/brand.properties b/chrome/locale/ro/brand.properties similarity index 100% rename from src/chrome/locale/ro/brand.properties rename to chrome/locale/ro/brand.properties diff --git a/src/chrome/locale/ro/securityLevel.properties b/chrome/locale/ro/securityLevel.properties similarity index 100% rename from src/chrome/locale/ro/securityLevel.properties rename to chrome/locale/ro/securityLevel.properties diff --git a/src/chrome/locale/ro/torbutton.dtd b/chrome/locale/ro/torbutton.dtd similarity index 100% rename from src/chrome/locale/ro/torbutton.dtd rename to chrome/locale/ro/torbutton.dtd diff --git a/src/chrome/locale/ro/torbutton.properties b/chrome/locale/ro/torbutton.properties similarity index 100% rename from src/chrome/locale/ro/torbutton.properties rename to chrome/locale/ro/torbutton.properties diff --git a/src/chrome/locale/ru/aboutDialog.dtd b/chrome/locale/ru/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/ru/aboutDialog.dtd rename to chrome/locale/ru/aboutDialog.dtd diff --git a/src/chrome/locale/ru/aboutTBUpdate.dtd b/chrome/locale/ru/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/ru/aboutTBUpdate.dtd rename to chrome/locale/ru/aboutTBUpdate.dtd diff --git a/src/chrome/locale/ru/aboutTor.dtd b/chrome/locale/ru/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ru/aboutTor.dtd rename to chrome/locale/ru/aboutTor.dtd diff --git a/src/chrome/locale/ru/brand.dtd b/chrome/locale/ru/brand.dtd similarity index 100% rename from src/chrome/locale/ru/brand.dtd rename to chrome/locale/ru/brand.dtd diff --git a/src/chrome/locale/ru/brand.properties b/chrome/locale/ru/brand.properties similarity index 100% rename from src/chrome/locale/ru/brand.properties rename to chrome/locale/ru/brand.properties diff --git a/src/chrome/locale/ru/browserOnboarding.properties b/chrome/locale/ru/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/ru/browserOnboarding.properties rename to chrome/locale/ru/browserOnboarding.properties diff --git a/src/chrome/locale/ru/securityLevel.properties b/chrome/locale/ru/securityLevel.properties similarity index 100% rename from src/chrome/locale/ru/securityLevel.properties rename to chrome/locale/ru/securityLevel.properties diff --git a/src/chrome/locale/ru/torbutton.dtd b/chrome/locale/ru/torbutton.dtd similarity index 100% rename from src/chrome/locale/ru/torbutton.dtd rename to chrome/locale/ru/torbutton.dtd diff --git a/src/chrome/locale/ru/torbutton.properties b/chrome/locale/ru/torbutton.properties similarity index 100% rename from src/chrome/locale/ru/torbutton.properties rename to chrome/locale/ru/torbutton.properties diff --git a/src/chrome/locale/sco/aboutTor.dtd b/chrome/locale/sco/aboutTor.dtd similarity index 100% rename from src/chrome/locale/sco/aboutTor.dtd rename to chrome/locale/sco/aboutTor.dtd diff --git a/src/chrome/locale/sco/brand.dtd b/chrome/locale/sco/brand.dtd similarity index 100% rename from src/chrome/locale/sco/brand.dtd rename to chrome/locale/sco/brand.dtd diff --git a/src/chrome/locale/sco/brand.properties b/chrome/locale/sco/brand.properties similarity index 100% rename from src/chrome/locale/sco/brand.properties rename to chrome/locale/sco/brand.properties diff --git a/src/chrome/locale/sco/torbutton.dtd b/chrome/locale/sco/torbutton.dtd similarity index 100% rename from src/chrome/locale/sco/torbutton.dtd rename to chrome/locale/sco/torbutton.dtd diff --git a/src/chrome/locale/sco/torbutton.properties b/chrome/locale/sco/torbutton.properties similarity index 100% rename from src/chrome/locale/sco/torbutton.properties rename to chrome/locale/sco/torbutton.properties diff --git a/src/chrome/locale/sk/aboutTor.dtd b/chrome/locale/sk/aboutTor.dtd similarity index 100% rename from src/chrome/locale/sk/aboutTor.dtd rename to chrome/locale/sk/aboutTor.dtd diff --git a/src/chrome/locale/sk/brand.dtd b/chrome/locale/sk/brand.dtd similarity index 100% rename from src/chrome/locale/sk/brand.dtd rename to chrome/locale/sk/brand.dtd diff --git a/src/chrome/locale/sk/brand.properties b/chrome/locale/sk/brand.properties similarity index 100% rename from src/chrome/locale/sk/brand.properties rename to chrome/locale/sk/brand.properties diff --git a/src/chrome/locale/sk/securityLevel.properties b/chrome/locale/sk/securityLevel.properties similarity index 100% rename from src/chrome/locale/sk/securityLevel.properties rename to chrome/locale/sk/securityLevel.properties diff --git a/src/chrome/locale/sk/torbutton.dtd b/chrome/locale/sk/torbutton.dtd similarity index 100% rename from src/chrome/locale/sk/torbutton.dtd rename to chrome/locale/sk/torbutton.dtd diff --git a/src/chrome/locale/sk/torbutton.properties b/chrome/locale/sk/torbutton.properties similarity index 100% rename from src/chrome/locale/sk/torbutton.properties rename to chrome/locale/sk/torbutton.properties diff --git a/src/chrome/locale/sl/aboutTor.dtd b/chrome/locale/sl/aboutTor.dtd similarity index 100% rename from src/chrome/locale/sl/aboutTor.dtd rename to chrome/locale/sl/aboutTor.dtd diff --git a/src/chrome/locale/sl/brand.dtd b/chrome/locale/sl/brand.dtd similarity index 100% rename from src/chrome/locale/sl/brand.dtd rename to chrome/locale/sl/brand.dtd diff --git a/src/chrome/locale/sl/brand.properties b/chrome/locale/sl/brand.properties similarity index 100% rename from src/chrome/locale/sl/brand.properties rename to chrome/locale/sl/brand.properties diff --git a/src/chrome/locale/sl/securityLevel.properties b/chrome/locale/sl/securityLevel.properties similarity index 100% rename from src/chrome/locale/sl/securityLevel.properties rename to chrome/locale/sl/securityLevel.properties diff --git a/src/chrome/locale/sl/torbutton.dtd b/chrome/locale/sl/torbutton.dtd similarity index 100% rename from src/chrome/locale/sl/torbutton.dtd rename to chrome/locale/sl/torbutton.dtd diff --git a/src/chrome/locale/sl/torbutton.properties b/chrome/locale/sl/torbutton.properties similarity index 100% rename from src/chrome/locale/sl/torbutton.properties rename to chrome/locale/sl/torbutton.properties diff --git a/src/chrome/locale/so/aboutTor.dtd b/chrome/locale/so/aboutTor.dtd similarity index 100% rename from src/chrome/locale/so/aboutTor.dtd rename to chrome/locale/so/aboutTor.dtd diff --git a/src/chrome/locale/so/brand.dtd b/chrome/locale/so/brand.dtd similarity index 100% rename from src/chrome/locale/so/brand.dtd rename to chrome/locale/so/brand.dtd diff --git a/src/chrome/locale/so/brand.properties b/chrome/locale/so/brand.properties similarity index 100% rename from src/chrome/locale/so/brand.properties rename to chrome/locale/so/brand.properties diff --git a/src/chrome/locale/so/torbutton.dtd b/chrome/locale/so/torbutton.dtd similarity index 100% rename from src/chrome/locale/so/torbutton.dtd rename to chrome/locale/so/torbutton.dtd diff --git a/src/chrome/locale/so/torbutton.properties b/chrome/locale/so/torbutton.properties similarity index 100% rename from src/chrome/locale/so/torbutton.properties rename to chrome/locale/so/torbutton.properties diff --git a/src/chrome/locale/son/aboutTor.dtd b/chrome/locale/son/aboutTor.dtd similarity index 100% rename from src/chrome/locale/son/aboutTor.dtd rename to chrome/locale/son/aboutTor.dtd diff --git a/src/chrome/locale/son/brand.dtd b/chrome/locale/son/brand.dtd similarity index 100% rename from src/chrome/locale/son/brand.dtd rename to chrome/locale/son/brand.dtd diff --git a/src/chrome/locale/son/brand.properties b/chrome/locale/son/brand.properties similarity index 100% rename from src/chrome/locale/son/brand.properties rename to chrome/locale/son/brand.properties diff --git a/src/chrome/locale/son/torbutton.dtd b/chrome/locale/son/torbutton.dtd similarity index 100% rename from src/chrome/locale/son/torbutton.dtd rename to chrome/locale/son/torbutton.dtd diff --git a/src/chrome/locale/son/torbutton.properties b/chrome/locale/son/torbutton.properties similarity index 100% rename from src/chrome/locale/son/torbutton.properties rename to chrome/locale/son/torbutton.properties diff --git a/src/chrome/locale/sq/aboutTor.dtd b/chrome/locale/sq/aboutTor.dtd similarity index 100% rename from src/chrome/locale/sq/aboutTor.dtd rename to chrome/locale/sq/aboutTor.dtd diff --git a/src/chrome/locale/sq/brand.dtd b/chrome/locale/sq/brand.dtd similarity index 100% rename from src/chrome/locale/sq/brand.dtd rename to chrome/locale/sq/brand.dtd diff --git a/src/chrome/locale/sq/brand.properties b/chrome/locale/sq/brand.properties similarity index 100% rename from src/chrome/locale/sq/brand.properties rename to chrome/locale/sq/brand.properties diff --git a/src/chrome/locale/sq/torbutton.dtd b/chrome/locale/sq/torbutton.dtd similarity index 100% rename from src/chrome/locale/sq/torbutton.dtd rename to chrome/locale/sq/torbutton.dtd diff --git a/src/chrome/locale/sq/torbutton.properties b/chrome/locale/sq/torbutton.properties similarity index 100% rename from src/chrome/locale/sq/torbutton.properties rename to chrome/locale/sq/torbutton.properties diff --git a/src/chrome/locale/sr/aboutTor.dtd b/chrome/locale/sr/aboutTor.dtd similarity index 100% rename from src/chrome/locale/sr/aboutTor.dtd rename to chrome/locale/sr/aboutTor.dtd diff --git a/src/chrome/locale/sr/brand.dtd b/chrome/locale/sr/brand.dtd similarity index 100% rename from src/chrome/locale/sr/brand.dtd rename to chrome/locale/sr/brand.dtd diff --git a/src/chrome/locale/sr/brand.properties b/chrome/locale/sr/brand.properties similarity index 100% rename from src/chrome/locale/sr/brand.properties rename to chrome/locale/sr/brand.properties diff --git a/src/chrome/locale/sr/securityLevel.properties b/chrome/locale/sr/securityLevel.properties similarity index 100% rename from src/chrome/locale/sr/securityLevel.properties rename to chrome/locale/sr/securityLevel.properties diff --git a/src/chrome/locale/sr/torbutton.dtd b/chrome/locale/sr/torbutton.dtd similarity index 100% rename from src/chrome/locale/sr/torbutton.dtd rename to chrome/locale/sr/torbutton.dtd diff --git a/src/chrome/locale/sr/torbutton.properties b/chrome/locale/sr/torbutton.properties similarity index 100% rename from src/chrome/locale/sr/torbutton.properties rename to chrome/locale/sr/torbutton.properties diff --git a/src/chrome/locale/st/aboutTor.dtd b/chrome/locale/st/aboutTor.dtd similarity index 100% rename from src/chrome/locale/st/aboutTor.dtd rename to chrome/locale/st/aboutTor.dtd diff --git a/src/chrome/locale/st/brand.dtd b/chrome/locale/st/brand.dtd similarity index 100% rename from src/chrome/locale/st/brand.dtd rename to chrome/locale/st/brand.dtd diff --git a/src/chrome/locale/st/brand.properties b/chrome/locale/st/brand.properties similarity index 100% rename from src/chrome/locale/st/brand.properties rename to chrome/locale/st/brand.properties diff --git a/src/chrome/locale/st/torbutton.dtd b/chrome/locale/st/torbutton.dtd similarity index 100% rename from src/chrome/locale/st/torbutton.dtd rename to chrome/locale/st/torbutton.dtd diff --git a/src/chrome/locale/st/torbutton.properties b/chrome/locale/st/torbutton.properties similarity index 100% rename from src/chrome/locale/st/torbutton.properties rename to chrome/locale/st/torbutton.properties diff --git a/src/chrome/locale/su/aboutTor.dtd b/chrome/locale/su/aboutTor.dtd similarity index 100% rename from src/chrome/locale/su/aboutTor.dtd rename to chrome/locale/su/aboutTor.dtd diff --git a/src/chrome/locale/su/brand.dtd b/chrome/locale/su/brand.dtd similarity index 100% rename from src/chrome/locale/su/brand.dtd rename to chrome/locale/su/brand.dtd diff --git a/src/chrome/locale/su/brand.properties b/chrome/locale/su/brand.properties similarity index 100% rename from src/chrome/locale/su/brand.properties rename to chrome/locale/su/brand.properties diff --git a/src/chrome/locale/su/torbutton.dtd b/chrome/locale/su/torbutton.dtd similarity index 100% rename from src/chrome/locale/su/torbutton.dtd rename to chrome/locale/su/torbutton.dtd diff --git a/src/chrome/locale/su/torbutton.properties b/chrome/locale/su/torbutton.properties similarity index 100% rename from src/chrome/locale/su/torbutton.properties rename to chrome/locale/su/torbutton.properties diff --git a/src/chrome/locale/sv-SE/aboutDialog.dtd b/chrome/locale/sv-SE/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/sv-SE/aboutDialog.dtd rename to chrome/locale/sv-SE/aboutDialog.dtd diff --git a/src/chrome/locale/sv-SE/aboutTBUpdate.dtd b/chrome/locale/sv-SE/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/sv-SE/aboutTBUpdate.dtd rename to chrome/locale/sv-SE/aboutTBUpdate.dtd diff --git a/src/chrome/locale/sv-SE/aboutTor.dtd b/chrome/locale/sv-SE/aboutTor.dtd similarity index 100% rename from src/chrome/locale/sv-SE/aboutTor.dtd rename to chrome/locale/sv-SE/aboutTor.dtd diff --git a/src/chrome/locale/sv-SE/brand.dtd b/chrome/locale/sv-SE/brand.dtd similarity index 100% rename from src/chrome/locale/sv-SE/brand.dtd rename to chrome/locale/sv-SE/brand.dtd diff --git a/src/chrome/locale/sv-SE/brand.properties b/chrome/locale/sv-SE/brand.properties similarity index 100% rename from src/chrome/locale/sv-SE/brand.properties rename to chrome/locale/sv-SE/brand.properties diff --git a/src/chrome/locale/sv-SE/browserOnboarding.properties b/chrome/locale/sv-SE/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/sv-SE/browserOnboarding.properties rename to chrome/locale/sv-SE/browserOnboarding.properties diff --git a/src/chrome/locale/sv-SE/securityLevel.properties b/chrome/locale/sv-SE/securityLevel.properties similarity index 100% rename from src/chrome/locale/sv-SE/securityLevel.properties rename to chrome/locale/sv-SE/securityLevel.properties diff --git a/src/chrome/locale/sv-SE/torbutton.dtd b/chrome/locale/sv-SE/torbutton.dtd similarity index 100% rename from src/chrome/locale/sv-SE/torbutton.dtd rename to chrome/locale/sv-SE/torbutton.dtd diff --git a/src/chrome/locale/sv-SE/torbutton.properties b/chrome/locale/sv-SE/torbutton.properties similarity index 100% rename from src/chrome/locale/sv-SE/torbutton.properties rename to chrome/locale/sv-SE/torbutton.properties diff --git a/src/chrome/locale/sw/aboutTor.dtd b/chrome/locale/sw/aboutTor.dtd similarity index 100% rename from src/chrome/locale/sw/aboutTor.dtd rename to chrome/locale/sw/aboutTor.dtd diff --git a/src/chrome/locale/sw/brand.dtd b/chrome/locale/sw/brand.dtd similarity index 100% rename from src/chrome/locale/sw/brand.dtd rename to chrome/locale/sw/brand.dtd diff --git a/src/chrome/locale/sw/brand.properties b/chrome/locale/sw/brand.properties similarity index 100% rename from src/chrome/locale/sw/brand.properties rename to chrome/locale/sw/brand.properties diff --git a/src/chrome/locale/sw/torbutton.dtd b/chrome/locale/sw/torbutton.dtd similarity index 100% rename from src/chrome/locale/sw/torbutton.dtd rename to chrome/locale/sw/torbutton.dtd diff --git a/src/chrome/locale/sw/torbutton.properties b/chrome/locale/sw/torbutton.properties similarity index 100% rename from src/chrome/locale/sw/torbutton.properties rename to chrome/locale/sw/torbutton.properties diff --git a/src/chrome/locale/ta/aboutTor.dtd b/chrome/locale/ta/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ta/aboutTor.dtd rename to chrome/locale/ta/aboutTor.dtd diff --git a/src/chrome/locale/ta/brand.dtd b/chrome/locale/ta/brand.dtd similarity index 100% rename from src/chrome/locale/ta/brand.dtd rename to chrome/locale/ta/brand.dtd diff --git a/src/chrome/locale/ta/brand.properties b/chrome/locale/ta/brand.properties similarity index 100% rename from src/chrome/locale/ta/brand.properties rename to chrome/locale/ta/brand.properties diff --git a/src/chrome/locale/ta/torbutton.dtd b/chrome/locale/ta/torbutton.dtd similarity index 100% rename from src/chrome/locale/ta/torbutton.dtd rename to chrome/locale/ta/torbutton.dtd diff --git a/src/chrome/locale/ta/torbutton.properties b/chrome/locale/ta/torbutton.properties similarity index 100% rename from src/chrome/locale/ta/torbutton.properties rename to chrome/locale/ta/torbutton.properties diff --git a/src/chrome/locale/te/aboutTor.dtd b/chrome/locale/te/aboutTor.dtd similarity index 100% rename from src/chrome/locale/te/aboutTor.dtd rename to chrome/locale/te/aboutTor.dtd diff --git a/src/chrome/locale/te/brand.dtd b/chrome/locale/te/brand.dtd similarity index 100% rename from src/chrome/locale/te/brand.dtd rename to chrome/locale/te/brand.dtd diff --git a/src/chrome/locale/te/brand.properties b/chrome/locale/te/brand.properties similarity index 100% rename from src/chrome/locale/te/brand.properties rename to chrome/locale/te/brand.properties diff --git a/src/chrome/locale/te/torbutton.dtd b/chrome/locale/te/torbutton.dtd similarity index 100% rename from src/chrome/locale/te/torbutton.dtd rename to chrome/locale/te/torbutton.dtd diff --git a/src/chrome/locale/te/torbutton.properties b/chrome/locale/te/torbutton.properties similarity index 100% rename from src/chrome/locale/te/torbutton.properties rename to chrome/locale/te/torbutton.properties diff --git a/src/chrome/locale/tg/aboutTor.dtd b/chrome/locale/tg/aboutTor.dtd similarity index 100% rename from src/chrome/locale/tg/aboutTor.dtd rename to chrome/locale/tg/aboutTor.dtd diff --git a/src/chrome/locale/tg/brand.dtd b/chrome/locale/tg/brand.dtd similarity index 100% rename from src/chrome/locale/tg/brand.dtd rename to chrome/locale/tg/brand.dtd diff --git a/src/chrome/locale/tg/brand.properties b/chrome/locale/tg/brand.properties similarity index 100% rename from src/chrome/locale/tg/brand.properties rename to chrome/locale/tg/brand.properties diff --git a/src/chrome/locale/tg/torbutton.dtd b/chrome/locale/tg/torbutton.dtd similarity index 100% rename from src/chrome/locale/tg/torbutton.dtd rename to chrome/locale/tg/torbutton.dtd diff --git a/src/chrome/locale/tg/torbutton.properties b/chrome/locale/tg/torbutton.properties similarity index 100% rename from src/chrome/locale/tg/torbutton.properties rename to chrome/locale/tg/torbutton.properties diff --git a/src/chrome/locale/th/aboutTor.dtd b/chrome/locale/th/aboutTor.dtd similarity index 100% rename from src/chrome/locale/th/aboutTor.dtd rename to chrome/locale/th/aboutTor.dtd diff --git a/src/chrome/locale/th/brand.dtd b/chrome/locale/th/brand.dtd similarity index 100% rename from src/chrome/locale/th/brand.dtd rename to chrome/locale/th/brand.dtd diff --git a/src/chrome/locale/th/brand.properties b/chrome/locale/th/brand.properties similarity index 100% rename from src/chrome/locale/th/brand.properties rename to chrome/locale/th/brand.properties diff --git a/src/chrome/locale/th/torbutton.dtd b/chrome/locale/th/torbutton.dtd similarity index 100% rename from src/chrome/locale/th/torbutton.dtd rename to chrome/locale/th/torbutton.dtd diff --git a/src/chrome/locale/th/torbutton.properties b/chrome/locale/th/torbutton.properties similarity index 100% rename from src/chrome/locale/th/torbutton.properties rename to chrome/locale/th/torbutton.properties diff --git a/src/chrome/locale/ti/aboutTor.dtd b/chrome/locale/ti/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ti/aboutTor.dtd rename to chrome/locale/ti/aboutTor.dtd diff --git a/src/chrome/locale/ti/brand.dtd b/chrome/locale/ti/brand.dtd similarity index 100% rename from src/chrome/locale/ti/brand.dtd rename to chrome/locale/ti/brand.dtd diff --git a/src/chrome/locale/ti/brand.properties b/chrome/locale/ti/brand.properties similarity index 100% rename from src/chrome/locale/ti/brand.properties rename to chrome/locale/ti/brand.properties diff --git a/src/chrome/locale/ti/torbutton.dtd b/chrome/locale/ti/torbutton.dtd similarity index 100% rename from src/chrome/locale/ti/torbutton.dtd rename to chrome/locale/ti/torbutton.dtd diff --git a/src/chrome/locale/ti/torbutton.properties b/chrome/locale/ti/torbutton.properties similarity index 100% rename from src/chrome/locale/ti/torbutton.properties rename to chrome/locale/ti/torbutton.properties diff --git a/src/chrome/locale/tk/aboutTor.dtd b/chrome/locale/tk/aboutTor.dtd similarity index 100% rename from src/chrome/locale/tk/aboutTor.dtd rename to chrome/locale/tk/aboutTor.dtd diff --git a/src/chrome/locale/tk/brand.dtd b/chrome/locale/tk/brand.dtd similarity index 100% rename from src/chrome/locale/tk/brand.dtd rename to chrome/locale/tk/brand.dtd diff --git a/src/chrome/locale/tk/brand.properties b/chrome/locale/tk/brand.properties similarity index 100% rename from src/chrome/locale/tk/brand.properties rename to chrome/locale/tk/brand.properties diff --git a/src/chrome/locale/tk/torbutton.dtd b/chrome/locale/tk/torbutton.dtd similarity index 100% rename from src/chrome/locale/tk/torbutton.dtd rename to chrome/locale/tk/torbutton.dtd diff --git a/src/chrome/locale/tk/torbutton.properties b/chrome/locale/tk/torbutton.properties similarity index 100% rename from src/chrome/locale/tk/torbutton.properties rename to chrome/locale/tk/torbutton.properties diff --git a/src/chrome/locale/tr/aboutDialog.dtd b/chrome/locale/tr/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/tr/aboutDialog.dtd rename to chrome/locale/tr/aboutDialog.dtd diff --git a/src/chrome/locale/tr/aboutTBUpdate.dtd b/chrome/locale/tr/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/tr/aboutTBUpdate.dtd rename to chrome/locale/tr/aboutTBUpdate.dtd diff --git a/src/chrome/locale/tr/aboutTor.dtd b/chrome/locale/tr/aboutTor.dtd similarity index 100% rename from src/chrome/locale/tr/aboutTor.dtd rename to chrome/locale/tr/aboutTor.dtd diff --git a/src/chrome/locale/tr/brand.dtd b/chrome/locale/tr/brand.dtd similarity index 100% rename from src/chrome/locale/tr/brand.dtd rename to chrome/locale/tr/brand.dtd diff --git a/src/chrome/locale/tr/brand.properties b/chrome/locale/tr/brand.properties similarity index 100% rename from src/chrome/locale/tr/brand.properties rename to chrome/locale/tr/brand.properties diff --git a/src/chrome/locale/tr/browserOnboarding.properties b/chrome/locale/tr/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/tr/browserOnboarding.properties rename to chrome/locale/tr/browserOnboarding.properties diff --git a/src/chrome/locale/tr/securityLevel.properties b/chrome/locale/tr/securityLevel.properties similarity index 100% rename from src/chrome/locale/tr/securityLevel.properties rename to chrome/locale/tr/securityLevel.properties diff --git a/src/chrome/locale/tr/torbutton.dtd b/chrome/locale/tr/torbutton.dtd similarity index 100% rename from src/chrome/locale/tr/torbutton.dtd rename to chrome/locale/tr/torbutton.dtd diff --git a/src/chrome/locale/tr/torbutton.properties b/chrome/locale/tr/torbutton.properties similarity index 100% rename from src/chrome/locale/tr/torbutton.properties rename to chrome/locale/tr/torbutton.properties diff --git a/src/chrome/locale/uk/aboutTor.dtd b/chrome/locale/uk/aboutTor.dtd similarity index 100% rename from src/chrome/locale/uk/aboutTor.dtd rename to chrome/locale/uk/aboutTor.dtd diff --git a/src/chrome/locale/uk/brand.dtd b/chrome/locale/uk/brand.dtd similarity index 100% rename from src/chrome/locale/uk/brand.dtd rename to chrome/locale/uk/brand.dtd diff --git a/src/chrome/locale/uk/brand.properties b/chrome/locale/uk/brand.properties similarity index 100% rename from src/chrome/locale/uk/brand.properties rename to chrome/locale/uk/brand.properties diff --git a/src/chrome/locale/uk/securityLevel.properties b/chrome/locale/uk/securityLevel.properties similarity index 100% rename from src/chrome/locale/uk/securityLevel.properties rename to chrome/locale/uk/securityLevel.properties diff --git a/src/chrome/locale/uk/torbutton.dtd b/chrome/locale/uk/torbutton.dtd similarity index 100% rename from src/chrome/locale/uk/torbutton.dtd rename to chrome/locale/uk/torbutton.dtd diff --git a/src/chrome/locale/uk/torbutton.properties b/chrome/locale/uk/torbutton.properties similarity index 100% rename from src/chrome/locale/uk/torbutton.properties rename to chrome/locale/uk/torbutton.properties diff --git a/src/chrome/locale/ur/aboutTor.dtd b/chrome/locale/ur/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ur/aboutTor.dtd rename to chrome/locale/ur/aboutTor.dtd diff --git a/src/chrome/locale/ur/brand.dtd b/chrome/locale/ur/brand.dtd similarity index 100% rename from src/chrome/locale/ur/brand.dtd rename to chrome/locale/ur/brand.dtd diff --git a/src/chrome/locale/ur/brand.properties b/chrome/locale/ur/brand.properties similarity index 100% rename from src/chrome/locale/ur/brand.properties rename to chrome/locale/ur/brand.properties diff --git a/src/chrome/locale/ur/torbutton.dtd b/chrome/locale/ur/torbutton.dtd similarity index 100% rename from src/chrome/locale/ur/torbutton.dtd rename to chrome/locale/ur/torbutton.dtd diff --git a/src/chrome/locale/ur/torbutton.properties b/chrome/locale/ur/torbutton.properties similarity index 100% rename from src/chrome/locale/ur/torbutton.properties rename to chrome/locale/ur/torbutton.properties diff --git a/src/chrome/locale/ve/aboutTor.dtd b/chrome/locale/ve/aboutTor.dtd similarity index 100% rename from src/chrome/locale/ve/aboutTor.dtd rename to chrome/locale/ve/aboutTor.dtd diff --git a/src/chrome/locale/ve/brand.dtd b/chrome/locale/ve/brand.dtd similarity index 100% rename from src/chrome/locale/ve/brand.dtd rename to chrome/locale/ve/brand.dtd diff --git a/src/chrome/locale/ve/brand.properties b/chrome/locale/ve/brand.properties similarity index 100% rename from src/chrome/locale/ve/brand.properties rename to chrome/locale/ve/brand.properties diff --git a/src/chrome/locale/ve/torbutton.dtd b/chrome/locale/ve/torbutton.dtd similarity index 100% rename from src/chrome/locale/ve/torbutton.dtd rename to chrome/locale/ve/torbutton.dtd diff --git a/src/chrome/locale/ve/torbutton.properties b/chrome/locale/ve/torbutton.properties similarity index 100% rename from src/chrome/locale/ve/torbutton.properties rename to chrome/locale/ve/torbutton.properties diff --git a/src/chrome/locale/vi/aboutDialog.dtd b/chrome/locale/vi/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/vi/aboutDialog.dtd rename to chrome/locale/vi/aboutDialog.dtd diff --git a/src/chrome/locale/vi/aboutTBUpdate.dtd b/chrome/locale/vi/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/vi/aboutTBUpdate.dtd rename to chrome/locale/vi/aboutTBUpdate.dtd diff --git a/src/chrome/locale/vi/aboutTor.dtd b/chrome/locale/vi/aboutTor.dtd similarity index 100% rename from src/chrome/locale/vi/aboutTor.dtd rename to chrome/locale/vi/aboutTor.dtd diff --git a/src/chrome/locale/vi/brand.dtd b/chrome/locale/vi/brand.dtd similarity index 100% rename from src/chrome/locale/vi/brand.dtd rename to chrome/locale/vi/brand.dtd diff --git a/src/chrome/locale/vi/brand.properties b/chrome/locale/vi/brand.properties similarity index 100% rename from src/chrome/locale/vi/brand.properties rename to chrome/locale/vi/brand.properties diff --git a/src/chrome/locale/vi/browserOnboarding.properties b/chrome/locale/vi/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/vi/browserOnboarding.properties rename to chrome/locale/vi/browserOnboarding.properties diff --git a/src/chrome/locale/vi/securityLevel.properties b/chrome/locale/vi/securityLevel.properties similarity index 100% rename from src/chrome/locale/vi/securityLevel.properties rename to chrome/locale/vi/securityLevel.properties diff --git a/src/chrome/locale/vi/torbutton.dtd b/chrome/locale/vi/torbutton.dtd similarity index 100% rename from src/chrome/locale/vi/torbutton.dtd rename to chrome/locale/vi/torbutton.dtd diff --git a/src/chrome/locale/vi/torbutton.properties b/chrome/locale/vi/torbutton.properties similarity index 100% rename from src/chrome/locale/vi/torbutton.properties rename to chrome/locale/vi/torbutton.properties diff --git a/src/chrome/locale/wa/aboutTor.dtd b/chrome/locale/wa/aboutTor.dtd similarity index 100% rename from src/chrome/locale/wa/aboutTor.dtd rename to chrome/locale/wa/aboutTor.dtd diff --git a/src/chrome/locale/wa/brand.dtd b/chrome/locale/wa/brand.dtd similarity index 100% rename from src/chrome/locale/wa/brand.dtd rename to chrome/locale/wa/brand.dtd diff --git a/src/chrome/locale/wa/brand.properties b/chrome/locale/wa/brand.properties similarity index 100% rename from src/chrome/locale/wa/brand.properties rename to chrome/locale/wa/brand.properties diff --git a/src/chrome/locale/wa/torbutton.dtd b/chrome/locale/wa/torbutton.dtd similarity index 100% rename from src/chrome/locale/wa/torbutton.dtd rename to chrome/locale/wa/torbutton.dtd diff --git a/src/chrome/locale/wa/torbutton.properties b/chrome/locale/wa/torbutton.properties similarity index 100% rename from src/chrome/locale/wa/torbutton.properties rename to chrome/locale/wa/torbutton.properties diff --git a/src/chrome/locale/wo/aboutTor.dtd b/chrome/locale/wo/aboutTor.dtd similarity index 100% rename from src/chrome/locale/wo/aboutTor.dtd rename to chrome/locale/wo/aboutTor.dtd diff --git a/src/chrome/locale/wo/brand.dtd b/chrome/locale/wo/brand.dtd similarity index 100% rename from src/chrome/locale/wo/brand.dtd rename to chrome/locale/wo/brand.dtd diff --git a/src/chrome/locale/wo/brand.properties b/chrome/locale/wo/brand.properties similarity index 100% rename from src/chrome/locale/wo/brand.properties rename to chrome/locale/wo/brand.properties diff --git a/src/chrome/locale/wo/torbutton.dtd b/chrome/locale/wo/torbutton.dtd similarity index 100% rename from src/chrome/locale/wo/torbutton.dtd rename to chrome/locale/wo/torbutton.dtd diff --git a/src/chrome/locale/wo/torbutton.properties b/chrome/locale/wo/torbutton.properties similarity index 100% rename from src/chrome/locale/wo/torbutton.properties rename to chrome/locale/wo/torbutton.properties diff --git a/src/chrome/locale/zh-CN/aboutDialog.dtd b/chrome/locale/zh-CN/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/zh-CN/aboutDialog.dtd rename to chrome/locale/zh-CN/aboutDialog.dtd diff --git a/src/chrome/locale/zh-CN/aboutTBUpdate.dtd b/chrome/locale/zh-CN/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/zh-CN/aboutTBUpdate.dtd rename to chrome/locale/zh-CN/aboutTBUpdate.dtd diff --git a/src/chrome/locale/zh-CN/aboutTor.dtd b/chrome/locale/zh-CN/aboutTor.dtd similarity index 100% rename from src/chrome/locale/zh-CN/aboutTor.dtd rename to chrome/locale/zh-CN/aboutTor.dtd diff --git a/src/chrome/locale/zh-CN/brand.dtd b/chrome/locale/zh-CN/brand.dtd similarity index 100% rename from src/chrome/locale/zh-CN/brand.dtd rename to chrome/locale/zh-CN/brand.dtd diff --git a/src/chrome/locale/zh-CN/brand.properties b/chrome/locale/zh-CN/brand.properties similarity index 100% rename from src/chrome/locale/zh-CN/brand.properties rename to chrome/locale/zh-CN/brand.properties diff --git a/src/chrome/locale/zh-CN/browserOnboarding.properties b/chrome/locale/zh-CN/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/zh-CN/browserOnboarding.properties rename to chrome/locale/zh-CN/browserOnboarding.properties diff --git a/src/chrome/locale/zh-CN/securityLevel.properties b/chrome/locale/zh-CN/securityLevel.properties similarity index 100% rename from src/chrome/locale/zh-CN/securityLevel.properties rename to chrome/locale/zh-CN/securityLevel.properties diff --git a/src/chrome/locale/zh-CN/torbutton.dtd b/chrome/locale/zh-CN/torbutton.dtd similarity index 100% rename from src/chrome/locale/zh-CN/torbutton.dtd rename to chrome/locale/zh-CN/torbutton.dtd diff --git a/src/chrome/locale/zh-CN/torbutton.properties b/chrome/locale/zh-CN/torbutton.properties similarity index 100% rename from src/chrome/locale/zh-CN/torbutton.properties rename to chrome/locale/zh-CN/torbutton.properties diff --git a/src/chrome/locale/zh-HK/aboutTor.dtd b/chrome/locale/zh-HK/aboutTor.dtd similarity index 100% rename from src/chrome/locale/zh-HK/aboutTor.dtd rename to chrome/locale/zh-HK/aboutTor.dtd diff --git a/src/chrome/locale/zh-HK/brand.dtd b/chrome/locale/zh-HK/brand.dtd similarity index 100% rename from src/chrome/locale/zh-HK/brand.dtd rename to chrome/locale/zh-HK/brand.dtd diff --git a/src/chrome/locale/zh-HK/brand.properties b/chrome/locale/zh-HK/brand.properties similarity index 100% rename from src/chrome/locale/zh-HK/brand.properties rename to chrome/locale/zh-HK/brand.properties diff --git a/src/chrome/locale/zh-HK/torbutton.dtd b/chrome/locale/zh-HK/torbutton.dtd similarity index 100% rename from src/chrome/locale/zh-HK/torbutton.dtd rename to chrome/locale/zh-HK/torbutton.dtd diff --git a/src/chrome/locale/zh-HK/torbutton.properties b/chrome/locale/zh-HK/torbutton.properties similarity index 100% rename from src/chrome/locale/zh-HK/torbutton.properties rename to chrome/locale/zh-HK/torbutton.properties diff --git a/src/chrome/locale/zh-TW/aboutDialog.dtd b/chrome/locale/zh-TW/aboutDialog.dtd similarity index 100% rename from src/chrome/locale/zh-TW/aboutDialog.dtd rename to chrome/locale/zh-TW/aboutDialog.dtd diff --git a/src/chrome/locale/zh-TW/aboutTBUpdate.dtd b/chrome/locale/zh-TW/aboutTBUpdate.dtd similarity index 100% rename from src/chrome/locale/zh-TW/aboutTBUpdate.dtd rename to chrome/locale/zh-TW/aboutTBUpdate.dtd diff --git a/src/chrome/locale/zh-TW/aboutTor.dtd b/chrome/locale/zh-TW/aboutTor.dtd similarity index 100% rename from src/chrome/locale/zh-TW/aboutTor.dtd rename to chrome/locale/zh-TW/aboutTor.dtd diff --git a/src/chrome/locale/zh-TW/brand.dtd b/chrome/locale/zh-TW/brand.dtd similarity index 100% rename from src/chrome/locale/zh-TW/brand.dtd rename to chrome/locale/zh-TW/brand.dtd diff --git a/src/chrome/locale/zh-TW/brand.properties b/chrome/locale/zh-TW/brand.properties similarity index 100% rename from src/chrome/locale/zh-TW/brand.properties rename to chrome/locale/zh-TW/brand.properties diff --git a/src/chrome/locale/zh-TW/browserOnboarding.properties b/chrome/locale/zh-TW/browserOnboarding.properties similarity index 100% rename from src/chrome/locale/zh-TW/browserOnboarding.properties rename to chrome/locale/zh-TW/browserOnboarding.properties diff --git a/src/chrome/locale/zh-TW/securityLevel.properties b/chrome/locale/zh-TW/securityLevel.properties similarity index 100% rename from src/chrome/locale/zh-TW/securityLevel.properties rename to chrome/locale/zh-TW/securityLevel.properties diff --git a/src/chrome/locale/zh-TW/torbutton.dtd b/chrome/locale/zh-TW/torbutton.dtd similarity index 100% rename from src/chrome/locale/zh-TW/torbutton.dtd rename to chrome/locale/zh-TW/torbutton.dtd diff --git a/src/chrome/locale/zh-TW/torbutton.properties b/chrome/locale/zh-TW/torbutton.properties similarity index 100% rename from src/chrome/locale/zh-TW/torbutton.properties rename to chrome/locale/zh-TW/torbutton.properties diff --git a/src/chrome/locale/zu/aboutTor.dtd b/chrome/locale/zu/aboutTor.dtd similarity index 100% rename from src/chrome/locale/zu/aboutTor.dtd rename to chrome/locale/zu/aboutTor.dtd diff --git a/src/chrome/locale/zu/brand.dtd b/chrome/locale/zu/brand.dtd similarity index 100% rename from src/chrome/locale/zu/brand.dtd rename to chrome/locale/zu/brand.dtd diff --git a/src/chrome/locale/zu/brand.properties b/chrome/locale/zu/brand.properties similarity index 100% rename from src/chrome/locale/zu/brand.properties rename to chrome/locale/zu/brand.properties diff --git a/src/chrome/locale/zu/torbutton.dtd b/chrome/locale/zu/torbutton.dtd similarity index 100% rename from src/chrome/locale/zu/torbutton.dtd rename to chrome/locale/zu/torbutton.dtd diff --git a/src/chrome/locale/zu/torbutton.properties b/chrome/locale/zu/torbutton.properties similarity index 100% rename from src/chrome/locale/zu/torbutton.properties rename to chrome/locale/zu/torbutton.properties diff --git a/src/chrome/skin/about-wordmark.png b/chrome/skin/about-wordmark.png similarity index 100% rename from src/chrome/skin/about-wordmark.png rename to chrome/skin/about-wordmark.png diff --git a/src/chrome/skin/aboutDialog.css b/chrome/skin/aboutDialog.css similarity index 100% rename from src/chrome/skin/aboutDialog.css rename to chrome/skin/aboutDialog.css diff --git a/src/chrome/skin/aboutTor.css b/chrome/skin/aboutTor.css similarity index 100% rename from src/chrome/skin/aboutTor.css rename to chrome/skin/aboutTor.css diff --git a/src/chrome/skin/forwardArrow.png b/chrome/skin/forwardArrow.png similarity index 100% rename from src/chrome/skin/forwardArrow.png rename to chrome/skin/forwardArrow.png diff --git a/src/chrome/skin/icon-newsletter.png b/chrome/skin/icon-newsletter.png similarity index 100% rename from src/chrome/skin/icon-newsletter.png rename to chrome/skin/icon-newsletter.png diff --git a/src/chrome/skin/new_circuit.svg b/chrome/skin/new_circuit.svg similarity index 100% rename from src/chrome/skin/new_circuit.svg rename to chrome/skin/new_circuit.svg diff --git a/src/chrome/skin/preferences-mobile.css b/chrome/skin/preferences-mobile.css similarity index 100% rename from src/chrome/skin/preferences-mobile.css rename to chrome/skin/preferences-mobile.css diff --git a/src/chrome/skin/preferences.css b/chrome/skin/preferences.css similarity index 100% rename from src/chrome/skin/preferences.css rename to chrome/skin/preferences.css diff --git a/src/chrome/skin/searchLogo.png b/chrome/skin/searchLogo.png similarity index 100% rename from src/chrome/skin/searchLogo.png rename to chrome/skin/searchLogo.png diff --git a/src/chrome/skin/tor-circuit-display.css b/chrome/skin/tor-circuit-display.css similarity index 100% rename from src/chrome/skin/tor-circuit-display.css rename to chrome/skin/tor-circuit-display.css diff --git a/src/chrome/skin/tor.png b/chrome/skin/tor.png similarity index 100% rename from src/chrome/skin/tor.png rename to chrome/skin/tor.png diff --git a/src/chrome/skin/torbrowser_mobile_logo.png b/chrome/skin/torbrowser_mobile_logo.png similarity index 100% rename from src/chrome/skin/torbrowser_mobile_logo.png rename to chrome/skin/torbrowser_mobile_logo.png diff --git a/src/chrome/skin/torbutton-update-needed.svg b/chrome/skin/torbutton-update-needed.svg similarity index 100% rename from src/chrome/skin/torbutton-update-needed.svg rename to chrome/skin/torbutton-update-needed.svg diff --git a/src/chrome/skin/torbutton.css b/chrome/skin/torbutton.css similarity index 100% rename from src/chrome/skin/torbutton.css rename to chrome/skin/torbutton.css diff --git a/src/chrome/skin/torbutton.svg b/chrome/skin/torbutton.svg similarity index 100% rename from src/chrome/skin/torbutton.svg rename to chrome/skin/torbutton.svg diff --git a/src/components/aboutTor.js b/components/aboutTor.js similarity index 100% rename from src/components/aboutTor.js rename to components/aboutTor.js diff --git a/src/components/cookie-jar-selector.js b/components/cookie-jar-selector.js similarity index 100% rename from src/components/cookie-jar-selector.js rename to components/cookie-jar-selector.js diff --git a/src/components/domain-isolator.js b/components/domain-isolator.js similarity index 100% rename from src/components/domain-isolator.js rename to components/domain-isolator.js diff --git a/src/components/dragDropFilter.js b/components/dragDropFilter.js similarity index 100% rename from src/components/dragDropFilter.js rename to components/dragDropFilter.js diff --git a/src/components/external-app-blocker.js b/components/external-app-blocker.js similarity index 100% rename from src/components/external-app-blocker.js rename to components/external-app-blocker.js diff --git a/src/components/startup-observer.js b/components/startup-observer.js similarity index 100% rename from src/components/startup-observer.js rename to components/startup-observer.js diff --git a/src/components/torCheckService.js b/components/torCheckService.js similarity index 100% rename from src/components/torCheckService.js rename to components/torCheckService.js diff --git a/src/components/torbutton-logger.js b/components/torbutton-logger.js similarity index 100% rename from src/components/torbutton-logger.js rename to components/torbutton-logger.js diff --git a/src/defaults/preferences/preferences.js b/defaults/preferences/preferences.js similarity index 100% rename from src/defaults/preferences/preferences.js rename to defaults/preferences/preferences.js diff --git a/trans_tools/import-translations.sh b/import-translations.sh similarity index 98% rename from trans_tools/import-translations.sh rename to import-translations.sh index c5724011..26826090 100755 --- a/trans_tools/import-translations.sh +++ b/import-translations.sh @@ -12,7 +12,7 @@ BUNDLE_LOCALES="ar ca cs da de el es-AR es-ES fa fr ga-IE he hu id is it ja ka k # 26498 and #29257. Others might want to fix, build, and use it, though. BUNDLE_LOCALES="$BUNDLE_LOCALES eu bn-BD"

-LOCALE_DIR=../src/chrome/locale +LOCALE_DIR=./chrome/locale

# FILEMAP is an array of "localeFile:translationBranch" strings. FILEMAP=( "aboutDialog.dtd:torbutton-aboutdialogdtd" diff --git a/src/jar.mn b/jar.mn similarity index 100% rename from src/jar.mn rename to jar.mn diff --git a/src/modules/default-prefs.js b/modules/default-prefs.js similarity index 100% rename from src/modules/default-prefs.js rename to modules/default-prefs.js diff --git a/src/modules/noscript-control.js b/modules/noscript-control.js similarity index 100% rename from src/modules/noscript-control.js rename to modules/noscript-control.js diff --git a/src/modules/security-prefs.js b/modules/security-prefs.js similarity index 100% rename from src/modules/security-prefs.js rename to modules/security-prefs.js diff --git a/src/modules/tor-control-port.js b/modules/tor-control-port.js similarity index 100% rename from src/modules/tor-control-port.js rename to modules/tor-control-port.js diff --git a/src/modules/utils.js b/modules/utils.js similarity index 100% rename from src/modules/utils.js rename to modules/utils.js diff --git a/moz.build b/moz.build index 28f592f8..843cee0d 100644 --- a/moz.build +++ b/moz.build @@ -3,7 +3,7 @@ # This Source Code Form is subject to the terms of the Mozilla Public # License, v. 2.0. If a copy of the MPL was not distributed with this # file, You can obtain one at http://mozilla.org/MPL/2.0/. -JAR_MANIFESTS += ['src/jar.mn'] +JAR_MANIFESTS += ['jar.mn'] JS_PREFERENCE_FILES += [ - 'src/defaults/preferences/preferences.js', + 'defaults/preferences/preferences.js', ] diff --git a/src/CHANGELOG b/src/CHANGELOG deleted file mode 100644 index 858e8f53..00000000 --- a/src/CHANGELOG +++ /dev/null @@ -1,1366 +0,0 @@ -2.1.7 - * Bug 30388: Make sure the updated intermediate certificate keeps working - -2.0.13 - * Bug 30388: Make sure the updated intermediate certificate is working - -2.1.6 - * Bug 22538+22513: Fix new circuit button for error pages - * Bug 29825: Intelligently add new Security Level button to taskbar - * Bug 29903: No WebGL click-to-play on the standard security level - * Bug 27484: Improve navigation within onboarding (strings) - * Bug 29768: Introduce new features to users (strings) - * Bug 29943: Use locales in AB-CD scheme to match Mozilla - * Bug 26498: Add locale: es-AR - * Bug 29973: Remove remaining stopOpenSecuritySettingsObserver() pieces - * Translations update - -2.1.5 - * Bug 25658: Replace security slider with security level UI - * Bug 28628: Change onboarding Security panel to open new Security Level panel - * Bug 29440: Update about:tor when Tor Browser is updated - * Bug 27478: Improved Torbutton icons for dark theme - * Bug 29021: Tell NoScript it is running within Tor Browser - * Bug 29239: Don't ship the Torbutton .xpi on mobile - * Translations update - -2.0.11 - * Bug 29021: Tell NoScript it is running within Tor Browser - -2.1.4 - * Bug 25702: Update Tor Browser icon to follow design guidelines - * Bug 21805: Add click-to-play button for WebGL - * Bug 28836: Links on about:tor are not clickable - * Bug 29035: Clean up our donation campaign and add newsletter sign-up link - * Translations update - * Code clean-up - -2.0.10 - * Bug 29035: Clean up our donation campaign and add newsletter sign-up link - * Bug 27175: Add pref to allow users to persist custom noscript settings - -2.1.3 - * Bug 28540: Use new text for 2018 donation banner - * Bug 27290: Remove WebGL pref for min capability mode - * Bug 28075: Tone down missing SOCKS credential warning - * Bug 28747: Remove NoScript (XPCOM) related unused code - * Translations update - -2.0.9 - * Bug 28540: Use new text for 2018 donation banner - * Bug 28515: Use en-US for english Torbutton strings - * Translations update - -2.1.2 - * Bug 25013: Integrate Torbutton into tor-browser for Android - * Bug 27111: Update about:tor desktop version to work on mobile - * Bug 28093: Update donation banner style to make it fit in small screens - * Bug 28543: about:tor has scroll bar between widths 900px and 1000px - * Bug 28039: Enable dump() if log method is 0 - * Bug 27701: Don't show App Blocker dialog on Android - * Bug 28187: Change tor circuit icon to torbutton.svg - * Bug 28515: Use en-US for english Torbutton strings - * Translations update - -2.1.1 - * Bug 23925+27959: Donation banner for year end 2018 campaign - * Bug 24172: Donation banner clobbers Tor Browser version string - * Bug 28082: Add locales cs, el, hu, ka - * Translations update - -2.0.8 - * Bug 23925+27959: Donation banner for year end 2018 campaign - * Bug 24172: Donation banner clobbers Tor Browser version string - * Bug 27760: Use new NoScript API for IPC and fix about:blank issue - * Translations update - -2.1 - * Bug 27175: Add pref to allow users to persist custom noscript settings - * Bug 27760: Use new NoScript API for IPC and fix about:blank issue - * Bug 21263: Remove outdated information from the README - -2.0.7 - * Bug 27097: Tor News signup banner - * Bug 27663: Add New Identity menuitem again - * Bug 26624: Only block OBJECT on highest slider level - * Bug 26555: Don't show IP address for meek or snowflake - * Bug 27478: Torbutton icons for dark theme - * Bug 27506+14520: Move status version to upper left corner for RTL locales - * Bug 27427: Fix NoScript IPC for about:blank by whitelisting messages - * Bug 27558: Update the link to "Your Guard note may not change" text - * Translations update - -2.0.6 - * Bug 27401: Start listening for NoScript before it loads - -2.0.5 - * Bug 26962: Circuit display onboarding - * Bug 26520: Fix sec slider/NoScript for TOR_SKIP_LAUNCH=1 - * Bug 26490: Remove the security slider notification - * Bug 27301: Improve about:tor behavior and appearance - * Bug 27214: Improve the onboarding text - * Translations update - -2.0.4 - * Bug 27276: Adapt to new NoScript messaging protocol - * Bug 27097: Add text for Tor News signup widget - * Translations update - -2.0.3 - * Bug 26884: Use Torbutton to provide security slider on mobile - * Translations update - -2.0.2 - * Bug 26960: Implement new about:tor start page - * Bug 26961: Implement new user onboarding - * Bug 26321: Move 'New Identity', 'New Circuit' to File, hamburger menus - * Bug 26590: Use new svg.disabled pref in security slider - * Bug 26655: Adjust color and size of onion button - * Bug 26500: Reposition circuit display relay icon for RTL locales - * Bug 26409: Remove spoofed locale implementation - * Bug 26189: Remove content-policy.js - * Bug 26544: Images are not centered anymore - * Bug 27129: Add locales ca, ga, id, is, nb - * Translations update - -2.0.1 - * Bug 26100: Adapt Torbutton to Firefox 60 ESR - * Bug 26430: New Torbutton icon - * Bug 24309: Move circuit display to the identity popup - * Bug 26128: Adapt security slider to the WebExtensions version of NoScript - * Bug 23247: Show security state of .onions - * Bug 26129: Show our about:tor page on startup - * Bug 26235: Hide new unusable items from help menu - * Bug 26058: Remove workaround for hiding 'sign in to sync' button - * Bug 20628: Add locales bn-BD, da, he, sv, zh-TW - * Translations update - -1.9.9.1 - * Bug 25126: Make about:tor layout responsive - * Translations update - -1.9.9 - * Bug 24159: Version check does not deal with platform specific checks - * Bug 25016: Remove 2017 donation banner - * Translations update - -1.9.8.5 - * Bug 21245: Add da translation to Torbutton and keep track of it - * Bug 24702: Remove Mozilla text from banner - * Translations update - -1.9.8.4 - * Bug 21847: Update copy for security slider - * Bug 10573: Replace deprecated nsILocalFile with nsIFile (code clean-up) - * Translations update - -1.9.8.3 - * Bug 23997: Add link to Tor Browser manual for de, nl, tr, vi - * Bug 23949: Fix donation banner display - * Update locales with translated banner - * Translations update - -1.9.7.10 - * Bug 23997: Add link to Tor Browser manual for de, nl, tr, vi - * Translations update - -1.9.7.9 - * Bug 23949: Fix donation banner display - * Update locales with translated banner - * Translations update - -1.9.8.2 - * Bug 23887: Update banner locales and Mozilla text - * Translations update - -1.9.7.8 - * Bug 23887: Update banner locales and Mozilla text - * Bug 23526: Add 2017 Donation banner text - * Bug 23483: Donation banner on about:tor for 2017 (testing mode) - * Bug 22610: Avoid crashes when canceling external helper app related downloads - * Bug 22472: Fix FTP downloads when external helper app dialog is shown - * Bug 22471: Downloading pdf files via the PDF viewer download button is broken - * Bug 22618: Downloading pdf file via file:/// is stalling - * Translations update - -1.9.8.1 - * Bug 20375: Warn users after entering fullscreen mode - * Bug 22989: Fix dimensions of new windows on macOS - * Bug 23526: Add 2017 Donation banner text - * Bug 23483: Donation banner on about:tor for 2017 (testing mode) - * Translations Update - -1.9.7.7 - * Bug 22542: Security Settings window too small on macOS 10.12 (fixup) - * Bug 20375: Warn users after entering fullscreen mode - -1.9.7.6 - * Bug 22989: Fix dimensions of new windows on macOS - * Translations update - -1.9.8 - * Bug 22610: Avoid crashes when canceling external helper app related downloads - * Bug 22472: Fix FTP downloads when external helper app dialog is shown - * Bug 22471: Downloading pdf files via the PDF viewer download button is broken - * Bug 22618: Downloading pdf file via file:/// is stalling - * Bug 22542: Resize slider window to work without scrollbars - * Bug 21999: Fix display of language prompt in non-en-US locales - * Bug 18193: Don't let about:tor have chrome privileges - * Bug 22535: Search on about:tor discards search query - * Bug 21948: Going back to about:tor page gives "Address isn't valid" error - * Code clean-up - * Translations update - -1.9.7.5 - * Bug 21999: Fix display of language prompt in non-en-US locales - * Bug 18193: Don't let about:tor have chrome privileges - * Bug 22535: Search on about:tor discards search query - * Bug 21948: Going back to about:tor page gives "Address isn't valid" error - * Code clean-up - * Translations update - -1.9.7.4 - * Bug 22542: Security Settings window too small on macOS 10.12 - -1.9.7.3 - * Bug 22104: Adjust our content policy whitelist for ff52-esr - * Bug 22457: Allow resources loaded by view-source:// - * Bug 21627: Ignore HTTP 304 responses when checking redirects - * Bug 22459: Adapt our use of the nsIContentPolicy to e10s mode - * Translations update - -1.9.7.2 - * Bug 21865: Update our JIT preferences in the security slider - * Bug 21747: Make 'New Tor Circuit for this Site' work in ESR52 - * Bug 21745: Fix handling of catch-all circuit - * Bug 21547: Fix circuit display under e10s - * Bug 21268: e10s compatibility for New Identity - * Bug 21267: Remove window resize implementation for now - * Bug 21201: Make Torbutton multiprocess compatible - * Translation updates - -1.9.7.1 - * Bug 21396: Allow leaking of resource/chrome URIs (off by default) - * Bug 21574: Add link for zh manual and create manual links dynamically - * Bug 21330: Non-usable scrollbar appears in tor browser security settings - * Bug 21324: Don't update NoScript button with timer update - * Translation updates - -1.9.7 - * Bug 19898: Use DuckDuckGo on about:tor - * Bug 21091: Hide the update check menu entry when running under the sandbox - * Bug 21243: Add links to es, fr, and pt Tor Browser manual - * Bug 21194: Show snowflake in the circuit display - * Bug 21131: Remove 2016 donation banner - * Translation updates - -1.9.6.12 - * Bug 20951: Back out Unix domain socket related patches for Tor Browser 6.5 - * Bug 19898: Use DuckDuckGo on about:tor - * Bug 21243: Add links to es, fr, and pt Tor Browser manual - * Bug 21091: Hide the update check menu entry when running under the sandbox - * Bug 21131: Remove 2016 donation banner - * Bug 14429: Make sure the automatic resizing is disabled - * Translation updates - -1.9.6.9 - * Bug 20947: Donation banner improvements - -1.9.5.13 - * Bug 20947: Donation banner improvements - -1.9.6.8 - * Bug 16622: Timezone spoofing moved to tor-browser.git - * Bug 20701: Allow the directory listing stylesheet in the content policy - * Bug 20556: Use pt-BR strings from now on - * Bug 20614: Add links to Tor Browser User Manual - * Bug 20414: Fix non-rendering arrow on OS X - * Bug 20728: Fix bad preferences.xul dimensions - * Bug 20318: Remove helpdesk link from about:tor - * Bug 20753: Remove obsolete StartPage locale strings - * Translation updates - -1.9.6.7 - * Bug 20414: Add donation banner on about:tor for 2016 campaign - * Bug 20111: use Unix domain sockets for SOCKS port by default - * Bug 19459: Move resizing code to tor-browser.git - * Bug 20264: Change security slider to 3 options - * Bug 20347: Enhance security slider's custom mode - * Bug 20123: Disable remote jar on all security levels - * Bug 20244: Move privacy checkboxes to about:preferences#privacy - * Bug 17546: Add tooltips to explain our privacy checkboxes - * Bug 17904: Allow security settings dialog to resize - * Bug 18093: Remove 'Restore Defaults' button - * Bug 20373: Prevent redundant dialogs opening - * Bug 20388+20399+20394: Code clean-up - * Translation updates - -1.9.5.12 - * Bug 20414: Add donation banner on about:tor for 2016 campaign - * Translation updates - -1.9.6.4 - * Bug 17334: Move referrer spoofing for .onion domains into tor-browser.git - * Bug 17767: Make "JavaScript disabled" more visible in Security Slider - -1.9.6.2 - * Bug 18589: Clear site security settings during New Identity - * Bug 19906: "Maximizing Tor Browser" Notification can exist multiple times - * Bug 19837: Whitelist internal URLs that Firefox requires for media - * Bug 15852: Remove/synchronize Torbutton SOCKS pref logic - * Bug 19733: GETINFO response parser doesn't handle AF_UNIX entries + IPv6 - * Bug 14271: Make Torbutton work with Unix Domain Socket option - * Translation updates - -1.9.5.7 - * Bug 18589: Clear site security settings during New Identity - * Bug 19906: "Maximizing Tor Browser" Notification can exist multiple times - -1.9.6.1 - * Bug 19206: Avoid SOCKS auth and NEWNYM collisions when sharing a tor client - * Bug 19417: Disable asm.js (but add code to clear on New Identity if enabled) - * Bug 19689: Plugin usage prompt is parented to wrong window - * Bug 19273: Improve external app launch handling and associated warnings - * Bug 8725: Block addon resource and url fingerprinting with nsIContentPolicy - -1.9.5.6 - * Bug 19417: Disable asmjs for now - * Bug 19689: Use proper parent windows for plugin prompt - -1.9.5.5 - * Bug 19417: Clear asmjscache - -1.9.6 - * Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu - * Bug 18905: Hide unusable items from help menu - * Bug 17599: Provide shortcuts for New Identity and New Circuit - * Bug 18980: Remove obsolete toolbar button code - * Bug 18238: Remove unused Torbutton code and strings - * Translation updates - * Code clean-up - -1.9.5.4 - * Bug 18466: Make Torbutton compatible with Firefox ESR 45 - * Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu - * Bug 18905: Hide unusable items from help menu - * Bug 16017: Allow users to more easily set a non-tor SSH proxy - * Bug 17599: Provide shortcuts for New Identity and New Circuit - * Bug 18980: Remove obsolete toolbar button code - * Bug 14429: Make sure the automatic resizing is disabled - * Translation updates - * Code clean-up - -1.9.5.3 - * Bug 18466: Make Torbutton compatible with Firefox ESR 45 - * Translation updates - -1.9.5.2 - * Bug 18557: Exempt Graphite preference from Security Slider - -1.9.4.5 - * Bug 18557: Exempt Graphite preference from Security Slider - -1.9.5.1 - * Bug 16990: Don't mishandle multiline commands - * Bug 18144: about:tor update arrow position is wrong - * Bug 16725: Allow resizing with non-default homepage - * Bug 16017: Allow users to more easily set a non-tor SSH proxy - * Translation updates - -1.9.4.4 - * Bug 16990: Don't mishandle multiline commands - * Bug 18144: about:tor update arrow position is wrong - * Bug 16725: Allow resizing with non-default homepage - * Translation updates - -1.9.5 - * Bug 16990: Show circuit display for connections using multi-party channels - * Bug 18019: Avoid empty prompt shown after non-en-US update - * Bug 18004: Remove Tor fundraising donation banner - * Code cleanup - * Translation updates - -1.9.4.3 - * Bug 16990: Show circuit display for connections using multi-party channels - * Bug 18019: Avoid empty prompt shown after non-en-US update - * Bug 18004: Remove Tor fundraising donation banner - * Bug 16940: After update, load local change notes - * Bug 17108: Polish about:tor appearance - * Bug 17568: Clean up tor-control-port.js - * Bug 16620: Move window.name handling into a Firefox patch - * Bug 17351: Code cleanup - * Translation updates - -1.9.4.2 - * Bug 16940: After update, load local change notes - * Bug 16990: Avoid matching '250 ' to the end of node name - * Bug 17108: Polish about:tor appearance - * Bug 17565: Tor fundraising campaign donation banner - * Bug 17568: Clean up tor-control-port.js - * Bug 17770: Fix alignments on donation banner - * Bug 17792: Include donation banner in some non en-US Tor Browsers - * Translation updates - -1.9.4.1 - * Bug 9623: Spoof Referer when leaving a .onion domain - * Bug 16620: Move window.name handling into a Firefox patch - * Bug 17164: Don't show text-select cursor on circuit display - * Bug 17351: Remove unused code - * Translation updates - -1.9.4 - * Bug 16937: Don't translate the hompepage/spellchecker dictionary string - * Bug 16735: about:tor should accommodate different fonts/font sizes - * Bug 16887: Update intl.accept_languages value - * Bug 15493: Update circuit display on new circuit info - * Bug 16797: brandShorterName is missing from brand.properties - * Translation updates - -1.9.3.7 - * Bug 16990: Avoid matching '250 ' to the end of node name - * Bug 17565: Tor fundraising campaign donation banner - * Bug 17770: Fix alignments on donation banner - * Bug 17792: Include donation banner in some non en-US Tor Browsers - * Translation updates - -1.9.3.5 - * Bug 9623: Spoof Referer when leaving a .onion domain - * Bug 16735: about:tor should accommodate different fonts/font sizes - * Bug 16937: Don't translate the hompepage/spellchecker dictionary string - * Bug 17164: Don't show text-select cursor on circuit display - * Bug 17351: Remove unused code - * Translation updates - -1.9.3.4 - * Bug 16887: Update intl.accept_languages value - * Bug 15493: Update circuit display on new circuit info - * Bug 16797: brandShorterName is missing from brand.properties - * Bug 14429: Make sure the automatic resizing is disabled - * Translation updates - -1.9.3.3 - * Bug 14429: Make sure the automatic resizing is enabled - -1.9.3.2 - * Bug 16731: TBB 5.0 a3/a4 fails to download a file on right click - * Bug 16730: Reset NoScript whitelist on upgrade - * Bug 16722: Prevent "Tiles" feature from being enabled after upgrade - * Bug 16488: Remove "Sign in to Sync" from the browser menu (fixup) - * Bug 14429: Make sure the automatic resizing is disabled - * Translation updates - -1.9.3.1 - * Bug 16268: Show Tor Browser logo on About page - * Bug 16639: Check for Updates menu item can cause update failure - * Bug 15781: Remove the sessionstore filter - * Bug 15656: Sync privacy.resistFingerprinting with Torbutton pref - -1.9.3.0 - * Bug 16427: Use internal update URL - * Bug 16200: Update Cache API usage and prefs for FF38 - * Bug 16357: Use Mozilla API to wipe permissions db - -1.9.2.8 - * Bug 16403: Set search parameters for Disconnect - * Bug 14429: Make sure the automatic resizing is disabled - * Translation updates - -1.9.2.7 - * Bug 14429: Make sure the automatic resizing is enabled - -1.9.2.6 - * Bug 15984: Disabling Torbutton breaks the Add-ons Manager - * Bug 14429: Make sure the automatic resizing is disabled - * Translation updates - -1.9.2.5 - * Translation updates - -1.9.2.4 - * Bug 14429: Improved automatic window resizing - -1.9.2.3: - * Bug 15837: Show descriptions if unchecking custom mode - * Bug 15927: Force update of the NoScript UI when changing security level - * Bug 15915: Hide circuit display if it is disabled. - -1.9.2.2: - * Bug 15795: Some security slider prefs do not trigger custom checkbox - -1.9.2.1: - * Bug 14429: Disable window resizing for now. - -1.9.2.0: - * Bug 15562: Bind SharedWorkers to thirdparty pref - * Bug 15533: Restore default security level when restoring defaults - * Bug 15510: Close Tor Circuit UI control port connections on New Identity - * Bug 15472: Make node text black in circuit status UI. - * Bug 15502: Wipe blob URIs on New Identity - -1.9.1.0: - * Bug 9387: "Security Slider 1.0" - * Include descriptions and tooltip hints for security levels - * Notify users that the security slider exists - * Flip slider so that "low" is on the bottom - * Make use of new SVG and MathML prefs - * Bug 13766: Set a 10 minute circuit lifespan for non-content requests - * Bug 15460: Ensure FTP urls use content-window circuit isolation - * Bug 13650: Clip initial window height to 1000px - * Bug 14429: Ensure windows can only be resized to 200x100px multiples - * Bug 15334: Display Cookie Protections menu if disk records are enabled - * Bug 14324: Show HS circuit in Tor circuit display - * Bug 15086: Handle RTL text in Tor circuit display - * Bug 15085: Fix about:tor RTL text alignment problems - * Bug 10216: Add a pref to disable the local tor control port test - * Bug 14937: Show meek and flashproxy bridges in tor circuit display - * Bugs 13891+15207: Fix exceptions/errors in circuit display with bridges - * Bug 13019: Change locale hiding pref to boolean - * Bug 7255: Warn users about maximizing windows - * Bug 14631: Improve profile access error msgs (strings). - -1.9.0.0 - * Bug 13882: Fix display of bridges after bridge settings have been changed - * Bug 5698: Use "Tor Browser" branding in "About Tor Browser" dialog - * Bug 10280: Strings and pref for preventing plugin initialization. - * Bug 14866: Show correct circuit when more than one exists for a given domain - * Bug 9442: Add New Circuit button to Torbutton menu - * Bug 9906: Warn users before closing all windows and performing new identity. - * Bug 8400: Prompt for restart if disk records are enabled/disabled. - * Bug 14630: Hide Torbutton's proxy settings tab. - * Bug 14632: Disable Cookie Manager until we get it working. - * Bug 11175: Remove "About Torbutton" from onion menu. - * Bug 13900: Remove SafeCache code. - * Bug 14490: Use Disconnect search in about:tor search box - * Bug 14392: Don't steal input focus in about:tor search box - * Bug 11236: Don't set omnibox order in Torbutton (to prevent translation) - * Bug 13406: Stop directing users to download-easy.html.en on update - * Bug 9387: Handle "custom" mode better in Security Slider - * Bug 12430: Bind jar: pref to Security Slider - * Bug 14448: Restore Torbutton menu operation on non-English localizations - -1.8.1.3 - * Bug 13998: Handle changes in NoScript 2.6.9.8+ - * Bug 14100: Option to hide NetworkSettings menuitem - * Bug 13079: Option to skip control port verification - * Bug 13835: Option to change default Tor Browser homepage - * Bug 11449: Fix new identity error if NoScript is not enabled - * Bug 13881: Localize strings for tor circuit display - * Bug 9387: Incorporate user feedback - * Bug 13671: Fixup for circuit display if bridges are used - * Translation updates - -1.8.1.2 - * Bug 13672: Make circuit display optional - * Bug 13671: Make bridges visible on circuit display - * Bug 9387: Incorporate user feedback - * Bug 13784: Remove third party authentication tokens - -1.8.1.1 - * Bug 13751: Remove remaining SafeCache code. - -1.8.1.0 - * Bug 13746: Properly link Torbutton UI to thirdparty pref. - * Bug 13742: Remove SafeCache code (in favor of C++ implementation) - -1.8.0.3 - * misc: Translation imports for security slider - -1.8.0.2 - * Bug 13666: Various fixes for circuit status display - -1.8.0.1 - * Bug 13651: Fix hangs associated with circuit status UI from #8641. - -1.8.0.0 - * Bug 9387: Provide a "Security Slider" for vulnerability surface reduction - * Bug 13019: Synchronize locale spoofing pref with our Firefox patch - * Bug 3455: Use SOCKS user+pass to isolate all requests from the same url domain - * Bug 8641: Create browser UI to indicate current tab's Tor circuit IPs - -1.7.0.2 - * Bug 13019: Synchronize locale spoofing pref with our Firefox patch - * Bug 13746: Properly link Torbutton UI to thirdparty pref. - -1.7.0.1 - * Bug 13378: Prevent addon reordering in toolbars on first-run. - -1.7.0.0 - 9 Oct 2014 - * Bug 10751: Adapt Torbutton to ESR31's Australis UI. - * Bug 13138: ESR31-about:tor shows "Tor is not working" - * Bug 12947: Adapt session storage blocker to ESR 31. - * Bug 10716: Take care of drag/drop events in ESR 31. - * Bug 13366: Fix cert exemption dialog when disk storage is enabled. - -1.6.12.3 - 23 Sep 2014 - * Bug 10804: Workaround for some TBB startup hangs - -1.6.12.2 - 22 Sep 2014 - * Bug 13091: Use "Tor Browser" everywhere - -1.6.12.1 - 1 Sep 2014 - * Bug 12684: Add `canvas.notNow` UI strings to torbutton.properties file. - * Bug 8940: Move RecommendedTBBVersions file to www.torproject.org. - -1.6.12.0 - 4 Aug 2014 - * Bug 9531: Workaround to avoid rare hangs during New Identity - -1.6.11.1 - 24 Jul 2014 - * Bug 11472: Adjust about:tor font and logo positioning to avoid overlap - * Bug 12680: Fix Torbutton about url. - -1.6.11.0 - 27 Jun 2014 - * Bug 10819: Bind new third party isolation pref to Torbutton security UI - * Bug 9268: Fix some window resizing corner cases with DPI and taskbar size. - -1.6.10.1 - 26 Jun 2014 - * Bug #12221: Remove obsolete Javascript components from the toggle era - -1.6.10.0 - 5 Jun 2014 - * Bug 11510: about:tor should not report success if tor proxy is unreachable - * Bug 11783: Avoid b.webProgress error when double-clicking on New Identity - * Bug 11722: Add hidden pref to force remote Tor check - * Bug 11763: Fix pref dialog double-click race that caused settings to be reset - -1.6.9.0: - 25 Apr 2014 - * Bug 7439: Improve download warning dialog text. - * Bug 11384: Completely remove hidden toggle menu item. - -1.6.8.0: - 7 Apr 2014: - * Bug 9010: Add Turkish to update locales. - * Bug 11242: Fix improper "update needed" message after in-place upgrade. - * Bug 10398: Ease translation of about:tor page elements - -1.6.7.0: - 7 Mar 2014: - * Bug 9901: Fix browser freeze due to content type sniffing - * Bug 10611: Add Swedish (sv) to extra locales to update - -1.6.6.0: - 3 Feb 2014 - * Bug 10800: Prevent exception in New Identity - * Bug 10640: Fix about:tor's pointer position for RTL languages. - * Bug 10095: Make inner window a multiple of 200x100 - * Bug 10285: Clear permissions on New Identity - * Bug 9738: Fix for auto-maximizing on browser start - * Bug 10682: Workaround to really disable updates for Torbutton. - * Bug 10419: Don't allow connections to localhost - * Bug 10140: Move Japanese to extra locales - * Bug 10687: Add Basque (eu) to extra locales - -1.6.5.5: - 20 Jan 2014 - * Bug 9486: Properly clear NoScript Temporary Permissions - -1.6.5.4: - 14 Jan 2014 - * Bug 10537: Include Arabic locale in Torbutton. - -1.6.5.3: - 23 Dec 2013 - * Bug 9486: Clear NoScript Temporary Permissions on New Identity - -1.6.5.2: - 17 Dec 2013 - * Misc: Change the default update download link back to download-easy - -1.6.5.1: - 10 Dec 2013 - * Bug 10352: Clear FF24 Private Browsing Mode data during New Identity - -1.6.5: - 9 Dec 2013 - * Bug 8167: Update cache isolation to use getFirstPartyURIFromChannel() for FF24 - * Bug 10201: FF ESR 24 hangs during exit on Mac OS. - * Bug 10078: Properly clear crypto tokens during New Identity on FF24 - * Bug 9454: Support changes to Private Browsing Mode and plugin APIs in FF24 - -1.6.4.1: - 15 Nov 2013 - * Bug 10002: Make the TBB3.0 blog tag our update download url for now. - -1.6.4: - 29 Oct 2013 - * Bug 9144: Workaround for missing translation properties - -1.6.3: - 11 Oct 2013: - * Bug 9224: Support multiple Tor socks ports for about:tor status check - * Bug 9587: Add TBB version number to about:tor - -1.6.2.1: - 23 Sep 2013: - * Bug 8839: Switch about:tor search link to unfiltered startpage link - -1.6.2: - 18 Sep 2013 - * bug 9492: Fix Torbutton logo on OSX and Windows (and related - initialization code) - -1.6.1: - 01 Aug 2013 - * bug 8478: Change when window resizing code fires to avoid rounding errors - * bug 9331: Hack an update URL for the next TBB release - * bug 9144: Change an aboutTor.dtd string to something transifex might accept - -1.6.0: - 05 Jun 2013 - * bug 7494: Create a local home page for TBB as about:tor - * misc: Perform a control port test of proper Tor configuration by default. - Only use check.torproject.org if the control port is unavailable. - * misc: Add an icon menu option for Tor Launcher's Network Settings - * misc: Add branding string overrides (primarily controls browser name and - homepage) - -1.5.2: - 22 Apr 2013 - * bug 8457: Allow session restore if the user allows disk actvity - * bug 8301: Remove the Display Settings panel and associated locales - * bug 6566: Fix "Transparent Torification" option. - * bug 8642: Fix a hang on New Identity. - -1.5.1: - 07 Mar 2013 - * bug 8324: Fix Drag+Drop crash by using a new TBB drag observer - * bug 6202: Fix XML/E4X errors with Cookie Protections - * bug 8423: Don't clear cookies at shutdown if user wants disk history - * bug 8382: Leave IndexedDB and Offline Storage disabled. - * bug 8422: Clear DOM localStorage on New Identity. - * bug 8335: Don't strip "third party" HTTP auth from favicons - * bug 5183: Localize the "Spoof english" button strings - * bug 8313: Ask user for confirmation before enabling plugins - * misc: Emit private browsing session clearing event on "New Identity" - -1.5.0 - 18 Feb 2013 - * bug 5279: Remove old toggle observers and related code - * bug 3100: Simplify Security Preference UI and associated pref updates - * bug 1305: Eliminate redundancy in our Flash/plugin disabling code - * bug 3944: Leave most preferences under Tor Browser's control - * bug 7974: Disable toggle-on-startup and crash detection logic - * bug 5279: Disable/remove toggle-mode code and related observers - * bug 6431: Add menu hint to Torbutton icon - * bug 7495: Make Torbutton icon flash a warning symbol if TBB is out of date - * bug 6096: Perform version check every time there's a new tab. - * bug 6156: Rate limit version check queries to once every 1.5hrs max. - * misc: Allow WebGL and DOM storage. - * misc: Disable independent Torbutton updates - * misc: Change the recommended SOCKSPort to 9150 (to match TBB) - -1.4.6.3 - 9 Oct 2012 - * bug 5856: Disable JS hooks to make way for direct Firefox patch - -1.4.6.2 - 12 Sep 2012 - * bug 6803: Set proxy settings earlier to fix broken homepage load on FF15 - * bug 6254: Support transparent Tor mode through TOR_TRANSPROXY=1 env var. - -1.4.6.1 - 30 Aug 2012 - * Bug 6737: Disable window.screen hooks for FF15+ (fixes exception alert) - -1.4.6 - 30 May 2012 - * Bug 5710: Prevent all sessionstore data saving in TBB - * Bug 5715: Explicitly clear image cache on TBB New Identity - * Bug 4660: Clear search and find boxes on TBB New Identity - * Bug 5729: Make New Identity and New Window a multiple of 200x100px - * Bug 4755: Spoof screen coordinates for DOM MouseEvents - * Bug 4718: Make TBB version check happen on New Window+New Identity - * Bug 5758: Disable WebSockets and IndexedDB for non-TBB users - * Bug 5863: Remove the ability to toggle Torbutton (to prevent leaks) - * Bug 3838: Inform Torbutton users about TBB - * Bug 5092: Sign Torbutton Updates - * Bugs 5673+5732: Change captcha redirect to startpage.com - * Bug 3845: Bump Firefox user agent to 10.0-ESR - -1.4.5.1 - 17 Dec 2011 - * bug 4722: Fix ability to drag tabs on Windows (due to #4517) - -1.4.5 - 14 Dec 2011 - * bug 4517: Disable external drag and drop (prevents proxy bypass) - * bug 4099: Disable TLS session tickets to prevent linkability - * bug 4603: Lower HTTP keep-alive timeout to reduce linkability - * bug 4611: Notify user if "New Identity" fails - * bug 4667: Close keep-alive connections on "New Identity" (TBB only) - * bug 4453: Reset SOCKS host and port only when using "recommended settings" - * misc: Perform versioncheck at startup regardless of session restore status - -1.4.4.1 - 11 Oct 2011 - * misc: Fix a homepage load error on Windows TBB first-run - -1.4.4 - 9 Oct 2011 - * bug 4197: Allow Torbutton formfill blocking to be disabled - * bug 4058: Fix yet more issues with links opening in new tabs - * bug 4161: Make TBB version check work w/ SocksPort auto builds - * bug 3686: Fix loading of localized homepage on Debian - * bug 4016: Resize window on "New Identity" - * bug 3928: Implement CookieAuthFile password reading - * misc: Fix scoping issue for some stream variables - -1.4.3 - 9 Sep 2011 - * bug 3933: Don't touch app.update.auto in TBB - * bug 3960: Don't disable zoom.siteSpecific on TBB - * bug 3928: Fix auto-scroll on twitter - * bug 3649: Make permissions and disk errors human-readable - -1.4.2 - 3 Sep 2011 - * bug 3879: Fix broken framed sites (yopmail, gmane, gmaps, etc) - * bug 3337: Fetch check.tp.o page to check versions (TBB only) - * Bug 3754: Fix SafeCache OCSP errors (fix for TBB only) - -1.4.1 - 28 Aug 2011 - * bug 523: Implement New Identity (for TBB only) - * bug 3580: Fix hotmail/live breakage (TBB only) - * bug 3748: Disable 3rd party HTTP auth - * bug 3665: Fix several corner cases SafeCache isolation - * bug 3739: Fix https->http CORS failure for SafeCache - * bug 3414: Isolate window.name based on referrer policy - * bug 3809: Disable referer spoofing (fixes navigation issues) - * bug 3819: Fix API issue with cookie protections - * bug 3820: Fix warning w/ session store filter - -1.4.0 - 30 Jun 2011 - * bug 3101: Disable WebGL. Too many unknowns for now. - * bug 3345: Make Google Captcha redirect work again. - * bug 3399: Fix a reversed exception check found by arno. - * bug 3177: Update torbutton to use new TorBrowser prefs. - * bug 2843: Update proxy preferences window to support env var. - * bug 2338: Force toggle at startup if tor is enabled - * bug 3554: Make Cookie protections obey disk settings - * bug 3441: Enable cookie protection UI by default. - * bug 3446: We're Firefox 5.0, we swear. - * bug #3506: Remove window resize event listener. - * bug #1282: Set fixed window size for each new window. - * bug #3508: Apply Stanford SafeCache patch (thanks Edward, Collin et al). - * bug #2361: Make about window work again on FF4+. - * bug #3436: T(A)ILS was renamed to Tails. - * bugfix: Fix a transparent context menu issue on Linux FF4+. - * misc: Squelch exception from app launcher in error console. - * misc: Make DuckDuckGo the default Google Captcha redirect destination. - * misc: Make it harder to accidentally toggle torbutton. - -1.3.3-alpha - 01 May 2011 - * bug 2777: Clear OCSP cache on tor toggle - * bug 2832: Update spoofed user agent to Firefox 4.0 - * bug 2838: Make cookie protections dialog work - * bug 2819: Move JS hooks to new JS1.8.5 hooking support on FF4. - * bug 3042: Fix version compatibility issue with FF4.0.1+ - -1.3.2-alpha - 21 Mar 2011 - * bug 1624: Use nsIDOMCrypto::logout() instead of the SSLv2 pref hack - * bug 1999: Disable tor:// urls by default - * bug 1968: Reset window.name on tor toggle - * bug 2148: Make refspoofing more uniform - * bug 2359: Fix XHTML DTD errors on FF4 - * bugs 2465+2421: Fix javascript hook exceptions+issues in FF4.0 - * bug 2458: Opt out of Firefox addon usage pings - * bug 2377: Limit the Google captcha cookies copied between google TLDs - * bug 2491: Clean up checks for when to jar protected cookies - * bug 1110: Add popup to ask if we should spoof English Accept: headers - * misc: Remove a noisy FF2 nsICookieManager2 fallback check. - -1.3.1-alpha - 03 Jan 2011 - * bugfix: bug 1894: Amnesia is now called TAILS (patch from intrigeri) - * bugfix: bug 2315: Remove reference to TorVM (patch from intrigeri) - * bugfix: bug 2011: Fix preference dialog issues (patch from chrisdoble) - * bugfix: Fix some incorrect log lines in RefSpoofer - * new: Support Firefox 4.0 (many changes) - * new: Place button in the nav-bar (FF4 killed the status-bar) - * misc: No longer reimplement the session store, use new APIs instead - * misc: Simplify crash detection and startup mode settings - -1.3.0-alpha - 30 Sep 2010 - * new: Support for transparent proxies in settings - (patch from Jacob Appelbaum and Kory Kirk) - * new: tor:// and tors:// url support to auto-toggle into tor mode - (patch from Kory Kirk) - * new: Cookie manager to allow individual Cookie protection - (patch from Kory Kirk) - * new: Add referrer spoofing based on modified same origin policy - (patch from Kory Kirk) - * new: Add DuckDuckGo.com as a Google captcha redirect destination - (patch from aiden tighe) - * bugfix: bug 1911: Fix broken useragent locale string on debian - (patch from lunar) - * bugfix: Fix captcha detection for encrypted.google.com - -1.2.5 - 08 Apr 2010 - * bugfix: bug 1169: Fix blank popup conflict with CoolPreviews - * bugfix: bug 1246: Fix IST and other HH:30 timezone issues. - * bugfix: bug 1219: Fix the toggle warning loop issue on settings change. - * bugfix: bug 1321: Fix a session restore bug when closing the last window - * bugfix: bug 1302: Update useragent to FF3.6.3 on WinNT6. - * bugfix: bug 1157: Add logic to handle torbutton crashed state conflicts - * bugfix: bug 1235: Improve the 'changed-state' refresh warning message - * bugfix: bug 1337: Bind alert windows to correct browser window - * bugfix: bug 1055: Make the error console the default log output location - * bugfix: bug 1032: Fix an exception in the localhost proxy filter - * misc: Always tell a website our window size is rounded even if it's not - * misc: Add some suggestions to warning about loading external content - * new: Add option to always update Torbutton via Tor. On by default - * new: Redirect Google queries elsewhere on captcha (default ixquick) - * new: Strip identifying info off of Google searchbox queries - -1.2.4 - 16 Dec 2009 - * bugfix: bug 1169: Fix blank popup conflict with Google Toolbar - * bugfix: bug 1171: Properly store and set network.dns.disablePrefetch - * bugfix: bug 1165: Fix an exception on toggle in FF3.6 - * bugfix: bug 1163: Fix history loss in FF3.6 - * bugfix: Fix a typo error during logging - * bugfix: Properly handle session restore in FF3.6 - * misc: Kill a warning message about missing properties in window-mapper.js - * new: Add a new pref to disable Livemark updates during Tor usage (FF3.5+) - -1.2.3 - 02 Dec 2009 - * bugfix: bug 950: Preserve useragent and download settings across toggle - * bugfix: bug 1014: Fix XML Parsing Error on XHTML sites in Tor mode - * bugfix: bug 1041: Preserve tab history in FF3.5 - * bugfix: bug 1047: Fix spurious user agent change notice - * bugfix: bug 1053: Partial fix for 'TypeError: browser is undefined' error - * bugfix: bug 1084: Preserve HTTP accept language for Non-Tor usage - * bugfix: bug 1085: Fix test settings issues with dead privoxy - * bugfix: bug 1088: Clean up some namespace issues in the main chrome window - * bugfix: bug 1091: Fix a lockup when 'Ask Every Time' cookie pref is set - * bugfix: bug 1093: Fix cert acceptance dialogs in Firefox 3.5 - * bugfix: bug 1146: Fixes for properly handling tab restore in FF3.5 - * bugfix: bug 1152: Close tabs on toggle prevents toggling in FF3.5" - * bugfix: bug 1154: Clarify "Last Tor test failed" message - * misc: Disable geolocation in FF3.5 during Tor mode - * misc: Disable DNS prefetch in FF3.5 in Tor mode and for Tor-loaded tabs - * misc: Disable offline app cache during Tor mode - * misc: Disable specific site zoom settings during Tor mode - * new: Transfer Google cookies between country-code domains. This should - make it such that captchas only need to be solved once per Tor session, - as opposed to for each country. - -1.2.2 - 09 Aug 2009 - * bugfix: Workaround Firefox Bug 440892 to prevent external apps from - being launched (and thus bypassing proxy settings) without user - confirmation. Independently reported by Greg Fleischer and optimist. - * bugfix: Create a separate "No Proxy For" option and remove the - string "localhost" from proxy exemptions. Prevents a theoretical - proxy bypass condition discovered by optimist. Fix based on patch from - optimist. - * bugfix: bug 970: Purge undo tab list on Tor toggle. - * bugfix: bug 1040: Scrub URLs from log level 4 and higher log messages. - Mac OS writes Firefox console messages to disk by default. - * bugfix: bug 1033: Fix FoxyProxy conflict that caused some FoxyProxy - strings to fail to display. - * misc: bug 1006: Pop up a more specific failure message for pref - changing errors during Tor toggle. - * misc: Fix a couple of strict javascript warns on FF3.5 - * misc: Add chrome url protection call to conceal other addons during - non-Tor usage. Patch by Sebastian Lisken. - * misc: Remove torbutton log system init message that may have scared some - paranoids. - -1.2.1 - 21 Mar 2009 - * bugfix: bug 773: Fixed Noscript conflict issue. - * bugfix: bug 866: Fixed conflict with ZoTero - * bugfix: bug 908: Make UserAgentSwitcher's 'default' button restore - Torbutton's spoofed user agent if Tor is enabled. - * bugfix: bug 909: Get Torbutton to "properly" react to users changing - their Firefox cookie lifetime settings as opposed to using the Torbutton - interface. - * bugfix: bug 834: Fix session saving and startup issues - * bugfix: bug 875: Removed docShell == null popup during toggle for - some users - * bugfix: bug 910: fixed a locale spoofing issue in navigator.appVersion - * bugfix: bug 747: Attempt to fix 'fullscreen' resizing issues. - * bugfix: Stop-gap timezone spoofing fix for Linux and Mac - for FF3. Requires a one-line patch to Firefox for Windows to work. - * bugfix: Clear SSL Session IDs on toggle. (See FF Bug 448747) - * misc: bug 931: Added a socks v4 vs v5 version choice to custom prefs. - * misc: bug 836: redesign startup preference window to make it more - understandable - * misc: Torbutton now presents itself as Windows FF3.0.7. - * misc: Change RDF to allow Torbutton to run on FF3.1 betas. - -1.2.0 - 30 Jul 2008 - * bugfix: bug 777: Fix issue with locale spoofing breaking translations. - * bugfix: bug 778: Preserve locale in spoofed version if user does not want - locale spoofing. - * bugfix: bug 780: Keep session cookies during Tor toggle. - * bugfix: Potential fix for some PKCS#12 issues. - * bugfix: Fix crash recovery and uninstall/upgrade to avoid cookie loss. - * misc: Translation updates. - -1.2.0rc6: - 12 Jul 2008 - * bugfix: Fix bug causing Firefox history to get cleared in some situations - * bugfix: bug 753: Fix exception thrown during Tor toggle in some instances - * bugfix: bug 758: Fix resize issue where 0x0 windows could be created - * bugfix: Fix some potential permission denied issues with cookie jars - * bugfix: bug 520: Fix issue where Javascript stayed disabled in some tabs - * bugfix: Apply cookie lifetime settings to Tor settings on first install. - * bugfix: Don't disable Firefox preferences when Torbutton is uninstalled - * misc: Allow automatic updates in FF3 by default. They are secure now. - * misc: Translation updates - -1.2.0rc5 - 06 Jul 2008 - * bugfix: bug 734: Fix exception with clearing history on toggle - * bugfix: bug 735: Fix exception with blocking Non-Tor history writes - * bugfix: bug 720: FF3 cookie jar fix submitted by arno - * misc: translation updates for French, Farsi, and others - * misc: demote "mapper check" log message to info - * new: Option to not write cookie jars to disk submitted by arno - -1.2.0rc4 - 27 Jun 2008 - * misc: Refuse to jar cookies under Firefox 3. Lame workaround for Firefox - Bug 439384, but it's the best we can do. At least we won't destroy - cookies anymore. - * misc: Some strings were present twice in the en-US locale. Didn't seem - to cause any problems, but probably should be fixed. - -1.2.0rc3 - 27 Jun 2008 - * bugfix: Lots of compatibility updates with other extensions. Issues - with SpeedDial, Google Notebook, TabMixPlus, and others have been fixed. - * bugfix: Fix bug with first window/tab after restart being partially - prevented from performing network activity and/or history access. - * bugfix: Add an additional pref for blocking Non-Tor file url network - activity. Off by default. This should fix issues with Sage addon in - Non-Tor mode. - * bugfix: Be better about saving all sorts of Firefox prefs that we touch - so that users' Non-Tor preferences are remembered. - * bugfix: Fix potential issues with FF3 sessionstore by updating component, - and performing version detection. - * bugfix: Separate toggle into a 3 stage process to eliminate potential - race conditions and issues with javascript and other functionality - not working after Tor toggle. - * new: Added 'Test Settings' button to Proxy Preferences that uses - check.torproject.org to verify Tor status. - * misc: Improve 'Restore Defaults' to reset all prefs that we touch. - * misc: Fix logging system to be more user-legible. - -1.2.0rc2 - 08 Jun 2008 - * bugfix: MacOS: Fix broken Tor state/toggle issues when all windows are - closed but app stays open - * misc: Potential performance improvements when many windows+tabs are open - * new: Add 'locked mode' pref to allow users to disable one-click toggling - * new: Add prefs to start Firefox with a specific Tor state. - -1.2.0rc1 - 01 Jun 2008 - * general: FF3 should now be functional, but timezone masking is not - operational - * bugfix: Fix Places/history component hooking in FF3 - * bugfix: Disable Places database in FF3 via browser.history_expire_days=0 - if history writes are disabled. - * bugfix: General component hooking fixes for FF3 - * bugfix: Block favicon leaking in FF3 - * bugfix: Enable safebrowsing updates in FF3 (it's finally HMACd. Yay). - * bugfix: Use Greg Fleischer's new useragent prefs in FF3. - * bugfix: Properly reset cookie lifetime policy when user changes cookie - handling options. - * bugfix: Fix 'Restore defaults' button issues with custom proxy settings - * bugfix: navigator.oscpu hooking was broken in 1.1.18 - * bugfix: Try to prevent alleged 0x0 windows on crash recovery - * bugfix: Attempt to block livemarks updates during Tor. Only partial fix. - Not possible to cancel existing Livemarks timer (one fetch will still - happen via Tor before disable). See Firefox Bug 436250 - * misc: Set plugin.disable_full_page_plugin_for_types for all plugin - mimetypes just in case our custom full page blocking code fails - -1.1.18 - 17 Apr 2008 - * bugfix: Fix Gmail exceptions involving window.navigator that made Gmail - unusable after recent updates by Google. - * bugfix: Fix an exception in the content policy that may have prevented - some AJAX page elements from loading. - * bugfix: Fix regression on cross-state favicon leak introduced in 1.1.17 - * bugfix: Fix to make clear private data work again by fixing up history - hooking (may also help FF3 compatibility). - * bugfix: Fix Yahoo email account creation (broken due to Date.valueOf() - weirdness). - * bugfix: Fix to allow plugins if the user unchecks the plugin blocking - preference - * bugfix: Fix bug 638: eliminate cross-state history popup on session - restore - * bugfix: Only resize windows on document load. Hopefully this will make - the resizing code less annoying, and drift less. - * bugfix: Fix Object.prototype extensions involving the Date object - (observed on LiveJournal) - * bugfix: Fix javascript debugger compatibility issues involving source - window display and other functionality. - * misc: Prevent blocked popups from opening blank, unusable windows - * misc: Updated firefox version to 2.0.0.14 - * new: New translations for French, Russian, Farsi, Italian, and Spanish. - -1.1.17 - 15 Mar 2008 - * bugfix: Improve chrome disclosure protection (patch from Greg Fleischer) - * bugfix: Block network access from file urls to workaround Firefox - 'Content-Disposition' file stealing attack (found/fixed by Greg) - * bugfix: Apply Javascript hooks to javascript: urls (found by Greg) - * bugfix: Improve Torbutton chrome concealment (found by Greg) - * bugfix: Use 127.0.0.1 instead of localhost for IPv6 users - * bugfix: Don't resize maximized windows - * misc: Improve window resizing to only resize on document load, - and to try to address drift by remembering window sizes - * misc: Clear session history if clear history on tor toggle is set - * new: Remove history hooks in favor of nsISHistoryListeners that - prevent history navigation from alternate Tor states - -1.1.16 - 03 Mar 2008 - * bugfix: Fix yet more javascript unmasking issues found by Greg. - Date is still unmaskable. - * bugfix: Close tabs *before* toggling proxy settings if pref is set. - * bugfix: Fix a couple exceptions thrown on resizing and plugin canceling - -1.1.15 - 26 Feb 2008 - * bugfix: Fix hook unmasking of window.screen, window.history, - and window.navigator discovered by Greg Fleischer. window.Date - unmasking is still unfixed. window.history unmasking represents - potential IP disclosure due to Firefox Bug 409737. - * bugfix: Fix view-source extension disclosure bug found by Greg - Fleischer. - * bugfix: Fix javascript and about links. Found by Greg Fleischer. - * new: Attempt to prevent window sizes from drifting during resize. - -1.1.14 - 24 Feb 2008 - * bugfix: set general.useragent.locale if user wants to spoof an English - browser. This handles navigator.locale - * bugfix: Mask navigator.buildID. Reported by Greg Fleischer - * Initial Firefox 3 work. Functionality still broken due to FF Bug 413682 - * bug 580: Resize preferences window to fit in 640x480 displays - * new: Spoof window.screen to mask desktop resolution and resize the - browser to multiples of 50px while tor is enabled. - * new: Block content window access to chrome urls if Tor is enabled, - and hide Torbutton if Tor is disabled. Thanks to Greg Fleischer for - reporting the chrome disclosure issues - * new: Added option to close all opened tabs on a Tor toggle. Useful - for general convenience and also as a backup protection against - Bug 409737. - * new: Add Tor ports to the list of banned ports for Firefox. Should - prevent http-ping based fingerprinting attacks. - * new: Finally add support for automatic updates. - -1.1.13 - 01 Feb 2008 - * bugfix: Implement workarounds to disable Javascript network access - for Firefox Bug 409737 - * bugfix: Improved plugin-disabling workarounds for Firefox Bug 401296 - * misc: Set network.protocol-handler.warn-external.* to warn on external - app handlers during Tor usage - * misc: Disable browser.safebrowsing.enabled during Tor usage since it - retrieves some information in plaintext. - * misc: Disable browser.send_pings. - * misc: Block Javascript back/forward manipulation if Tor is enabled - * new: Option to clear HTTP auth on Tor toggle - -1.1.12 - 26 Nov 2007 - * bugfix: bug 520: Fix some content policy/tagging issues. Not sure if this - is the whole bug. - * bugfix: Fix a nasty bug where torbutton mostly broke if the first Firefox - window was closed (introduced in 1.1.11) - * bugfix: Fix a favicon proxy-leak discussed in onionland - -1.1.11 - 16 Nov 2007 - * bugfix: Fix a scope issue with the JS hooks that caused problems with - some sites (gmail, others?) - * misc: Performance enhancements for speeding up toggle - * new: Prevent Tor cookies from being written to disk if the user wants - them cleared. - -1.1.10 - 06 Nov 2007 - * bugfix: bug 522: Try harder to kill plugins before they do any network IO - (discovered by goldy) - * bugfix: bug 460: Remove hook verification. Attempt to apply hooks at every - location event. - * misc: New logging system - * new: Have user choose between starting in Tor or Non-Tor after crash. - Leaving it to Firefox is non-deterministic and should not be an option. - -1.1.9.1 - 23 Oct 2007 - * bugfix: 1.1.9 killed all plugins. Bring them back to life. - -1.1.9 - 21 Oct 2007 - * bugfix: bug 519: Fix Ubuntu Gutsy hang on startup. - * bugfix: bug 521: Fix yet more false positive popups introduced in 1.1.8 - * bugfix: bug 522: Block loading of direct clicks of plugin-handled content - (discovered by goldy). - -1.1.8 - 01 Oct 2007 - * bugfix: bug 503: Prevent sessionstore from writing Tor tabs to disk - * bugfix: bug 510: Decouple cookie clearing from Clear Private Data settings - * bugfix: bug 474: Decouple password+form saving from history writing - * bugfix: bug 460: Rework handling of hooking based on global events+window - lookup - * bugfix: Hooking fixes for pages with nested frames/iframes - * bugfix: Cookies are now properly synced before storing into a jar - * misc: Tightened up the alerts a bit more for the javascript hooking - * misc: Changed defaults to be less intrusive to non-tor usage - * new: Added options to start in Tor and reload cookies after browser crash - * new: Added ability to have both tor and non-tor cookie jars - -1.1.7 - 20 Sep 2007 - * bugfix: bug 495: couple of memory leaks found and fixed by arno - * bugfix: bug 497: uninstall exception found and fixed by arno - * bugfix: bug 460: No more alerts should happen. But does that mean its - fixed? Outlook uncertain... - * bugfix: bugs 461+489: verbosity+macos logging issues resolved - * bugfix: if javascript is disabled, the hooking code no longer complains - * misc: Update spoofed Firefox version to 2.0.0.6 - * new: "Restore Defaults" button added to the preferences window - -1.1.6 - 30 Jul 2007 - * bugfix: Fix an exception that may have messed up cookie/cache clearing - if you allowed Tor to write history URLs (possibly kills bug #457) - * bugfix: Use only sub-browsers for tagging. Could fix some Date hooking - misses (possibly kills bug #460) - * misc: Clean up annoying false positives with date hooking checks - -1.1.5 - 17 Jul 2007 - * bugfix: Reset shutdown option if user wants to manually manage cookies - * misc: Add code to detect date hooking failures to zero in on Bug #460 - * new: Pref to disable "DOM Storage" during Tor usage - -1.1.4 - Defcon CD Release - 6 Jul 2007 - * bugfix: Make plugin state tied to tab load state also - * bugfix: Date hooking bug. getUTCYear is not defined. Must call getYear.. - * new: Add options to spoof charset and language headers - * new: Add option to disable referer header. This can break some sites. - Seems to break digg in particular. - * new: Copy English strings to all language DTDs so they are at least - functional. - -1.1.3 - Black Hat CD Release - 30 Jun 2007 - * bugfix: Fully disable session store if option is set. Otherwise it - can save Tor tabs and cause them to be reloaded during Tor usage! - * new: Differentiate between crucial and recommended settings in preferences - -1.1.2 - 22 Jun 2007 - * bugfix: Make js hooking a bit more invisible - * bugfix: Improve navigator.* hooking for user agent spoofing - * new: Block session saving during tor usage - * new: Add options to clear cookies during Tor/Non-Tor shutdowns - -1.1.1 - 20 Jun 2007 - * bugfix: Remove Date hooks from DOM after inserted. Fixes some sites - who expect a fixed DOM structure. - * new: Integrated Collin Jackson's history blocking+cookie jar code, adapted - it to handle various Tor States+read/write differentiation. - * new: Allow users to manually manage cookies - * new: Mark tabs as having been fetched via Tor or in the clear - * new: Add code to only enable javascript on tabs with the same Tor load - state as the current - * new: options to clear the cache, block disk cache, or block all caching - * new: Created options tabbox - * new: Option to block updates if Tor was enabled - * new: Add nsIContentPolicy to block CSS popups from pages with a different - load state than current Tor State. - * new: Added user agent spoofing code - * new: Support FireFox 2.0 only - * new: Disable "safe browsing" remote lookups - * new: block session saving - - -1.1.0 - Security Development begins (Alpha branch) - 31 Mar 2007 - * new: Option to disable all plugins during Tor usage - * new: Javascript hooking to mask timezone for Date Object, attempted CSS fix - * new: Options to clear history and cookies on Tor toggle - * bugfix: Fix logging to use error console if logger extension not present - -1.0.5 - 18 Nov 2006 - * bugfix: fix the about box in firefox 1.0 - * bugfix: set the toolbar button to the correct state upon insertion into - the toolbar (ff >= 1.5 only) - * bugfix: clarify the wording of the one-liner extension description - * bugfix: bypassing privoxy with Firefox <= 1.0 is not recommended - * bugfix: remember previous "custom" proxy settings - * misc: new icons - * misc: keyboard shortcut re-assigned to ctrl-2 - * new: previous proxy settings are restored after exiting tor mode - * new: if the torbutton proxy settings are changed while torbutton is - enabled, then the active proxy settings are updated to reflect it - * new: added twelve locales - -1.0.4 - 01 Jun 2006 - * bugfix: without-privoxy settings were incorrect - * bugfix: https settings did not take effect until firefox restart - * bugfix: let firefox generate our about box, so it will include the version - -1.0.3 - 31 May 2006 - * bugfix: statusbar style would reset to text after firefox restart - -1.0.2 - 23 May 2006 - * bugfix: fixed problem with socks_remote_dns - * new: mozilla thunderbird support - * new: user may customize proxy settings for nonstandard configurations - * new: option to not use privoxy in the standard configuration - * new: slovenian translation - * new: french translation - * new: keyboard shortcut (control-shift-t, changeable via keyconfig) - * new: context menu for toolbar button and statusbar panel - * new: attractive tor icons - * new: about dialog - * new: option to display statusbar as an icon instead of text - -1.0.1 - 16 Mar 2006 - * bugfix: toolbar button tooltips now display the correct status - * bugfix: set socks5 proxy to tor port (9050) instead of privoxy (8118) - * bugfix: allow user to change proxy exclusion list ("no proxy for") - * new: use socks_remote_dns on firefox versions that have it - * new: added update functionality through the extensions manager - * new: added preference: display statusbar panel (yes/no) - * new: added compatibility with firefox 1.0 and 0.9 - -1.0 - 07 Mar 2006 - * initial release diff --git a/src/LICENSE b/src/LICENSE deleted file mode 100644 index c6bc6921..00000000 --- a/src/LICENSE +++ /dev/null @@ -1,53 +0,0 @@ -Copyright (c) 2006 Scott Squires, Oleg Ivanov - -Permission is hereby granted, free of charge, to any person obtaining a -copy of this software and associated documentation files (the "Software"), -to deal in the Software without restriction, including without limitation -the rights to use, copy, modify, merge, publish, distribute, sublicense, -and/or sell copies of the Software, and to permit persons to whom the -Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included -in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL -THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR -OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, -ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR -OTHER DEALINGS IN THE SOFTWARE. - --------------------------------------------------------------------------------- - -Date: Fri, 3 Mar 2006 03:16:21 +0200 -From: Oleg Ivanov -To: Scott Squires -Subject: Re: ProxyButton licensing question - -Hello Scott, - -I'm glad to support your project so you can use the Proxybutton in any way you -need under any open source license as it's stated in mozdev's copyright policy. -I'll just ask you to put in the Tor or it's source code any credits with -references to me and the original Proxybutton. Feel free to ask if you have -any questions regarding the extension - I'll be glad to help you. - -On Thursday 02 March 2006 05:01, you wrote: -> Hello, -> -> I am a volunteer for the Tor project, which is a network proxy with strong -> anonymnity. We would like to make it easier for users to install and -> configure the software, and would like a firefox button to enable/disable -> Tor. Your extension is very close to what we need, our version would just -> set the proxy for the user instead of the user needing to enter the -> information. So I was wondering what license your software is released under -> and whether we can use it as a base for this extension. -> -> Thanks! -> --Scott - --- -Oleg Ivanov -mailto: saruman@unigsm.com -ICQ #69991809 diff --git a/src/install.rdf b/src/install.rdf deleted file mode 100644 index 637483c3..00000000 --- a/src/install.rdf +++ /dev/null @@ -1,24 +0,0 @@ -<?xml version="1.0"?> -<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#" - xmlns:em="http://www.mozilla.org/2004/em-rdf#%22%3E - - <Description about="urn:mozilla:install-manifest"> - em:nameTorbutton</em:name> - em:creatorMike Perry</em:creator> - em:idtorbutton@torproject.org</em:id> - em:version2.1.6</em:version> - em:multiprocessCompatibletrue</em:multiprocessCompatible> - em:homepageURLhttps://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> - em:iconURLchrome://torbutton/skin/tor.png</em:iconURL> - em:updateURLdata:text/plain,</em:updateURL> - em:updateKey-</em:updateKey> - <!-- firefox --> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion60.0</em:minVersion> - em:maxVersion10000.0</em:maxVersion> - </Description> - </em:targetApplication> - </Description> -</RDF> diff --git a/trans_tools/old/mkmoz.sh b/trans_tools/old/mkmoz.sh deleted file mode 100755 index 1f2986bc..00000000 --- a/trans_tools/old/mkmoz.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/bash -x -# - -LOCALEDIR="../src/chrome/locale" - -poDir="po" -directories="`ls -1 ./$poDir|tr _ -`" -mozDir="moz" -input="en" -template="torbutton.dtd" - -for dir in $directories -do - pootleDir="`echo $dir|tr - _`"; - echo "$pootleDir" - mkdir -p $mozDir/$dir/ - po2moz -i $poDir/$pootleDir/ -t ${LOCALEDIR}/${input}/ -o $mozDir/$dir/ - #po2moz -i $poDir/$pootleDir/ -t pootle/templates/ -o $mozDir/$dir/ -done - diff --git a/trans_tools/old/mkpo.sh b/trans_tools/old/mkpo.sh deleted file mode 100755 index 5e06757a..00000000 --- a/trans_tools/old/mkpo.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/bash -x -# - -LOCALEDIR="../src/chrome/locale/" - -directories="ar de-DE es hr-HR nl-NL pt-BR sl-SI de-AT el-GR fa-IR it-IT pl-PL zh-CN de-CH fr-FR ru zh-TW" -outdir="po" -#input="en-US/torbutton.dtd" -input="en" -template="torbutton.dtd" - -for dir in $directories -do - pootleDir="`echo $dir|tr - _`"; - mkdir -p $outdir/$pootleDir/ - #moz2po -i $dir/$template -t $input -o $outdir/$pootleDir/torbutton.po - moz2po -i $LOCALEDIR/$dir/ -t $LOCALEDIR/$input/ -o $outdir/$pootleDir/ -done - - diff --git a/trans_tools/old/mvmoz.sh b/trans_tools/old/mvmoz.sh deleted file mode 100755 index 64ff4360..00000000 --- a/trans_tools/old/mvmoz.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/bash - -for locale in `ls -1 moz/`; -do - mv -v moz/$locale/*.{dtd,properties} ../src/chrome/locale/$locale/ -done diff --git a/trans_tools/old/new_tb_strings.sh b/trans_tools/old/new_tb_strings.sh deleted file mode 100755 index b0b4e30a..00000000 --- a/trans_tools/old/new_tb_strings.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/bash - -moz2po -P -i ../src/chrome/locale/en/ -o po/templates/ - -for i in `ls -1 po` -do - msgmerge -U ./po/$i/torbutton.dtd.po ./po/templates/torbutton.dtd.pot - msgmerge -U ./po/$i/torbutton.properties.po ./po/templates/torbutton.properties.pot - msgmerge -U ./po/$i/browser.dtd.po ./po/templates/browser.dtd.pot - msgmerge -U ./po/$i/browser.properties.po ./po/templates/browser.properties.pot -done - -svn diff po -svn commit po - -cd po -tx push --source -tx push --translation -cd .. - diff --git a/trans_tools/old/validate.py b/trans_tools/old/validate.py deleted file mode 100755 index 179e7b0f..00000000 --- a/trans_tools/old/validate.py +++ /dev/null @@ -1,94 +0,0 @@ -#!/usr/bin/python - -from __future__ import unicode_literals, print_function - -import polib -import sys -import getopt - -symbols = [ - '(', ')', '<', '>', '{', - '}', '[', ']', '"', ';' - ] - -counts = {} - -def reset(): - for s in symbols: - counts[s] = 0 - -def parse_orig_string(string): - for ch in string: - if ch in symbols: - counts[ch] += 1 - -def parse_trans_string(string): - for ch in string: - if ch in symbols: - counts[ch] -= 1 - -def get_strings(file): - entries = [] - po = polib.pofile(file, autodetect_encoding=True) - - for entry in po: - entries.append((entry.msgid, entry.msgstr, 0)) - - return entries - -def warn(): - for s in symbols: - if counts[s] < 0: - return True - return False - -def usage(): - print("Usage: %s -i/--input=<file.po> -l/--logfile=<logfile>" % sys.argv[0]) - -def log(string, file_to_check, log_file, linenum = -1): - f = log_file - if linenum == -1: - f.write(("%s: %s\n" % (file_to_check, string)).encode("utf-8")) - else: - f.write(("%s (%s): %s\n" % (file_to_check, linenum, string)).encode("utf-8")) - #f.close() - -def check(file_to_check, log_file): - errors = 0 - - strings = get_strings(file_to_check) - for (orig, trans, linenum) in strings: - reset() - parse_orig_string(orig) - parse_trans_string(trans) - if warn(): - errors += 1 - log(trans, file_to_check, log_file, linenum) - - if errors != 0: - log("Total count of warnings %d\n" % errors, file_to_check, log_file) - -if __name__ == '__main__': - try: - opts, args = getopt.getopt(sys.argv[1:], "i:hl:", ["input=", "help", "logfile="]) - except getopt.GetoptError, err: - print(str(err)) - sys.exit(2) - - file_to_check = None - log_file = sys.stdout - - for opt, arg in opts: - if opt in ("-i", "--input"): - file_to_check = arg - elif opt in ("-h", "--help"): - usage() - sys.exit() - elif opt in ("-l", "--logfile"): - log_file = arg - - if file_to_check is None or log_file is None: - print("ERROR: You need to specify both the input and the logfile") - sys.exit(2) - - check(file_to_check, log_file) diff --git a/trans_tools/old/validate_all.sh b/trans_tools/old/validate_all.sh deleted file mode 100755 index 47bb6e62..00000000 --- a/trans_tools/old/validate_all.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash - -for i in `ls -1 ./po` -do - ./validate.py --input=./po/$i/torbutton.dtd.po - ./validate.py --input=./po/$i/torbutton.properties.po -done diff --git a/website/design/CHROME_NOTES b/website/design/CHROME_NOTES deleted file mode 100644 index 5142453e..00000000 --- a/website/design/CHROME_NOTES +++ /dev/null @@ -1,120 +0,0 @@ -- Investigation of Privacy Mode: - - Good: - - Cookies Cleared+memory only - - Cache cleared and memory-only - - History not available via javascript or CSS - - Safe because currently unsupported: - - Geolocation not supported in browser - - DOM Storage not supported - - HTML5 Storage not supported - - Http auth is cleared - - Do they have a session store? - - Yes. It is disabled. - - Form history disabled - - But non-private entries still available - - Malware and phishing protection - - Per-url check? - - Doesn't seem like it.. - - Bad: - - RLZ Identifier sent with all queries even in Incognito mode - - http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=107684 - - Flash cookies not cleared - - Google gears are still available - - Do they have their own storage? - - Yes. Completely ignores private mode. - - Safebrowsing API key not cleared? - - but updates may not happen "under" the incognito window - - Desktop resolution available - - Browser resolution is available - - SSL session keys - - Not cleared! - - They clear trusted certs tho - - Timezone not spoofed - -- Misc Features we definitely need: - - Incognito-specific proxy settings - - Browser proxy settings currently do not apply immediately - - Plugin enable/disable controls - - Spoof user agent - - Referer alteration API - - Autolaunching of remote apps needs to be disabled - - API to opt-out of all the opt-in tracking for incognito mode - - Cookie API would be nice - - Need network.security.ports.banned - - http://www.remote.org/jochen/sec/hfpa/hfpa.pdf - - Resize windows (content-window side possibly ok) - -- Future investigation - - Non-private form history still available - - Forms seem to not be auto-filled, but this may be different - for some fields? - - How evil is google update? will it happen over incognito? - - http://en.wikipedia.org/wiki/Google_Updater#Google_Updater - - http://en.wikipedia.org/wiki/SRWare_Iron#Differences_from_Chrome - - http://foliovision.com/2008/12/09/adwords-ppc-organic-rlz/ - - Test in more detail with sysinternals for disk writes - - What about safebrowsing requests? Can they bypass proxy? - - Video tag supports H264 and ogg via ffmpeg - - Hrmm.. proxy bypass ability? - -- Test results. Used Incognito Mode with the test suites from: - https://www.torproject.org/torbutton/design/#SingleStateTesting - - Decloak.net: - - Recovers IP and DNS via Java - - Recovers IP via flash - - Deanonymizer.com - - Failed NNTP and FTP quicktime - - JohnDo's hated some headers - - Mr. T got a lot of shit wrong... - - http://labs.isecpartners.com/breadcrumbs/breadcrumbs.html - -- Comparison with Torora - - http://github.com/mwenge/torora/tree/master/doc/DESIGN.torora - - Good ideas for both chrome and torbutton: - - Cache/Cookie expiry every 24hrs - - Random preturbation on Date() object.. - - No longer possible without js hooks :/ - - Possible if Chrome allows non-delatable shadowing of window.Date() - from user scripts. ECMA says it should - -========================================== - -- Incognito Issues: - - SSL session keys - - Not cleared! - - Flash cookies not cleared - - Better Privacy? Permissions? - - Google gears are still available - - Do they have their own storage? - - Yes. Completely ignores private mode. - - RLZ override/disable for incognito - - Opt out of opt-in tracking? - - Source code: - http://src.chromium.org/viewvc/chrome/trunk/src/chrome/browser/profile.cc - -- Privacy Enhancing API Wishlist (remove existing items): - - http://code.google.com/chrome/extensions/devguide.html - - Prefs (copy-on-write for incognito mode) - - Incognito-specific proxy settings - - Should not be used for safebrowsing or app/addon update - - pref to disable autolaunch of apps/warn user - - network.security.ports.banned - - User agent (that also govern navigator.*) - - could be done (better) via http headers and good hook support - - Core APIs: - - Per-Plugin enable/disable controls - - Cookie API - - Cache control - - HTTP header alteration ("on-modify-request") - - Referrer, accept, user agent - - Javascript hooks: - - http://code.google.com/chrome/extensions/content_scripts.html - - Bleh, these suck... Too limited. - - ECMA compliance - - desktop+screen resolution - - Date hooking - - navigator.* hooking - -- Posted at: - - http://groups.google.com/group/chromium-extensions/t/ceba26ca9e2f6a78 - diff --git a/website/design/FF35_AUDIT b/website/design/FF35_AUDIT deleted file mode 100644 index 35a9fbf4..00000000 --- a/website/design/FF35_AUDIT +++ /dev/null @@ -1,195 +0,0 @@ -First pass: Quick Review of Firefox Features -- Video Tag - - Docs: - - https://developer.mozilla.org/En/HTML/Element/Audio - - https://developer.mozilla.org/En/HTML/Element/Video - - https://developer.mozilla.org/En/HTML/Element/Source - - https://developer.mozilla.org/En/Manipulating_video_using_canvas - - https://developer.mozilla.org/En/nsIDOMHTMLMediaElement - - https://developer.mozilla.org/En/Media_formats_supported_by_the_audio_and_vi... - - http://en.flossmanuals.net/TheoraCookbook - - nsIContentPolicy is checked on load - - Uses NSIChannels for initial load - - Wrapped in nsHTMLMediaElement::mDecoder - - is nsOggDecoder() or nsWaveDecoder() - - liboggplay - - Governed by media.* prefs - - Preliminary audit shows they do not use the liboggplay tcp functions -- Geolocation - - Wifi: - - https://developer.mozilla.org/En/Monitoring_WiFi_access_points - - Requires security policy to allow. Then still prompted - - navigator.geolocation - - Governed by geo.enabled - - "2 week access token" is set - - geo.wifi.access_token.. Clearing is prob a good idea - - http://mxr.mozilla.org/mozilla1.9.1/source/dom/src/geolocation/NetworkGeoloc... - - https://developer.mozilla.org/En/Using_geolocation -- DNS prefetching after toggle - - prefetch pref? Always disable for now? - - network.dns.disablePrefetch - - Also disabled in netwerk/dns/src/nsDNSService2.cpp when manual proxies - are set.. - - This should prevent prefetching of non-tor urls in tor mode.. - - But the reverse is unclear. - - DocShell attribute!!1 YAY - - http://www.oxymoronical.com/experiments/apidocs/interface/nsIDocShell - - "Takes effect for the NEXT document loaded...." - - Do we win this race? hrmm.. If we do, the tor->nontor direction - should also be safe. - - Content policy called? - - No. See content/html/content/src/nsHTMLDNSPrefetch.cpp -- Storage - - https://developer.mozilla.org/en/Storage - - "It is available to trusted callers, meaning extensions and Firefox - components only." -- New content policy - - Content Security Policy. Addon-only -- "Offline resources" - - https://developer.mozilla.org/en/Offline_resources_in_Firefox - - https://developer.mozilla.org/en/nsIApplicationCache - - browser.cache.offline.enable toggles - - browser.cache.disk.enable does not apply. Seperate "device". - - Does our normal cache clearing mechanism apply? - - We call nsICacheService.evictEntries() - - May need: nsOfflineCacheDevice::EvictEntries(NULL) - - Code is smart enough to behave cleanly if we simply set - browser.cache.offline.enable or enable private browsing. -- Mouse gesture and other new DOM events -- Fonts - - Remote fonts obey content policy. Good. - - XXX: Are they cached independent of regular cache? Prob not. - - Hrmm can probe for installed fonts: - http://remysharp.com/2008/07/08/how-to-detect-if-a-font-is-installed-only-us... - http://www.lalit.org/lab/javascript-css-font-detect - http://www.ajaxupdates.com/cssjavascript-font-detector/ - http://code.google.com/p/jquery-fontavailable/ -- Drag and drop - - https://developer.mozilla.org/En/DragDrop/Drag_and_Drop - - https://developer.mozilla.org/En/DragDrop/Drag_Operations - - https://developer.mozilla.org/En/DragDrop/Dragging_and_Dropping_Multiple_Ite... - - https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types - - https://developer.mozilla.org/En/DragDrop/DataTransfer - - Should be no different than normal url handling.. -- Local Storage - - https://developer.mozilla.org/en/DOM/Storage#localStorage - - Disabled by dom storage pref.. - - Private browsing mode has its own DB - - Memory only? - - Disk Avoidance of gStorage and local storage: - - mSessionOnly set via nsDOMStorage::CanUseStorage() - - Seems to be set to true if cookies are session-only or private - browsing mode - - Our cookies are NOT session-only with dual cookie jars - - but this is ok if we clear the session storage.. - - XXX: Technically clearing session storage may break - sites if cookies remain though - - nsDOMStoragePersistentDB not used if mSessionOnly - - Can clear with nsDOMStorage::ClearAll() or nsIDOMStorage2::clear()? - - These only work for a particular storage. There's both global now - and per-origin storage instances - - Each docshell has tons of storages for each origin contained in it - - Toggling dom.storage.enabled does not clear existing storage - - Oh HOT! cookie-changed to clear cookies clears all storages! - - happens for both ff3.0 and 3.5 in dom/src/storage/nsDOMStorage.cpp - - Conclusion: - - can safely enable dom storage - - May have minor buggy usability issues unless we preserve it - when user is preserving cookies.. - -Second Pass: Verification of all Torbutton Assumptions -- "Better privacy controls" - - Basically UI stuff for prefs we set already - - address bar search disable option is interesting, but not - torbutton's job to toggle. Users will hate us. -- Private browsing - - https://developer.mozilla.org/En/Supporting_private_browsing_mode - - We should consider an option (off by default) to enable PBM during - toggle - - It is a good idea because it will let our users use DOM storage - safely and also may cause their plugins and other addons to be - safe - - Doing it always will cause the user to lose fine-grained control - of many settings - - Also we'll need to prevent them from leaving without toggling tor - - Stuff the emit does (grep for NS_PRIVATE_BROWSING_SWITCH_TOPIC and - "private-browsing") - - XXX: clear mozilla.org/security/sdr;1. We should too! Wtf is it?? - - Neg. Best to let them handle this. Users will be annoyed - at having to re-enter their passwords.. - - They also clear the console service.. - - Recommend watching private-browsing-cancel-vote and blocking if - we are performing a db operation - - Maybe we want to block transitions during our toggle for safety - - XXX: They also clear general.open_location.last_url - - XXX: mozilla.org/permissionmanager - - XXX: mozilla.org/content-pref/service - - XXX: Sets browser.zoom.siteSpecific to false - - Interesting.. They clear their titles.. I wonder if some - window managers log titles.. But that level of surveillance is - unbeatable.. - - XXX: Unless there is some way for flash or script to read titles? - - They empty the clipboard.. - - Can js access the clipboard?? ... - - Yes, but needs special pref+confirmation box - - http://www.dynamic-tools.net/toolbox/copyToClipboard/ - - They clear cache.. - - Cookies: - - Use in-memory table that is different than their default - - This could fuck up our cookie storage options - - We could maybe prevent them from getting this - event by wrapping nsCookieService::Observe(). Lullz.. - - NavHistory: - - XXX: nsNavHistory::AutoCompleteFeedback() doesn't track - awesomebar choices for feedback.. Is this done on disk? - - Don't add history entries - - We should block this observe event too if we can.. - - The session store stops storing tabs - - We could block this observe - - XXX: They expunge private temporary files on exit from PMB - - This is not done normally until browser exit or - "on-profile-change" - - emits browser:purge-domain-data.. Mostly just for session - editing it appears - - Direct component query for pbs.privateBrowsingEnabled - - This is where we have no ability to provide certain option - control - - browser.js seems to prevent user from allowing blocked - popups? - - Some items in some places context menu get blocked: - - Can't delete items from history? placesContext_deleteHost - - nsCookiePermission::InPrivateBrowsing() calls direct - - but is irellevant - - Form history cannot be saved while in PBM.. :( - - User won't be prompted for adding login passwords.. - - Can't remember prefs on content types - - Many components read this value upon init: - - This fucks up our observer game if tor starts enabled - - NavHistory and cookie and dl manager - - We could just wrap the bool on startup and lie - and emit later... :/ - - Or! emit an exit and an enter always at startup if tor is - enabled. - - Read iSec report - - Compare to Chrome - - API use cases -- SessionStore - - Has been reworked with observers and write methods. Should use those. -- security.enable_ssl2 to clear session id - - Still cleared -- browser.sessionstore.max_tabs_undo - - Yep. -- SafeBrowsing Update Key removed on cookie clear still? - - Yep. -- Livemark updates have kill events now -- Test if nsICertStore is still buggy... - -Third Pass: Exploit Auditing -- Remote fonts -- SVG with HTML -- Javascript threads+locking -- Ogg theora and vorbis codecs -- SQLite - - -- https://developer.mozilla.org/en/Firefox_3_for_developers diff --git a/website/design/FF40_AUDIT b/website/design/FF40_AUDIT deleted file mode 100644 index 7830eb34..00000000 --- a/website/design/FF40_AUDIT +++ /dev/null @@ -1,50 +0,0 @@ -- Review of https://developer.mozilla.org/en/Firefox_4_for_developers - - Potential proxy issues - - DocShell and plugins inside createHTMLDocument? - - https://developer.mozilla.org/en/DOM/DOMImplementation.createHTMLDocument - - WebSockets? - - Media attributes? - - "buffered" - - "preload" - - new codecs? - - What the hell is a blob url? - - https://developer.mozilla.org/en/DOM/window.createBlobURL - - https://developer.mozilla.org/en/DOM/window.revokeBlobURL - - Seems only relevent to FS injection.. - - WebThreads are OK: - - https://developer.mozilla.org/En/Using_web_workers - - Network activity blocked by content policy - - Fingerprinting issues: - - New screen attributes - - https://developer.mozilla.org/en/DOM/window.mozInnerScreenX, Y - - High Res Animation Timers: - - https://developer.mozilla.org/en/DOM/window.mozAnimationStartTime - - https://developer.mozilla.org/en/DOM/Animations_using_MozBeforePaint - - 50-60hz max.. Can we leverage this? - - timeStamps on keystroke events - - https://developer.mozilla.org/en/DOM/event.timeStamp - - Bounding rectangles -> window sizes? - - Maybe not display sizes, but seems possible to fingerprint rendered - content size.. ugh. - - https://developer.mozilla.org/en/DOM/element.getBoundingClientRect - - https://developer.mozilla.org/en/dom:range - - CSS resize, media queries, etc.. - - WebGL may also expose screen properties and video card properties: - - https://developer.mozilla.org/en/WebGL - - https://www.khronos.org/registry/webgl/specs/1.0/#5.2 - - https://www.khronos.org/registry/webgl/specs/1.0/#5.11 - - SVG needs auditing. It may also expose absolute coords, but appears OK - - https://developer.mozilla.org/en/SVG/SVG_animation_with_SMIL - - Mouse events reveal desktop coordinates - - https://bugzilla.mozilla.org/show_bug.cgi?id=503943 - - https://developer.mozilla.org/en/DOM/Event/UIEvent/MouseEvent - - Actual screen dimensions not exposed - - Identifier Storage - - Content Secuity Properties may need clearing: - - https://developer.mozilla.org/en/Security/CSP - - STS cache needs clearing - - New window.history functions may allow state smuggling - - https://developer.mozilla.org/en/DOM/Manipulating_the_browser_history - -- New Javascript hooking options may help improve Date() hooks: - - https://developer.mozilla.org/en/JavaScript/New_in_JavaScript/1.8.5 diff --git a/website/design/MozillaBrownBag.odp b/website/design/MozillaBrownBag.odp deleted file mode 100644 index bf844061..00000000 Binary files a/website/design/MozillaBrownBag.odp and /dev/null differ diff --git a/website/design/MozillaBrownBag.pdf b/website/design/MozillaBrownBag.pdf deleted file mode 100644 index ebcd3418..00000000 Binary files a/website/design/MozillaBrownBag.pdf and /dev/null differ diff --git a/website/design/build.sh b/website/design/build.sh deleted file mode 100755 index 6531077e..00000000 --- a/website/design/build.sh +++ /dev/null @@ -1 +0,0 @@ -xsltproc --output index.html.en --stringparam section.autolabel.max.depth 2 --stringparam section.autolabel 1 /usr/share/sgml/docbook/xsl-stylesheets-1.75.2/xhtml/docbook.xsl design.xml diff --git a/website/design/design.xml b/website/design/design.xml deleted file mode 100644 index bc0d5b89..00000000 --- a/website/design/design.xml +++ /dev/null @@ -1,2901 +0,0 @@ -<?xml version="1.0" encoding="ISO-8859-1"?> -<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN" - "file:///usr/share/sgml/docbook/xml-dtd-4.4-1.0-30.1/docbookx.dtd"> - -<article id="design"> - <articleinfo> - <title>Torbutton Design Documentation</title> - <author> - <firstname>Mike</firstname><surname>Perry</surname> - <affiliation> - <address><email>mikeperry.fscked/org</email></address> - </affiliation> - </author> - <pubdate>Apr 10 2011</pubdate> - </articleinfo> - -<sect1> - <title>Introduction</title> - <para> - -This document describes the goals, operation, and testing procedures of the -Torbutton Firefox extension. It is current as of Torbutton 1.3.2. - - </para> - <sect2 id="adversary"> - <title>Adversary Model</title> - <para> - -A Tor web browser adversary has a number of goals, capabilities, and attack -types that can be used to guide us towards a set of requirements for the -Torbutton extension. Let's start with the goals. - - </para> - <sect3 id="adversarygoals"> - <title>Adversary Goals</title> - <orderedlist> -<!-- These aren't really commands.. But it's the closest I could find in an -acceptable style.. Don't really want to make my own stylesheet --> - <listitem><command>Bypassing proxy settings</command> - <para>The adversary's primary goal is direct compromise and bypass of -Tor, causing the user to directly connect to an IP of the adversary's -choosing.</para> - </listitem> - <listitem><command>Correlation of Tor vs Non-Tor Activity</command> - <para>If direct proxy bypass is not possible, the adversary will likely -happily settle for the ability to correlate something a user did via Tor with -their non-Tor activity. This can be done with cookies, cache identifiers, -javascript events, and even CSS. Sometimes the fact that a user uses Tor may -be enough for some authorities.</para> - </listitem> - <listitem><command>History disclosure</command> - <para> -The adversary may also be interested in history disclosure: the ability to -query a user's history to see if they have issued certain censored search -queries, or visited censored sites. - </para> - </listitem> - <listitem><command>Location information</command> - <para> - -Location information such as timezone and locality can be useful for the -adversary to determine if a user is in fact originating from one of the -regions they are attempting to control, or to zero-in on the geographical -location of a particular dissident or whistleblower. - - </para> - </listitem> - <listitem><command>Miscellaneous anonymity set reduction</command> - <para> - -Anonymity set reduction is also useful in attempting to zero in on a -particular individual. If the dissident or whistleblower is using a rare build -of Firefox for an obscure operating system, this can be very useful -information for tracking them down, or at least <link -linkend="fingerprinting">tracking their activities</link>. - - </para> - </listitem> - <listitem><command>History records and other on-disk -information</command> - <para> -In some cases, the adversary may opt for a heavy-handed approach, such as -seizing the computers of all Tor users in an area (especially after narrowing -the field by the above two pieces of information). History records and cache -data are the primary goals here. - </para> - </listitem> - </orderedlist> - </sect3> - - <sect3 id="adversarypositioning"> - <title>Adversary Capabilities - Positioning</title> - <para> -The adversary can position themselves at a number of different locations in -order to execute their attacks. - </para> - <orderedlist> - <listitem><command>Exit Node or Upstream Router</command> - <para> -The adversary can run exit nodes, or alternatively, they may control routers -upstream of exit nodes. Both of these scenarios have been observed in the -wild. - </para> - </listitem> - <listitem><command>Adservers and/or Malicious Websites</command> - <para> -The adversary can also run websites, or more likely, they can contract out -ad space from a number of different adservers and inject content that way. For -some users, the adversary may be the adservers themselves. It is not -inconceivable that adservers may try to subvert or reduce a user's anonymity -through Tor for marketing purposes. - </para> - </listitem> - <listitem><command>Local Network/ISP/Upstream Router</command> - <para> -The adversary can also inject malicious content at the user's upstream router -when they have Tor disabled, in an attempt to correlate their Tor and Non-Tor -activity. - </para> - </listitem> - <listitem><command>Physical Access</command> - <para> -Some users face adversaries with intermittent or constant physical access. -Users in Internet cafes, for example, face such a threat. In addition, in -countries where simply using tools like Tor is illegal, users may face -confiscation of their computer equipment for excessive Tor usage or just -general suspicion. - </para> - </listitem> - </orderedlist> - </sect3> - - <sect3 id="attacks"> - <title>Adversary Capabilities - Attacks</title> - <para> - -The adversary can perform the following attacks from a number of different -positions to accomplish various aspects of their goals. It should be noted -that many of these attacks (especially those involving IP address leakage) are -often performed by accident by websites that simply have Javascript, dynamic -CSS elements, and plugins. Others are performed by adservers seeking to -correlate users' activity across different IP addresses, and still others are -performed by malicious agents on the Tor network and at national firewalls. - - </para> - <orderedlist> - <listitem><command>Inserting Javascript</command> - <para> -If not properly disabled, Javascript event handlers and timers -can cause the browser to perform network activity after Tor has been disabled, -thus allowing the adversary to correlate Tor and Non-Tor activity and reveal -a user's non-Tor IP address. Javascript -also allows the adversary to execute <ulink -url="http://whattheinternetknowsaboutyou.com/%22%3Ehistory disclosure attacks</ulink>: -to query the history via the different attributes of 'visited' links to search -for particular Google queries, sites, or even to <ulink -url="http://www.mikeonads.com/2008/07/13/using-your-browser-url-history-estimate-... -users based on gender and other classifications</ulink>. Finally, -Javascript can be used to query the user's timezone via the -<function>Date()</function> object, and to reduce the anonymity set by querying -the <function>navigator</function> object for operating system, CPU, locale, -and user agent information. - </para> - </listitem> - - <listitem><command>Inserting Plugins</command> - <para> - -Plugins are abysmal at obeying the proxy settings of the browser. Every plugin -capable of performing network activity that the author has -investigated is also capable of performing network activity independent of -browser proxy settings - and often independent of its own proxy settings. -Sites that have plugin content don't even have to be malicious to obtain a -user's -Non-Tor IP (it usually leaks by itself), though <ulink -url="http://decloak.net%22%3Eplenty of active -exploits</ulink> are possible as well. In addition, plugins can be used to store unique identifiers that are more -difficult to clear than standard cookies. -<ulink url="http://epic.org/privacy/cookies/flash.html">Flash-based -cookies</ulink> fall into this category, but there are likely numerous other -examples. - - </para> - </listitem> - <listitem><command>Inserting CSS</command> - <para> - -CSS can also be used to correlate Tor and Non-Tor activity and reveal a user's -Non-Tor IP address, via the usage of -<ulink url="http://www.tjkdesign.com/articles/css%20pop%20ups/">CSS -popups</ulink> - essentially CSS-based event handlers that fetch content via -CSS's onmouseover attribute. If these popups are allowed to perform network -activity in a different Tor state than they were loaded in, they can easily -correlate Tor and Non-Tor activity and reveal a user's IP address. In -addition, CSS can also be used without Javascript to perform <ulink -url="http://ha.ckers.org/weird/CSS-history.cgi%22%3ECSS-only history disclosure -attacks</ulink>. - </para> - </listitem> - <listitem><command>Read and insert cookies</command> - <para> - -An adversary in a position to perform MITM content alteration can inject -document content elements to both read and inject cookies for -arbitrary domains. In fact, many "SSL secured" websites are vulnerable to this -sort of <ulink url="http://seclists.org/bugtraq/2007/Aug/0070.html">active -sidejacking</ulink>. - - </para> - </listitem> - <listitem><command>Create arbitrary cached content</command> - <para> - -Likewise, the browser cache can also be used to <ulink -url="http://crypto.stanford.edu/sameorigin/safecachetest.html%22%3Estore unique -identifiers</ulink>. Since by default the cache has no same-origin policy, -these identifiers can be read by any domain, making them an ideal target for -adserver-class adversaries. - - </para> - </listitem> - - <listitem id="fingerprinting"><command>Fingerprint users based on browser -attributes</command> -<para> - -There is an absurd amount of information available to websites via attributes -of the browser. This information can be used to reduce anonymity set, or even -<ulink url="http://mandark.fr/0x000000/articles/Total_Recall_On_Firefox..html">uniquely -fingerprint individual users</ulink>. </para> -<para> -For illustration, let's perform a -back-of-the-envelope calculation on the number of anonymity sets for just the -resolution information available in the <ulink -url="http://developer.mozilla.org/en/docs/DOM:window%22%3Ewindow</ulink> and -<ulink -url="http://developer.mozilla.org/en/docs/DOM:window.screen%22%3Ewindow.screen</ulink> -objects. - - - -Browser window resolution information provides something like -(1280-640)*(1024-480)=348160 different anonymity sets. Desktop resolution -information contributes about another factor of 5 (for about 5 resolutions in -typical use). In addition, the dimensions and position of the desktop taskbar -are available, which can reveal hints on OS information. This boosts the count -by a factor of 5 (for each of the major desktop taskbars - Windows, OSX, KDE -and Gnome, and None). Subtracting the browser content window -size from the browser outer window size provide yet more information. -Firefox toolbar presence gives about a factor of 8 (3 toolbars on/off give -2<superscript>3</superscript>=8). Interface effects such as title bar font size -and window manager settings gives a factor of about 9 (say 3 common font sizes -for the title bar and 3 common sizes for browser GUI element fonts). -Multiply this all out, and you have (1280-640)*(1024-480)*5*5*8*9 ~= -2<superscript>29</superscript>, or a 29 bit identifier based on resolution -information alone. </para> - -<para> - -Of course, this space is non-uniform in user density and prone to incremental -changes. The <ulink -url="https://wiki.mozilla.org/Fingerprinting#Data%22%3EPanopticlick study -done</ulink> by the EFF attempts to measure the actual entropy - the number of -identifying bits of information encoded in browser properties. Their result -data is definitely useful, and the metric is probably the appropriate one for -determining how identifying a particular browser property is. However, some -quirks of their study means that they do not extract as much information as -they could from display information: they only use desktop resolution (which -Torbutton reports as the window resolution) and do not attempt to infer the -size of toolbars. - -</para> -<!-- -FIXME: This is no longer true. Only certain addons are now discoverable, and -only if they want to be: -http://webdevwonders.com/detecting-firefox-add-ons/ -https://developer.mozilla.org/en/Updating_web_applications_for_Firefox_3#sec... - -<para> - -To add insult to injury, <ulink -url="http://pseudo-flaw.net/content/tor/torbutton/%22%3Echrome URL disclosure -attacks</ulink> mean that each and every extension on <ulink -url="https://addons.mozilla.org%22%3Eaddons.mozilla.org</ulink> adds another bit -to that 2<superscript>29</superscript>. With hundreds of popular extensions -and thousands of extensions total, it is easy to see that this sort of -information is an impressively powerful identifier if used properly by a -competent and determined adversary such as an ad network. Again, a -nearest-neighbor bit vector space approach here would also gracefully handle -incremental changes to installed extensions. - -</para> ---> - </listitem> - <listitem><command>Remotely or locally exploit browser and/or -OS</command> - <para> -Last, but definitely not least, the adversary can exploit either general -browser vulnerabilities, plugin vulnerabilities, or OS vulnerabilities to -install malware and surveillance software. An adversary with physical access -can perform similar actions. Regrettably, this last attack capability is -outside of Torbutton's ability to defend against, but it is worth mentioning -for completeness. - </para> - </listitem> - </orderedlist> - </sect3> - - </sect2> - - <sect2 id="requirements"> - <title>Torbutton Requirements</title> -<note> - -Since many settings satisfy multiple requirements, this design document is -organized primarily by Torbutton components and settings. However, if you are -the type that would rather read the document from the requirements -perspective, it is in fact possible to search for each of the following -requirement phrases in the text to find the relevant features that help meet -that requirement. - -</note> - <para> - -From the above Adversary Model, a number of requirements become clear. - - </para> - -<orderedlist> -<!-- These aren't really commands.. But it's the closest I could find in an -acceptable style.. Don't really want to make my own stylesheet --> - <listitem id="proxy"><command>Proxy Obedience</command> - <para>The browser -MUST NOT bypass Tor proxy settings for any content.</para></listitem> - <listitem id="state"><command>State Separation</command> - <para>Browser state (cookies, cache, history, 'DOM storage'), accumulated in - one Tor state MUST NOT be accessible via the network in - another Tor state.</para></listitem> - <listitem id="isolation"><command>Network Isolation</command> - <para>Pages MUST NOT perform any network activity in a Tor state different - from the state they were originally loaded in.</para> - <para>Note that this requirement is -being de-emphasized due to the coming shift to supporting only the Tor Browser -Bundles, which do not support a Toggle operation.</para></listitem> - <listitem id="undiscoverability"><command>Tor Undiscoverability</command><para>With -the advent of bridge support in Tor 0.2.0.x, there are now a class of Tor -users whose network fingerprint does not obviously betray the fact that they -are using Tor. This should extend to the browser as well - Torbutton MUST NOT -reveal its presence while Tor is disabled. -</para> - <para>Note that this requirement is -being de-emphasized due to the coming shift to supporting only the Tor Browser -Bundles, which do not support a Toggle operation.</para> -</listitem> - <listitem id="disk"><command>Disk Avoidance</command><para>The browser SHOULD NOT write any Tor-related state to disk, or store it - in memory beyond the duration of one Tor toggle.</para></listitem> - <listitem id="location"><command>Location Neutrality</command><para>The browser SHOULD NOT leak location-specific information, such as - timezone or locale via Tor.</para></listitem> - <listitem id="setpreservation"><command>Anonymity Set -Preservation</command><para>The browser SHOULD NOT leak any other anonymity -set reducing or fingerprinting information - (such as user agent, extension presence, and resolution information) -automatically via Tor. The assessment of the attacks above should make it clear -that anonymity set reduction is a very powerful method of tracking and -eventually identifying anonymous users. -</para></listitem> - <listitem id="updates"><command>Update Safety</command><para>The browser -SHOULD NOT perform unauthenticated updates or upgrades via Tor.</para></listitem> - <listitem id="interoperate"><command>Interoperability</command><para>Torbutton SHOULD interoperate with third-party proxy switchers that - enable the user to switch between a number of different proxies. It MUST - provide full Tor protection in the event a third-party proxy switcher has - enabled the Tor proxy settings.</para></listitem> -</orderedlist> - </sect2> - <sect2 id="layout"> - <title>Extension Layout</title> - -<para>Firefox extensions consist of two main categories of code: 'Components' and -'Chrome'. Components are a fancy name for classes that implement a given -interface or interfaces. In Firefox, components <ulink -url="https://developer.mozilla.org/en/XPCOM%22%3Ecan be -written</ulink> in C++, -Javascript, or a mixture of both. Components have two identifiers: their -'<ulink -url="http://www.mozilla.org/projects/xpcom/book/cxc/html/quicktour2.html#1005005%... -ID</ulink>' (a human readable path-like string), and their '<ulink -url="http://www.mozilla.org/projects/xpcom/book/cxc/html/quicktour2.html#1005329%... -ID</ulink>' (a GUID hex-string). In addition, the interfaces they implement each have a hex -'Interface ID'. It is possible to 'hook' system components - to reimplement -their interface members with your own wrappers - but only if the rest of the -browser refers to the component by its Contract ID. If the browser refers to -the component by Class ID, it bypasses your hooks in that use case. -Technically, it may be possible to hook Class IDs by unregistering the -original component, and then re-registering your own, but this relies on -obsolete and deprecated interfaces and has proved to be less than -stable.</para> - -<para>'Chrome' is a combination of XML and Javascript used to describe a window. -Extensions are allowed to create 'overlays' that are 'bound' to existing XML -window definitions, or they can create their own windows. The DTD for this XML -is called <ulink -url="http://developer.mozilla.org/en/docs/XUL_Reference%22%3EXUL</ulink>.</para> - </sect2> -</sect1> -<sect1 id="components"> - <title>Components</title> - <para> - -Torbutton installs components for two purposes: hooking existing components to -reimplement their interfaces; and creating new components that provide -services to other pieces of the extension. - - </para> - - <sect2 id="hookedxpcom"> - <title>Hooked Components</title> - -<para>Torbutton makes extensive use of Contract ID hooking, and implements some -of its own standalone components as well. Let's discuss the hooked components -first.</para> - -<sect3 id="appblocker"> - <title><ulink -url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/co... -</ulink>, <ulink -url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/co...</ulink>, -and <ulink url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/mime%3B1">@mozilla.org/mime;1</ulink> -- <ulink - url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink></title> - <para> -Due to <link linkend="FirefoxBugs">Firefox Bug</link> <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=440892%22%3E440892</ulink> allowing Firefox 3.x to automatically launch some -applications without user intervention, Torbutton had to wrap the three -components involved in launching external applications to provide user -confirmation before doing so while Tor is enabled. Since external applications -do not obey proxy settings, they can be manipulated to automatically connect -back to arbitrary servers outside of Tor with no user intervention. Fixing -this issue helps to satisfy Torbutton's <link linkend="proxy">Proxy -Obedience</link> Requirement. - </para> -</sect3> -<sect3> -<title><ulink url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/global-history;2">@mozilla.org/browser/global-history;2</ulink> -- <ulink - url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink></title> - -<para>This component was contributed by <ulink -url="http://www.collinjackson.com/%22%3ECollin Jackson</ulink> as a method for defeating -CSS and Javascript-based methods of history disclosure. The global-history -component is what is used by Firefox to determine if a link was visited or not -(to apply the appropriate style to the link). By hooking the <ulink -url="https://developer.mozilla.org/en/nsIGlobalHistory2#isVisited.28.29%22%3EisVi...</ulink> -and <ulink -url="https://developer.mozilla.org/en/nsIGlobalHistory2#addURI.28.29%22%3EaddURI</ulink> -methods, Torbutton is able to selectively prevent history items from being -added or being displayed as visited, depending on the Tor state and the user's -preferences. -</para> -<para> -This component helps satisfy the <link linkend="state">State Separation</link> -and <link linkend="disk">Disk Avoidance</link> requirements of Torbutton. It -is only needed for Firefox 3.x. On Firefox 4, we omit this component in favor -of the <ulink -url="https://developer.mozilla.org/en/CSS/Privacy_and_the_%3avisited_selector%22%... -history protections</ulink>. -</para> -</sect3> -<sect3 id="livemarks"> -<title><ulink -url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/co...</ulink> -- <ulink - url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink></title> -<para> - -The <ulink -url="http://www.mozilla.com/en-US/firefox/livebookmarks.html%22%3Elivemark</ulink> service -is started by a timer that runs 5 seconds after Firefox -startup. As a result, we cannot simply call the stopUpdateLivemarks() method to -disable it. We must wrap the component to prevent this start() call from -firing in the event the browser starts in Tor mode. - -</para> -<para> -This component helps satisfy the <link linkend="isolation">Network -Isolation</link> and <link linkend="setpreservation">Anonymity Set -Preservation</link> requirements. -</para> -</sect3> -</sect2> -<sect2> -<title>New Components</title> - -<para>Torbutton creates four new components that are used throughout the -extension. These components do not hook any interfaces, nor are they used -anywhere besides Torbutton itself.</para> - -<sect3 id="cookiejar"> -<title><ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/... -- components/cookie-jar-selector.js</ulink></title> - -<para>The cookie jar selector (also based on code from <ulink -url="http://www.collinjackson.com/%22%3ECollin -Jackson</ulink>) is used by the Torbutton chrome to switch between -Tor and Non-Tor cookies. It stores an XML representation of the current -cookie state in memory and/or on disk. When Tor is toggled, it syncs the -current cookies to this XML store, and then loads the cookies for the other -state from the XML store. -</para> - -<para> -This component helps to address the <link linkend="state">State -Isolation</link> requirement of Torbutton. -</para> - -</sect3> -<sect3> -<title><ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/... -- components/torbutton-logger.js</ulink></title> - -<para>The torbutton logger component allows on-the-fly redirection of torbutton -logging messages to either Firefox stderr -(<command>extensions.torbutton.logmethod=0</command>), the Javascript error console -(<command>extensions.torbutton.logmethod=1</command>), or the DebugLogger extension (if -available - <command>extensions.torbutton.logmethod=2</command>). It also allows you to -change the loglevel on the fly by changing -<command>extensions.torbutton.loglevel</command> (1-5, 1 is most verbose). -</para> -</sect3> -<sect3 id="windowmapper"> - -<title><ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/... -- components/window-mapper.js</ulink></title> - -<para>Torbutton tags Firefox <ulink -url="https://developer.mozilla.org/en/XUL_Tutorial/Tabboxes%22%3Etabs</ulink> with a special variable that indicates the Tor -state the tab was most recently used under to fetch a page. The problem is -that for many Firefox events, it is not possible to determine the tab that is -actually receiving the event. The Torbutton window mapper allows the Torbutton -chrome and other components to look up a <ulink -url="https://developer.mozilla.org/en/XUL/tabbrowser%22%3Ebrowser -tab</ulink> for a given <ulink -url="https://developer.mozilla.org/en/nsIDOMWindow%22%3EHTML content -window</ulink>. It does this by traversing all windows and all browsers, until it -finds the browser with the requested <ulink -url="https://developer.mozilla.org/en/XUL/tabbrowser#p-contentWindow%22%3Econtent...</ulink> element. Since the content policy -and page loading in general can generate hundreds of these lookups, this -result is cached inside the component. -</para> -</sect3> -<sect3 id="crashobserver"> - <title><ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink></title> - <para> - -This component detects when Firefox crashes by altering Firefox prefs during -runtime and checking for the same values at startup. It <ulink -url="https://developer.mozilla.org/en/XPCOM_Interface_Reference/nsIPrefService#sa... -the preference service</ulink> to ensure the altered prefs are written to disk -immediately. - - </para> -</sect3> -<sect3 id="tbsessionstore"> - <title><ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink></title> - <para> - -This component subscribes to the Firefox <ulink -url="https://developer.mozilla.org/en/Observer_Notifications#Session_Store%22%3Es...</ulink> -observer event to filter out URLs from tabs loaded during Tor, to prevent them -from being written to disk. To do this, it checks the -<command>__tb_tor_fetched</command> tag of tab objects before writing them out. If -the tag is from a blocked Tor state, the tab is not written to disk. This is -a rather expensive operation that involves potentially very large JSON -evaluations and object tree traversals, but it preferable to replacing the -Firefox session store with our own implementation, which is what was done in -years past. - - </para> -</sect3> - -<sect3 id="refspoofer"> - <title><ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink></title> - <para> -This component handles optional referer spoofing for Torbutton. It implements a -form of "smart" referer spoofing using <ulink -url="https://developer.mozilla.org/en/Setting_HTTP_request_headers%22%3Ehttp-on-m...</ulink> -to modify the Referer header. The code sends the default browser referer -header only if the destination domain is a suffix of the source, or if the -source is a suffix of the destination. Otherwise, it sends no referer. This -strange suffix logic is used as a heuristic: some rare sites on the web block -requests without proper referer headers, and this logic is an attempt to cater -to them. Unfortunately, it may not be enough. For example, google.fr will not -send a referer to google.com using this logic. Hence, it is off by default. - </para> -</sect3> - -<!-- FIXME: tor-protocol, tors-protocol need documenting, but -they are disabled by default for now, so no reason to add the -clutter+confusion. --> - -<sect3 id="contentpolicy"> -<title><ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/... -- components/cssblocker.js</ulink></title> - -<para>This is a key component to Torbutton's security measures. When Tor is -toggled, Javascript is disabled, and pages are instructed to stop loading. -However, CSS is still able to perform network operations by loading styles for -onmouseover events and other operations. In addition, favicons can still be -loaded by the browser. The cssblocker component prevents this by implementing -and registering an <ulink -url="https://developer.mozilla.org/en/nsIContentPolicy%22%3EnsIContentPolicy</ulink>. -When an nsIContentPolicy is registered, Firefox checks every attempted network -request against its <ulink -url="https://developer.mozilla.org/en/nsIContentPolicy#shouldLoad()%22%3EshouldLo...</ulink> -member function to determine if the load should proceed. In Torbutton's case, -the content policy looks up the appropriate browser tab using the <link -linkend="windowmapper">window mapper</link>, -and checks that tab's load tag against the current Tor state. If the tab was -loaded in a different state than the current state, the fetch is denied. -Otherwise, it is allowed.</para> This helps to achieve the <link -linkend="isolation">Network -Isolation</link> requirements of Torbutton. - -<para>In addition, the content policy also blocks website javascript from -<ulink -url="http://webdevwonders.com/detecting-firefox-add-ons/%22%3Equerying for -versions and existence of extension chrome</ulink> while Tor is enabled, and -also masks the presence of Torbutton to website javascript while Tor is -disabled. </para> - -<para> - -Finally, some of the work that logically belongs to the content policy is -instead handled by the <command>torbutton_http_observer</command> and -<command>torbutton_weblistener</command> in <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink>. These two objects handle blocking of -Firefox 3 favicon loads, popups, and full page plugins, which for whatever -reason are not passed to the Firefox content policy itself (see Firefox Bugs -<ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=437014%22%3E437014</ulink> and -<ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=401296%22%3E401296</ulink>). - -</para> - -<!-- -FIXME: Hrmm, the content policy doesn't really lend itself well to display -this way.. People looking for this much detail should consult the source. - -<para> - <table rowheader="firstcol" frame='all'><title>Access Permissions Table</title> - <tgroup cols='5' align='left' colsep='1' rowsep='1'> - <tbody> - <row> - <entry></entry> - <entry>chrome/resource</entry> - <entry>a3</entry> - <entry>a4</entry> - <entry>a5</entry> - </row> - <row> - <entry>file</entry> - <entry>b2</entry> - <entry>b3</entry> - <entry>b4</entry> - <entry>b5</entry> - </row> - <row> - <entry>c1</entry> - <entry>c2</entry> - <entry>c3</entry> - <entry>c4</entry> - <entry>c5</entry> - </row> - <row> - <entry>d1</entry> - <entry>d2</entry> - <entry>d3</entry> - <entry>d4</entry> - <entry>d5</entry> - </row> - </tbody> - </tgroup> - </table> -</para> ---> - -<para> - -This helps to fulfill both the <link -linkend="setpreservation">Anonymity Set Preservation</link> and the <link -linkend="undiscoverability">Tor Undiscoverability</link> requirements of -Torbutton.</para> - -</sect3> -</sect2> -</sect1> -<sect1> - <title>Chrome</title> - -<para>The chrome is where all the torbutton graphical elements and windows are -located. </para> -<sect2> - <title>XUL Windows and Overlays</title> -<para> -Each window is described as an <ulink -url="http://developer.mozilla.org/en/docs/XUL_Reference%22%3EXML file</ulink>, with zero or more Javascript -files attached. The scope of these Javascript files is their containing -window. XUL files that add new elements and script to existing Firefox windows -are called overlays.</para> - -<sect3 id="browseroverlay"> -<title>Browser Overlay - <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink></title> - -<para>The browser overlay, torbutton.xul, defines the toolbar button, the status -bar, and events for toggling the button. The overlay code is in <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink>. -It contains event handlers for preference update, shutdown, upgrade, and -location change events.</para> - -</sect3> -<sect3> - <title>Preferences Window - <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink></title> - -<para>The preferences window of course lays out the Torbutton preferences, with -handlers located in <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink>.</para> -</sect3> -<sect3> - <title>Other Windows</title> - -<para>There are additional windows that describe popups for right clicking on -the status bar, the toolbutton, and the about page.</para> - -</sect3> -</sect2> -<sect2> - <title>Major Chrome Observers</title> - <para> -In addition to the <link linkend="components">components described -above</link>, Torbutton also instantiates several observers in the browser -overlay window. These mostly grew due to scoping convenience, and many should -probably be relocated into their own components. - </para> - <orderedlist> - <listitem><command>torbutton_window_pref_observer</command> - <para> -This is an observer that listens for Torbutton state changes, for the purposes -of updating the Torbutton button graphic as the Tor state changes. - </para> - </listitem> - - <listitem><command>torbutton_unique_pref_observer</command> - <para> - -This is an observer that only runs in one window, called the main window. It -listens for changes to all of the Torbutton preferences, as well as Torbutton -controlled Firefox preferences. It is what carries out the toggle path when -the proxy settings change. When the main window is closed, the -torbutton_close_window event handler runs to dub a new window the "main -window". - - </para> - </listitem> - - <listitem><command>tbHistoryListener</command> - <para> -The tbHistoryListener exists to prevent client window Javascript from -interacting with window.history to forcibly navigate a user to a tab session -history entry from a different Tor state. It also expunges the window.history -entries during toggle. This listener helps Torbutton -satisfy the <link linkend="isolation">Network Isolation</link> requirement as -well as the <link linkend="state">State Separation</link> requirement. - - </para> - </listitem> - - <listitem><command>torbutton_http_observer</command> - <para> - -The torbutton_http_observer performs some of the work that logically belongs -to the content policy. This handles blocking of -Firefox 3 favicon loads, which for whatever -reason are not passed to the Firefox content policy itself (see Firefox Bugs -<ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=437014%22%3E437014</ulink> and -<ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=401296%22%3E401296</ulink>). - - </para> - <para> -The observer is also responsible for redirecting users to alternate -search engines when Google presents them with a Captcha, as well as copying -Google Captcha-related cookies between international Google domains. - </para> - </listitem> - - <listitem><command>torbutton_proxyservice</command> - <para> -The Torbutton proxy service handles redirecting Torbutton-related update -checks on addons.mozilla.org through Tor. This is done to help satisfy the -<link linkend="undiscoverability">Tor Undiscoverability</link> requirement. - </para> - </listitem> - - <listitem><command>torbutton_weblistener</command> -<para>The <ulink -url="https://developer.mozilla.org/en/nsIWebProgressListener#onLocationChange%22%... -change</ulink> <ulink -url="https://developer.mozilla.org/en/nsIWebProgress%22%3Ewebprogress -listener</ulink>, <command>torbutton_weblistener</command> is one of the most -important parts of the chrome from a security standpoint. It is a <ulink -url="https://developer.mozilla.org/en/nsIWebProgressListener%22%3Ewebprogress -listener</ulink> that handles receiving an event every time a page load or -iframe load occurs. This class eventually calls down to -<function>torbutton_update_tags()</function> and -<function>torbutton_hookdoc()</function>, which apply the browser Tor load -state tags, plugin permissions, and install the Javascript hooks to hook the -<ulink -url="https://developer.mozilla.org/en/DOM/window.screen%22%3Ewindow.screen</ulink> -object to obfuscate browser and desktop resolution information. - -</para> - </listitem> - - </orderedlist> - </sect2> -</sect1> - -<sect1> - <title>Toggle Code Path</title> - <para> - -The act of toggling is connected to <function>torbutton_toggle()</function> -via the <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink> -and <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink> -overlay files. Most of the work in the toggling process is present in <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink> - -</para> -<para> - -Toggling is a 3 stage process: Button Click, Proxy Update, and -Settings Update. These stages are reflected in the prefs -<command>extensions.torbutton.tor_enabled</command>, -<command>extensions.torbutton.proxies_applied</command>, and -<command>extensions.torbutton.settings_applied</command>. The reason for the -three stage preference update is to ensure immediate enforcement of <link -linkend="isolation">Network Isolation</link> via the <link -linkend="contentpolicy">content policy</link>. Since the content window -javascript runs on a different thread than the chrome javascript, it is -important to properly convey the stages to the content policy to avoid race -conditions and leakage, especially with <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=409737%22%3EFirefox Bug -409737</ulink> unfixed. The content policy does not allow any network activity -whatsoever during this three stage transition. - - </para> - <sect2> - <title>Button Click</title> - <para> - -This is the first step in the toggling process. When the user clicks the -toggle button or the toolbar, <function>torbutton_toggle()</function> is -called. This function checks the current Tor status by comparing the current -proxy settings to the selected Tor settings, and then sets the proxy settings -to the opposite state, and sets the pref -<command>extensions.torbutton.tor_enabled</command> to reflect the new state. -It is this proxy pref update that gives notification via the <ulink -url="https://developer.mozilla.org/en/NsIPrefBranch2#addObserver.28.29%22%3Epref -observer</ulink> -<command>torbutton_unique_pref_observer</command> to perform the rest of the -toggle. - - </para> - </sect2> - <sect2> - <title>Proxy Update</title> - <para> - -When Torbutton receives any proxy change notifications via its -<command>torbutton_unique_pref_observer</command>, it calls -<function>torbutton_set_status()</function> which checks against the Tor -settings to see if the Tor proxy settings match the current settings. If so, -it calls <function>torbutton_update_status()</function>, which determines if -the Tor state has actually changed, and sets -<command>extensions.torbutton.proxies_applied</command> to the appropriate Tor -state value, and ensures that -<command>extensions.torbutton.tor_enabled</command> is also set to the correct -value. This is decoupled from the button click functionality via the pref -observer so that other addons (such as SwitchProxy) can switch the proxy -settings between multiple proxies. - - </para> - </sect2> -<!-- FIXME: Describe tab tagging and other state clearing hacks? --> - <sect2> - <title>Settings Update</title> - <para> - -The next stage is also handled by -<function>torbutton_update_status()</function>. This function sets scores of -Firefox preferences, saving the original values to prefs under -<command>extensions.torbutton.saved.*</command>, and performs the <link -linkend="cookiejar">cookie jarring</link>, state clearing (such as window.name -and DOM storage), and <link linkend="preferences">preference -toggling</link><!--, and ssl certificate jaring work of Torbutton-->. At the -end of its work, it sets -<command>extensions.torbutton.settings_applied</command>, which signifies the -completion of the toggle operation to the <link -linkend="contentpolicy">content policy</link>. - - </para> - </sect2> -<sect2 id="preferences"> -<title>Firefox preferences touched during Toggle</title> -<para> -There are also a number of Firefox preferences set in -<function>torbutton_update_status()</function> that aren't governed by any -Torbutton setting. These are: -</para> -<orderedlist> - -<!-- -Not set any more. - <listitem><ulink -url="http://kb.mozillazine.org/Browser.bookmarks.livemark_refresh_seconds%22%3Ebr...</ulink> -<para> -This pref is set in an attempt to disable the fetching of LiveBookmarks via -Tor. Since users can potentially collect a large amount of live bookmarks to -very personal sites (blogs of friends, wikipedia articles they maintain, -comment feeds of their own blog), it is not possible to cleanly isolate these -fetches and they are simply disabled during Tor usage. -This helps to address the <link -linkend="state">State Separation</link> requirement. -Unfortunately <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=436250%22%3EFirefox Bug -436250</ulink> prevents this from -functioning completely correctly. -</para> - </listitem> ---> - - <listitem><ulink -url="http://kb.mozillazine.org/Network.security.ports.banned%22%3Enetwork.securit...</ulink> - <para> -Torbutton sets this setting to add ports 8123, 8118, 9050 and 9051 (which it -reads from <command>extensions.torbutton.banned_ports</command>) to the list -of ports Firefox is forbidden to access. These ports are Polipo, Privoxy, Tor, -and the Tor control port, respectively. This is set for both Tor and Non-Tor -usage, and prevents websites from attempting to do http fetches from these -ports to see if they are open, which addresses the <link -linkend="undiscoverability">Tor Undiscoverability</link> requirement. - </para> - </listitem> - <listitem><ulink url="http://kb.mozillazine.org/Browser.send_pings">browser.send_pings</ulink> - <para> -This setting is currently always disabled. If anyone ever complains saying -that they *want* their browser to be able to send ping notifications to a -page or arbitrary link, I'll make this a pref or Tor-only. But I'm not holding -my breath. I haven't checked if the content policy is called for pings, but if -not, this setting helps with meeting the <link linkend="isolation">Network -Isolation</link> requirement. - </para> - </listitem> - <listitem><ulink -url="http://kb.mozillazine.org/Browser.safebrowsing.remoteLookups%22%3Ebrowser.sa...</ulink> - <para> -Likewise for this setting. I find it hard to imagine anyone who wants to ask -Google in real time if each URL they visit is safe, especially when the list -of unsafe URLs is downloaded anyway. This helps fulfill the <link -linkend="disk">Disk Avoidance</link> requirement, by preventing your entire -browsing history from ending up on Google's disks. - </para> - </listitem> - <listitem><ulink -url="http://kb.mozillazine.org/Browser.safebrowsing.enabled%22%3Ebrowser.safebrow...</ulink> - <para> -Safebrowsing does <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=360387%22%3Eunauthenticated -updates under Firefox 2</ulink>, so it is disabled during Tor usage. -This helps fulfill the <link linkend="updates">Update -Safety</link> requirement. Firefox 3 has the fix for that bug, and so -safebrowsing updates are enabled during Tor usage. - </para> - </listitem> - <listitem><ulink -url="http://kb.mozillazine.org/Network.protocol-handler.warn-external.%28protocol...)</ulink> - <para> -If Tor is enabled, we need to prevent random external applications from -launching without at least warning the user. This group of settings only -partially accomplishes this, however. Applications can still be launched via -plugins. The mechanisms for handling this are described under the "Disable -Plugins During Tor Usage" preference. This helps fulfill the <link -linkend="proxy">Proxy Obedience</link> requirement, by preventing external -applications from accessing network resources at the command of Tor-fetched -pages. Unfortunately, due to <link linkend="FirefoxBugs">Firefox Bug</link> -<ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=440892%22%3E440892</ulink>, -these prefs are no longer obeyed. They are set still anyway out of respect for -the dead. - </para> -</listitem> - <listitem><ulink -url="http://kb.mozillazine.org/Browser.sessionstore.max_tabs_undo%22%3Ebrowser.se...</ulink> - <para> - -To help satisfy the Torbutton <link linkend="state">State Separation</link> -and <link linkend="isolation">Network Isolation</link> requirements, -Torbutton needs to purge the Undo Tab history on toggle to prevent repeat -"Undo Close" operations from accidentally restoring tabs from a different Tor -State. This purge is accomplished by setting this preference to 0 and then -restoring it to the previous user value upon toggle. - - </para> - </listitem> - - <listitem><command>security.enable_ssl2</command> or <ulink -url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/in...)</ulink> - <para> -TLS Session IDs can persist for an indefinite duration, providing an -identifier that is sent to TLS sites that can be used to link activity. This -is particularly troublesome now that we have certificate verification in place -in Firefox 3: The OCSP server can use this Session ID to build a history of -TLS sites someone visits, and also correlate their activity as users move from -network to network (such as home to work to coffee shop, etc), inside and -outside of Tor. To handle this and to help satisfy our <link -linkend="state">State Separation Requirement</link>, we call the logout() -function of nsIDOMCrypto. Since this may be absent, or may fail, we fall back -to toggling -<command>security.enable_ssl2</command>, which clears the SSL Session ID -cache via the pref observer at <ulink -url="http://mxr.mozilla.org/security/source/security/manager/ssl/src/nsNSSCompone...</ulink>. - </para> - </listitem> - <listitem><command>security.OCSP.enabled</command> - <para> -Similarly, we toggle <command>security.OCSP.enabled</command>, which clears the OCSP certificate -validation cache via the pref observer at <ulink -url="http://mxr.mozilla.org/security/source/security/manager/ssl/src/nsNSSCompone...</ulink>. -In this way, exit nodes will not be able to fingerprint you -based the fact that non-Tor OCSP lookups were obviously previously cached. -To handle this and to help satisfy our <link -linkend="state">State Separation Requirement</link>, - </para> - </listitem> - <listitem><command><ulink -url="http://kb.mozillazine.org/Updating_extensions#Disabling_update_checks_for_in...</ulink></command> - <para> -We permanently disable addon usage statistic reporting to the -addons.mozilla.org statistics engine. These statistics send version -information about Torbutton users via non-Tor, allowing their Tor use to be -uncovered. Disabling this reporting helps Torbutton to satisfy its <link -linkend="undiscoverability">Tor Undiscoverability</link> requirement. - - </para> - </listitem> - - <listitem><command><ulink url="http://www.mozilla.com/en-US/firefox/geolocation/">geo.enabled</ulink></command> - <para> - -Torbutton disables Geolocation support in Firefox 3.5 and above whenever tor -is enabled. This helps Torbutton maintain its -<link linkend="location">Location Neutrality</link> requirement. -While Firefox does prompt before divulging geolocational information, -the assumption is that Tor users will never want to give their -location away during Tor usage, and even allowing websites to prompt -them to do so will only cause confusion and accidents to happen. Moreover, -just because users may approve a site to know their location in non-Tor mode -does not mean they want it divulged during Tor mode. - - </para> - </listitem> - - <listitem><command><ulink -url="http://kb.mozillazine.org/Browser.zoom.siteSpecific%22%3Ebrowser.zoom.siteSp...</ulink></command> - <para> - -Firefox actually remembers your zoom settings for certain sites. CSS -and Javascript rule can use this to recognize previous visitors to a site. -This helps Torbutton fulfill its <link linkend="state">State Separation</link> -requirement. - - </para> - </listitem> - - <listitem><command><ulink -url="https://developer.mozilla.org/en/controlling_dns_prefetching%22%3Enetwork.dn...</ulink></command> - <para> - -Firefox 3.5 and above implement prefetching of DNS resolution for hostnames in -links on a page to decrease page load latency. While Firefox does typically -disable this behavior when proxies are enabled, we set this pref for added -safety during Tor usage. Additionally, to prevent Tor-loaded tabs from having -their links prefetched after a toggle to Non-Tor mode occurs, -we also set the docShell attribute -<ulink -url="http://www.oxymoronical.com/experiments/apidocs/interface/nsIDocShell%22%3E -allowDNSPrefetch</ulink> to false on Tor loaded tabs. This happens in the same -positions in the code as those for disabling plugins via the allowPlugins -docShell attribute. This helps Torbutton fulfill its <link -linkend="isolation">Network Isolation</link> requirement. - - </para> - </listitem> - - <listitem><command><ulink -url="http://kb.mozillazine.org/Browser.cache.offline.enable%22%3Ebrowser.cache.of...</ulink></command> - <para> - -Firefox has the ability to store web applications in a special cache to allow -them to continue to operate while the user is offline. Since this subsystem -is actually different than the normal disk cache, it must be dealt with -separately. Thus, Torbutton sets this preference to false whenever Tor is -enabled. This helps Torbutton fulfill its <link linkend="disk">Disk -Avoidance</link> and <link linkend="state">State Separation</link> -requirements. - - </para> - </listitem> - -<!-- FIXME: We should make it possible to search for ALL modified FF prefs --> - -</orderedlist> -</sect2> - -</sect1> - -<sect1> - <title>Description of Options</title> -<para>This section provides a detailed description of Torbutton's options. Each -option is presented as the string from the preferences window, a summary, the -preferences it touches, and the effect this has on the components, chrome, and -browser properties.</para> -<!-- FIXME: figure out how to give subsections # ids or make this into a -listitem --> - <sect2> - <title>Proxy Settings</title> - <sect3> - <title>Test Settings</title> - <para> -This button under the Proxy Settings tab provides a way to verify that the -proxy settings are correct, and actually do route through the Tor network. It -performs this check by issuing an <ulink -url="http://developer.mozilla.org/en/docs/XMLHttpRequest%22%3EXMLHTTPRequest</ulink> -for <ulink -url="https://check.torproject.org/?TorButton=True%22%3Ehttps://check.torproject.o...</ulink>. -This is a special page that returns very simple, yet well-formed XHTML that -Torbutton can easily inspect for a hidden link with an id of -<command>TorCheckResult</command> and a target of <command>success</command> -or <command>failure</command> to indicate if the -user hit the page from a Tor IP, a non-Tor IP. This check is handled in -<function>torbutton_test_settings()</function> in <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink>. -Presenting the results to the user is handled by the <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont... -window</ulink> -callback <function>torbutton_prefs_test_settings()</function> in <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink>. - - </para> - </sect3> - </sect2> - <sect2> - <title>Dynamic Content Settings</title> - <sect3 id="plugins"> - <title>Disable plugins on Tor Usage (crucial)</title> - <para>Option: <command>extensions.torbutton.no_tor_plugins</command></para> - - <para>Java and plugins <ulink -url="http://java.sun.com/j2se/1.5.0/docs/api/java/net/class-use/NetworkInterface.... query</ulink> the <ulink -url="http://www.rgagnon.com/javadetails/java-0095.html%22%3Elocal IP -address</ulink> and report it back to the -remote site. They can also <ulink -url="http://decloak.net%22%3Ebypass proxy settings</ulink> and directly connect to a -remote site without Tor. Every browser plugin we have tested with Firefox has -some form of network capability, and every one ignores proxy settings or worse - only -partially obeys them. This includes but is not limited to: -QuickTime, Windows Media Player, RealPlayer, mplayerplug-in, AcroRead, and -Flash. - - </para> - <para> -Enabling this preference causes the above mentioned Torbutton chrome web progress - listener <command>torbutton_weblistener</command> to disable Java via <command>security.enable_java</command> and to disable - plugins via the browser <ulink - url="https://developer.mozilla.org/en/XUL%3aProperty%3adocShell%22%3EdocShell</ulink> - attribute <command>allowPlugins</command>. These flags are set every time a new window is - created (<function>torbutton_tag_new_browser()</function>), every time a web -load -event occurs - (<function>torbutton_update_tags()</function>), and every time the tor state is changed - (<function>torbutton_update_status()</function>). As a backup measure, plugins are also - prevented from loading by the content policy in <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink> if Tor is - enabled and this option is set. - </para> - - <para>All of this turns out to be insufficient if the user directly clicks -on a plugin-handled mime-type. <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=401296%22%3EIn this case</ulink>, -the browser decides that maybe it should ignore all these other settings and -load the plugin anyways, because maybe the user really did want to load it -(never mind this same load-style could happen automatically with meta-refresh -or any number of other ways..). To handle these cases, Torbutton stores a list -of plugin-handled mime-types, and sets the pref -<command>plugin.disable_full_page_plugin_for_types</command> to this list. -Additionally, (since nothing can be assumed when relying on Firefox -preferences and internals) if it detects a load of one of them from the web -progress listener, it cancels the request, tells the associated DOMWindow to -stop loading, clears the document, AND throws an exception. Anything short of -all this and the plugin managed to find some way to load. - </para> - -<!-- - -FIXME: Hrmm, technically this behavior is not covered by this pref. - - <para> -Furthermore, with version 3.0 and above, Firefox -<ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=440892%22%3Ebegan ignoring</ulink> - -<ulink -url="http://kb.mozillazine.org/Network.protocol-handler.warn-external.%28protocol...)</ulink> -prefs, which caused us to have to <link linkend="appblocker">wrap the external -app launcher components</link> to prevent external apps from being loaded to -bypass proxy settings. - </para> ---> - - <para> - All this could be avoided, of course, if Firefox would either <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=401296%22%3Eobey - allowPlugins</ulink> for directly visited URLs, or notify its content policy for such - loads either <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=309524%22%3Evia</ulink> <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=380556%22%3EshouldProcess</ulink> or shouldLoad. The fact that it does not is - not very encouraging. - </para> - - - <para> - -Since most plugins completely ignore browser proxy settings, the actions -performed by this setting are crucial to satisfying the <link -linkend="proxy">Proxy Obedience</link> requirement. - - </para> -</sect3> -<sect3> - <title>Isolate Dynamic Content to Tor State (crucial)</title> - - <para>Option: <command>extensions.torbutton.isolate_content</command></para> - -<para>Enabling this preference is what enables the <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink> content policy -mentioned above, and causes it to block content load attempts in pages an -opposite Tor state from the current state. Freshly loaded <ulink -url="https://developer.mozilla.org/en/XUL/tabbrowser%22%3Ebrowser -tabs</ulink> are tagged -with a <command>__tb_load_state</command> member in -<function>torbutton_update_tags()</function> and this -value is compared against the current tor state in the content policy.</para> - -<para>It also kills all Javascript in each page loaded under that state by -toggling the <command>allowJavascript</command> <ulink -url="https://developer.mozilla.org/en/XUL%3aProperty%3adocShell%22%3EdocShell</ulink> property, and issues a -<ulink -url="https://developer.mozilla.org/en/XPCOM_Interface_Reference/nsIWebNavigation#...)</ulink> to each browser tab (the -equivalent of hitting the STOP button).</para> - -<para> - -Unfortunately, <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=409737%22%3EFirefox bug -409737</ulink> prevents <command>docShell.allowJavascript</command> from killing -all event handlers, and event handlers registered with <ulink -url="http://developer.mozilla.org/en/docs/DOM:element.addEventListener%22%3EaddEv...)</ulink> -are still able to execute. The <link linkend="contentpolicy">Torbutton Content -Policy</link> should prevent such code from performing network activity within -the current tab, but activity that happens via a popup window or via a -Javascript redirect can still slip by. For this reason, Torbutton blocks -popups by checking for a valid <ulink -url="http://developer.mozilla.org/en/docs/DOM:window.opener%22%3Ewindow.opener</ulink> -attribute in <function>torbutton_check_progress()</function>. If the window -has an opener from a different Tor state, its load is blocked. The content -policy also takes similar action to prevent Javascript redirects. This also -has the side effect/feature of preventing the user from following any links -from a page loaded in an opposite Tor state. - -</para> - -<para> -This setting is responsible for satisfying the <link -linkend="isolation">Network Isolation</link> requirement. -</para> - -</sect3> -<sect3 id="jshooks"> - -<title>Hook Dangerous Javascript</title> - - <para>Option: <command>extensions.torbutton.kill_bad_js</command></para> - -<para>This setting enables injection of the <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont... -hooking code</ulink>. This is done in the chrome in -<function>torbutton_hookdoc()</function>, which is called ultimately by both the -<ulink -url="https://developer.mozilla.org/en/nsIWebProgressListener%22%3Ewebprogress -listener</ulink> <command>torbutton_weblistener</command> and the <link -linkend="contentpolicy">content policy</link> (the latter being a hack to handle -javascript: urls). - -In the Firefox 2 days, this option did a lot more than -it does now. It used to be responsible for timezone and improved useragent -spoofing, and history object cloaking. However, now it only provides -obfuscation of the <ulink -url="https://developer.mozilla.org/en/DOM/window.screen%22%3Ewindow.screen</ulink> -object to mask your browser and desktop resolution. -The resolution hooks -effectively make the Firefox browser window appear to websites as if the renderable area -takes up the entire desktop, has no toolbar or other GUI element space, and -the desktop itself has no toolbars. -These hooks drastically reduce the amount of information available to do <link -linkend="fingerprinting">anonymity set reduction attacks</link> and help to -meet the <link linkend="setpreservation">Anonymity Set Preservation</link> -requirements. Unfortunately, Gregory Fleischer discovered it is still possible -to retrieve the original screen values by using <ulink -url="http://pseudo-flaw.net/tor/torbutton/unmask-sandbox-xpcnativewrapper.html%22...</ulink> -or <ulink -url="http://pseudo-flaw.net/tor/torbutton/unmask-components-lookupmethod.html%22%...</ulink>. -We are still looking for a workaround as of Torbutton 1.3.2. - -<!-- FIXME: Don't forget to update this --> -<!-- XXX: Date() issue now fixed by TZ variable! --> - -</para> -</sect3> -<sect3> -<title>Resize windows to multiples of 50px during Tor usage (recommended)</title> - - <para>Option: <command>extensions.torbutton.resize_windows</command></para> - -<para> - -This option drastically cuts down on the number of distinct anonymity sets -that divide the Tor web userbase. Without this setting, the dimensions for a -typical browser window range from 600-1200 horizontal pixels and 400-1000 -vertical pixels, or about 600x600 = 360000 different sets. Resizing the -browser window to multiples of 50 on each side reduces the number of sets by -50^2, bringing the total number of sets to 144. Of course, the distribution -among these sets are not uniform, but scaling by 50 will improve the situation -due to this non-uniformity for users in the less common resolutions. -Obviously the ideal situation would be to lie entirely about the browser -window size, but this will likely cause all sorts of rendering issues, and is -also not implementable in a foolproof way from extension land. - -</para> -<para> - -The implementation of this setting is spread across a couple of different -locations in the Torbutton javascript <link linkend="browseroverlay">browser -overlay</link>. Since resizing minimized windows causes them to be restored, -and since maximized windows remember their previous size to the pixel, windows -must be resized before every document load (at the time of browser tagging) -via <function>torbutton_check_round()</function>, called by -<function>torbutton_update_tags()</function>. To prevent drift, the extension -tracks the original values of the windows and uses this to perform the -rounding on document load. In addition, to prevent the user from resizing a -window to a non-50px multiple, a resize listener -(<function>torbutton_do_resize()</function>) is installed on every new browser -window to record the new size and round it to a 50px multiple while Tor is -enabled. In all cases, the browser's contentWindow.innerWidth and innerHeight -are set. This ensures that there is no discrepancy between the 50 pixel cutoff -and the actual renderable area of the browser (so that it is not possible to -infer toolbar size/presence by the distance to the nearest 50 pixel roundoff). - -</para> -<para> -This setting helps to meet the <link -linkend="setpreservation">Anonymity Set Preservation</link> requirements. -</para> -</sect3> -<sect3> - -<title>Disable Search Suggestions during Tor (recommended)</title> - - <para>Option: <command>extensions.torbutton.no_search</command></para> - -<para> -This setting causes Torbutton to disable <ulink -url="http://kb.mozillazine.org/Browser.search.suggest.enabled%22%3E<command>browser.search.suggest.enabled</command></ulink> -during Tor usage. -This governs if you get Google search suggestions during Tor -usage. Your Google cookie is transmitted with google search suggestions, hence -this is recommended to be disabled. - -</para> -<para> -While this setting doesn't satisfy any Torbutton requirements, the fact that -cookies are transmitted for partially typed queries does not seem desirable -for Tor usage. -</para> -</sect3> - - -<sect3> -<title>Disable Updates During Tor</title> - - <para>Option: <command>extensions.torbutton.no_updates</command></para> - - <para>This setting causes Torbutton to disable the four <ulink -url="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Control... -update settings</ulink> during Tor - usage: <command>extensions.update.enabled</command>, -<command>app.update.enabled</command>, - <command>app.update.auto</command>, and -<command>browser.search.update</command>. These prevent the - browser from updating extensions, checking for Firefox upgrades, and - checking for search plugin updates while Tor is enabled. - </para> -<para> -This setting satisfies the <link -linkend="updates">Update Safety</link> requirement. -</para> -</sect3> -<sect3> -<title>Redirect Torbutton Updates Via Tor (recommended)</title> - - <para>Option: <command>extensions.torbutton.update_torbutton_via_tor</command></para> - - <para>This setting causes Torbutton to install an - -<ulink -url="https://developer.mozilla.org/en/nsIProtocolProxyFilter%22%3EnsIProtocolProx...</ulink> -in order to redirect all version update checks and Torbutton update downloads -via Tor, regardless of if Tor is enabled or not. This was done both to address -concerns about data retention done by <ulink -url="https://www.addons.mozilla.org%22%3Eaddons.mozilla.org</ulink>, as well as to -help censored users meet the <link linkend="undiscoverability">Tor -Undiscoverability</link> requirement. - - </para> -</sect3> - -<sect3> -<title>Disable livemarks updates during Tor usage (recommended)</title> - <para>Option: - <simplelist> - <member><command>extensions.torbutton.disable_livemarks</command></member> - </simplelist> - </para> - -<para> - -This option causes Torbutton to prevent Firefox from loading <ulink -url="http://www.mozilla.com/firefox/livebookmarks.html%22%3ELivemarks</ulink> during -Tor usage. Because people often have very personalized Livemarks (such as RSS -feeds of Wikipedia articles they maintain, etc). This is accomplished both by -<link linkend="livemarks">wrapping the livemark-service component</link> and -by calling stopUpdateLivemarks() on the <ulink -url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/co... -service</ulink> when Tor is enabled. - -</para> - -<para> -This helps satisfy the <link linkend="isolation">Network -Isolation</link> and <link linkend="setpreservation">Anonymity Set -Preservation</link> requirements. -</para> - -</sect3> -<sect3> -<title>Block Tor/Non-Tor access to network from file:// urls (recommended)</title> - <para>Options: - <simplelist> - <member><command>extensions.torbutton.block_tor_file_net</command></member> - <member><command>extensions.torbutton.block_nontor_file_net</command></member> - </simplelist> - </para> - -<para> - -These settings prevent file urls from performing network operations during the -respective Tor states. Firefox 2's implementation of same origin policy allows -file urls to read and <ulink -url="http://www.gnucitizen.org/blog/content-disposition-hacking/%22%3Esubmit -arbitrary files from the local filesystem</ulink> to arbitrary websites. To -make matters worse, the 'Content-Disposition' header can be injected -arbitrarily by exit nodes to trick users into running arbitrary html files in -the local context. These preferences cause the <link -linkend="contentpolicy">content policy</link> to block access to any network -resources from File urls during the appropriate Tor state. - -</para> -<para> - -This preference helps to ensure Tor's <link linkend="isolation">Network -Isolation</link> requirement, by preventing file urls from executing network -operations in opposite Tor states. Also, allowing pages to submit arbitrary -files to arbitrary sites just generally seems like a bad idea. - -</para> -</sect3> - -<sect3> - -<title>Close all Tor/Non-Tor tabs and windows on toggle (optional)</title> - - <para>Options: - <simplelist> - <member><command>extensions.torbutton.close_nontor</command></member> - <member><command>extensions.torbutton.close_tor</command></member> - </simplelist> - </para> - -<para> - -These settings cause Torbutton to enumerate through all windows and close all -tabs in each window for the appropriate Tor state. This code can be found in -<function>torbutton_update_status()</function>. The main reason these settings -exist is as a backup mechanism in the event of any Javascript or content policy -leaks due to <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=409737%22%3EFirefox Bug -409737</ulink>. Torbutton currently tries to block all Javascript network -activity via the content policy, but until that bug is fixed, there is some -risk that there are alternate ways to bypass the policy. This option is -available as an extra assurance of <link linkend="isolation">Network -Isolation</link> for those who would like to be sure that when Tor is toggled -all page activity has ceased. It also serves as a potential future workaround -in the event a content policy failure is discovered, and provides an additional -level of protection for the <link linkend="disk">Disk Avoidance</link> -protection so that browser state is not sitting around waiting to be swapped -out longer than necessary. - -</para> -<para> -While this setting doesn't satisfy any Torbutton requirements, the fact that -cookies are transmitted for partially typed queries does not seem desirable -for Tor usage. -</para> -</sect3> - </sect2> - <sect2> - <title>History and Forms Settings</title> -<sect3> -<title>Isolate Access to History navigation to Tor state (crucial)</title> - <para>Option: <command>extensions.torbutton.block_js_history</command></para> - <para> -This setting determines if Torbutton installs an <ulink -url="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistoryListene...</ulink> -attached to the <ulink -url="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory%22%3Es...</ulink> of -of each browser's <ulink -url="https://developer.mozilla.org/en/XUL%3aProperty%3awebNavigation%22%3EwebNavi...</ulink>. -The nsIShistoryListener is instantiated with a reference to the containing -browser window and blocks the back, forward, and reload buttons on the browser -navigation bar when Tor is in an opposite state than the one to load the -current tab. In addition, Tor clears the session history during a new document -load if this setting is enabled. - - </para> - <para> - -This is marked as a crucial setting in part -because Javascript access to the history object is indistinguishable from -user clicks, and because -<ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=409737%22%3EFirefox Bug -409737</ulink> allows javascript to execute in opposite Tor states, javascript -can issue reloads after Tor toggle to reveal your original IP. Even without -this bug, however, Javascript is still able to access previous pages in your -session history that may have been loaded under a different Tor state, to -attempt to correlate your activity. - - </para> - <para> - -This setting helps to fulfill Torbutton's <link linkend="state">State -Separation</link> and (until Bug 409737 is fixed) <link linkend="isolation">Network Isolation</link> -requirements. - - </para> -</sect3> - - -<sect3> -<title>History Access Settings</title> - - <para>Options: - <simplelist> - <member><command>extensions.torbutton.block_thread</command></member> - <member><command>extensions.torbutton.block_nthread</command></member> - <member><command>extensions.torbutton.block_thwrite</command></member> - <member><command>extensions.torbutton.block_nthwrite</command></member> - </simplelist> - </para> - -<para>On Firefox 3.x, these four settings govern the behavior of the <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink> -history blocker component mentioned above. By hooking the browser's view of -the history itself via the <ulink -url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/co...</ulink> -and <ulink -url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/co...</ulink> -components, this mechanism defeats all document-based <ulink -url="http://whattheinternetknowsaboutyou.com/%22%3Ehistory disclosure -attacks</ulink>, including <ulink -url="http://ha.ckers.org/weird/CSS-history.cgi%22%3ECSS-only attacks</ulink>. - -The component also hooks functions involved in writing history to disk via -both the <ulink -url="http://developer.mozilla.org/en/docs/Places_migration_guide#History%22%3EPla... -Database</ulink> and the older Firefox 2 mechanisms. - -</para> - -<para> -On Firefox 4, Mozilla finally <ulink -url="https://developer.mozilla.org/en/CSS/Privacy_and_the_%3avisited_selector%22%... -these issues</ulink>, so we can effectively ignore the "read" pair of the -above prefs. We then only need to link the write prefs to -<command>places.history.enabled</command>, which disabled writing to the -history store while set. -</para> - -<para> -This setting helps to satisfy the <link -linkend="state">State Separation</link> and <link -linkend="disk">Disk Avoidance</link> requirements. -</para> - -</sect3> -<sect3> - -<title>Clear History During Tor Toggle (optional)</title> - -<para>Option: <command>extensions.torbutton.clear_history</command></para> - -<para>This setting governs if Torbutton calls -<ulink -url="https://developer.mozilla.org/en/nsIBrowserHistory#removeAllPages.28.29%22%3...</ulink> -and <ulink -url="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory%22%3En...</ulink> -for each tab on Tor toggle.</para> -<para> -This setting is an optional way to help satisfy the <link -linkend="state">State Separation</link> requirement. -</para> - -</sect3> -<sect3> -<title>Block Password+Form saving during Tor/Non-Tor</title> - -<para>Options: - <simplelist> - <member><command>extensions.torbutton.block_tforms</command></member> - <member><command>extensions.torbutton.block_ntforms</command></member> - </simplelist> - </para> - -<para>These settings govern if Torbutton disables -<command>browser.formfill.enable</command> -and <command>signon.rememberSignons</command> during Tor and Non-Tor usage. -Since form fields can be read at any time by Javascript, this setting is a lot -more important than it seems. -</para> - -<para> -This setting helps to satisfy the <link -linkend="state">State Separation</link> and <link -linkend="disk">Disk Avoidance</link> requirements. -</para> - -</sect3> - </sect2> - <sect2> - <title>Cache Settings</title> -<sect3> - <title>Block Tor disk cache and clear all cache on Tor Toggle</title> - - <para>Option: <command>extensions.torbutton.clear_cache</command> - </para> - -<para>This option causes Torbutton to call <ulink -url="https://developer.mozilla.org/en/nsICacheService#evictEntries.28.29%22%3EnsI...)</ulink> -on Tor toggle to remove all entries from the cache. In addition, this setting -causes Torbutton to set <ulink -url="http://kb.mozillazine.org/Browser.cache.disk.enable%22%3Ebrowser.cache.disk....</ulink> to false. -</para> -<para> -This setting helps to satisfy the <link -linkend="state">State Separation</link> and <link -linkend="disk">Disk Avoidance</link> requirements. -</para> - -</sect3> -<sect3> - <title>Block disk and memory cache during Tor</title> - -<para>Option: <command>extensions.torbutton.block_cache</command></para> - -<para>This setting -causes Torbutton to set <ulink -url="http://kb.mozillazine.org/Browser.cache.memory.enable%22%3Ebrowser.cache.mem...</ulink>, -<ulink -url="http://kb.mozillazine.org/Browser.cache.disk.enable%22%3Ebrowser.cache.disk....</ulink> and -<ulink -url="http://kb.mozillazine.org/Network.http.use-cache%22%3Enetwork.http.use-cache</ulink> to false during tor usage. -</para> -<para> -This setting helps to satisfy the <link -linkend="state">State Separation</link> and <link -linkend="disk">Disk Avoidance</link> requirements. -</para> - -</sect3> - </sect2> - <sect2> - <title>Cookie and Auth Settings</title> -<sect3> - <title>Clear Cookies on Tor Toggle</title> - -<para>Option: <command>extensions.torbutton.clear_cookies</command> - </para> - -<para> - -This setting causes Torbutton to call <ulink -url="https://developer.mozilla.org/en/nsICookieManager#removeAll.28.29%22%3EnsICo...)</ulink> on -every Tor toggle. In addition, this sets <ulink -url="http://kb.mozillazine.org/Network.cookie.lifetimePolicy%22%3Enetwork.cookie....</ulink> -to 2 for Tor usage, which causes all cookies to be demoted to session cookies, -which prevents them from being written to disk. - -</para> -<para> -This setting helps to satisfy the <link -linkend="state">State Separation</link> and <link -linkend="disk">Disk Avoidance</link> requirements. -</para> - -</sect3> -<sect3> - - <title>Store Non-Tor cookies in a protected jar</title> - -<para>Option: <command>extensions.torbutton.cookie_jars</command> - </para> - -<para> - -This setting causes Torbutton to use <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink> to store -non-tor cookies in a cookie jar during Tor usage, and clear the Tor cookies -before restoring the jar. -</para> -<para> -This setting also sets <ulink -url="http://kb.mozillazine.org/Network.cookie.lifetimePolicy%22%3Enetwork.cookie....</ulink> -to 2 for Tor usage, which causes all cookies to be demoted to session cookies, -which prevents them from being written to disk. - -</para> - -<para> -This setting helps to satisfy the <link -linkend="state">State Separation</link> and <link -linkend="disk">Disk Avoidance</link> requirements. -</para> - - -</sect3> -<sect3> - - <title>Store both Non-Tor and Tor cookies in a protected jar (dangerous)</title> - -<para>Option: <command>extensions.torbutton.dual_cookie_jars</command> - </para> - -<para> - -This setting causes Torbutton to use <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink> to store -both Tor and Non-Tor cookies into protected jars. -</para> - -<para> -This setting helps to satisfy the <link -linkend="state">State Separation</link> requirement. -</para> - - -</sect3> - -<!-- FIXME: If we decide to keep it, document the cookie protections dialog ---> - -<sect3> - - <title>Manage My Own Cookies (dangerous)</title> - -<para>Options: None</para> -<para>This setting disables all Torbutton cookie handling by setting the above -cookie prefs all to false.</para> -</sect3> -<sect3> - -<sect3> - <title>Do not write Tor/Non-Tor cookies to disk</title> - <para>Options: - <simplelist> - <member><command>extensions.torbutton.tor_memory_jar</command></member> - <member><command>extensions.torbutton.nontor_memory_jar</command></member> - </simplelist> - </para> - -<para> -These settings (contributed by arno) cause Torbutton to set <ulink -url="http://kb.mozillazine.org/Network.cookie.lifetimePolicy%22%3Enetwork.cookie....</ulink> -to 2 during the appropriate Tor state, and to store cookies acquired in that -state into a Javascript -<ulink -url="http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Guide:Processing_XM...</ulink> -object as opposed to writing them to disk. -</para> - -<para> -This allows Torbutton to provide an option to preserve a user's -cookies while still satisfying the <link linkend="disk">Disk Avoidance</link> -requirement. -</para> -</sect3> - - - <title>Disable DOM Storage during Tor usage (crucial)</title> - -<para>Option: <command>extensions.torbutton.disable_domstorage</command> - </para> - -<para> - -This setting causes Torbutton to toggle <command>dom.storage.enabled</command> during Tor -usage to prevent -<ulink - url="http://developer.mozilla.org/en/docs/DOM:Storage%22%3EDOM Storage</ulink> from - being used to store persistent information across Tor states.</para> -<para> -This setting helps to satisfy the <link -linkend="state">State Separation</link> requirement. -</para> - -</sect3> - -<sect3> - <title>Clear HTTP Auth on Tor Toggle (recommended)</title> -<para>Option: <command>extensions.torbutton.clear_http_auth</command> - </para> - -<para> -This setting causes Torbutton to call <ulink -url="http://www.oxymoronical.com/experiments/apidocs/interface/nsIHttpAuthManager...)</ulink> -every time Tor is toggled. -</para> - -<para> -This setting helps to satisfy the <link -linkend="state">State Separation</link> requirement. -</para> -</sect3> - </sect2> - <sect2> - <title>Startup Settings</title> -<sect3> - <title>On Browser Startup, set Tor state to: Tor, Non-Tor</title> - <para>Options: - <command>extensions.torbutton.restore_tor</command> - </para> - - <para>This option governs what Tor state tor is loaded in to. -<function>torbutton_set_initial_state()</function> covers the case where the -browser did not crash, and <function>torbutton_crash_recover()</function> -covers the case where the <link linkend="crashobserver">crash observer</link> -detected a crash. -</para> -<para> - -Since the Tor state after a Firefox crash is unknown/indeterminate, this -setting helps to satisfy the <link linkend="state">State Separation</link> -requirement in the event of Firefox crashes by ensuring all cookies, -settings and saved sessions are reloaded from a fixed Tor state. - -</para> -</sect3> - - -<sect3> - <title>Prevent session store from saving Non-Tor/Tor-loaded tabs</title> - - <para>Options: - <simplelist> - <member><command>extensions.torbutton.nonontor_sessionstore</command></member> - <member><command>extensions.torbutton.notor_sessionstore</command></member> - </simplelist> - </para> - - <para>If these options are enabled, the <link -linkend="tbsessionstore">tbSessionStore.js</link> component uses the session -store listeners to filter out the appropriate tabs before writing the session -store data to disk. -</para> -<para> -This setting helps to satisfy the <link linkend="disk">Disk Avoidance</link> -requirement, and also helps to satisfy the <link -linkend="state">State Separation</link> requirement in the event of Firefox -crashes. - -</para> - -</sect3> - </sect2> - <sect2> - <title>Shutdown Settings</title> -<sect3> - - <title>Clear cookies on Tor/Non-Tor shutdown</title> - -<para>Option: <command>extensions.torbutton.shutdown_method</command> - </para> - -<para> This option variable can actually take 3 values: 0, 1, and 2. 0 means no -cookie clearing, 1 means clear only during Tor-enabled shutdown, and 2 means -clear for both Tor and Non-Tor shutdown. When set to 1 or 2, Torbutton listens -for the <ulink -url="http://developer.mozilla.org/en/docs/Observer_Notifications#Application_shut...</ulink> event in -<link linkend="crashobserver">crash-observer.js</link> and use <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/...</ulink> -to clear out all cookies and all cookie jars upon shutdown. -</para> -<para> -This setting helps to satisfy the <link -linkend="state">State Separation</link> requirement. -</para> - - -</sect3> - </sect2> - <sect2> - <title>Header Settings</title> -<sect3> - - <title>Set user agent during Tor usage (crucial)</title> - <para>Options: - <simplelist> - <member><command>extensions.torbutton.set_uagent</command></member> - <member><command>extensions.torbutton.platform_override</command></member> - <member><command>extensions.torbutton.oscpu_override</command></member> - <member><command>extensions.torbutton.buildID_override</command></member> - <member><command>extensions.torbutton.productsub_override</command></member> - <member><command>extensions.torbutton.appname_override</command></member> - <member><command>extensions.torbutton.appversion_override</command></member> - <member><command>extensions.torbutton.useragent_override</command></member> - <member><command>extensions.torbutton.useragent_vendor</command></member> - <member><command>extensions.torbutton.useragent_vendorSub</command></member> - </simplelist> - </para> - -<para>On face, user agent switching appears to be straight-forward in Firefox. -It provides several options for controlling the browser user agent string: -<command>general.appname.override</command>, -<command>general.appversion.override</command>, -<command>general.platform.override</command>, -<command>general.oscpu.override</command>, -<command>general.productSub.override</command>, -<command>general.buildID.override</command>, -<command>general.useragent.override</command>, -<command>general.useragent.vendor</command>, and -<command>general.useragent.vendorSub</command>. If -the Torbutton preference <command>extensions.torbutton.set_uagent</command> is -true, Torbutton copies all of the other above prefs into their corresponding -browser preferences during Tor usage.</para> - - -<para> - -It also turns out that it is possible to detect the original Firefox version -by <ulink url="http://ha.ckers.org/blog/20070516/read-firefox-settings-poc/">inspecting -certain resource:// files</ulink>. These cases are handled by Torbutton's -<link linkend="contentpolicy">content policy</link>. - -</para> - -<para> -This setting helps to satisfy the <link -linkend="setpreservation">Anonymity Set Preservation</link> requirement. -</para> - - -</sect3> -<sect3> - - <title>Spoof US English Browser</title> -<para>Options: -<simplelist> - <member><command>extensions.torbutton.spoof_english</command></member> - <member><command>extensions.torbutton.spoof_charset</command></member> - <member><command>extensions.torbutton.spoof_language</command></member> -</simplelist> -</para> - -<para> This option causes Torbutton to set -<command>general.useragent.locale</command> -<command>intl.accept_languages</command> to the value specified in -<command>extensions.torbutton.spoof_locale</command>, -<command>extensions.torbutton.spoof_charset</command> and -<command>extensions.torbutton.spoof_language</command> during Tor usage, as -well as hooking <command>navigator.language</command> via its <link -linkend="jshooks">javascript hooks</link>. - </para> -<para> -This setting helps to satisfy the <link -linkend="setpreservation">Anonymity Set Preservation</link> and <link -linkend="location">Location Neutrality</link> requirements. -</para> - -</sect3> - -<sect3> - <title>Referer Spoofing Options</title> - -<para>Option: <command>extensions.torbutton.refererspoof</command> -</para> - -<para> -This option variable has three values. If it is 0, "smart" referer spoofing is -enabled. If it is 1, the referer behaves as normal. If it is 2, no referer is -sent. The default value is 1. The smart referer spoofing is implemented by the -<link linkend="refspoofer">torRefSpoofer</link> component. - -</para> -<para> -This setting also does not directly satisfy any Torbutton requirement, but -some may desire to mask their referer for general privacy concerns. -</para> -</sect3> - -<sect3> - <title>Automatically use an alternate search engine when presented with a -Google Captcha</title> - -<para>Options: -<simplelist> - <member><command>extensions.torbutton.asked_google_captcha</command></member> - <member><command>extensions.torbutton.dodge_google_captcha</command></member> - <member><command>extensions.torbutton.google_redir_url</command></member> -</simplelist> -</para> - -<para> - -Google's search engine has rate limiting features that cause it to -<ulink -url="http://googleonlinesecurity.blogspot.com/2007/07/reason-behind-were-sorry-me... -captchas</ulink> and sometimes even outright ban IPs that issue large numbers -of search queries, especially if a lot of these queries appear to be searching -for software vulnerabilities or unprotected comment areas. - -</para> -<para> - -Despite multiple discussions with Google, we were unable to come to a solution -or any form of compromise that would reduce the number of captchas and -outright bans seen by Tor users issuing regular queries. - -</para> -<para> -As a result, we've implemented this option as an <ulink -url="https://developer.mozilla.org/en/XUL_School/Intercepting_Page_Loads#HTTP_Obs...'</ulink> -http observer to optionally redirect banned or captcha-triggering Google -queries to search engines that do not rate limit Tor users. The current -options are duckduckgo.com, ixquick.com, bing.com, yahoo.com and scroogle.org. These are -encoded in the preferences -<command>extensions.torbutton.redir_url.[1-5]</command>. - -</para> -</sect3> - -<sect3> - - <title>Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</title> - -<para>Options: -<simplelist> - <member><command>extensions.torbutton.jar_certs</command></member> - <member><command>extensions.torbutton.jar_ca_certs</command></member> -</simplelist> -</para> -<para> - -These settings govern if Torbutton attempts to isolate the user's SSL -certificates into separate jars for each Tor state. This isolation is -implemented in <function>torbutton_jar_certs()</function> in <ulink -url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/cont...</ulink>, -which calls <function>torbutton_jar_cert_type()</function> and -<function>torbutton_unjar_cert_type()</function> for each certificate type in -the <ulink -url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/co...</ulink>. -Certificates are deleted from and imported to the <ulink -url="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/co...</ulink>. -</para> - -<para> -The first time this pref is used, a backup of the user's certificates is -created in their profile directory under the name -<filename>cert8.db.bak</filename>. This file can be copied back to -<filename>cert8.db</filename> to fully restore the original state of the -user's certificates in the event of any error. -</para> - -<para> -Since exit nodes and malicious sites can insert content elements sourced to -specific SSL sites to query if a user has a certain certificate, -this setting helps to satisfy the <link linkend="state">State -Separation</link> requirement of Torbutton. Unfortunately, <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=435159%22%3EFirefox Bug -435159</ulink> prevents it from functioning correctly in the event of rapid Tor toggle, so it -is currently not exposed via the preferences UI. - -</para> - -</sect3> - - -</sect2> -</sect1> - -<sect1 id="FirefoxBugs"> - <title>Relevant Firefox Bugs</title> - <para> -Future releases of Torbutton are going to be designed around supporting only -<ulink url="https://www.torproject.org/projects/torbrowser.html.en">Tor -Browser Bundle</ulink>, which greatly simplifies the number and nature of Firefox -bugs we must fix. This allows us to abandon the complexities of <link -linkend="state">State -Separation</link> and <link linkend="isolation">Network Isolation</link> requirements -associated with the Toggle Model. - </para> - <sect2 id="TorBrowserBugs"> - <title>Tor Browser Bugs</title> - <para> -The list of Firefox patches we must create to improve privacy on the -Tor Browser Bundle are collected in the Tor Bug Tracker under <ulink -url="https://trac.torproject.org/projects/tor/ticket/2871%22%3Eticket -#2871</ulink>. These bugs are also applicable to the Toggle Model, and -should be considered higher priority than all Toggle Model specific bugs -below. - </para> - </sect2> - <sect2 id="ToggleModelBugs"> - <title>Toggle Model Bugs</title> - <para> -In addition to the Tor Browser bugs, the Torbutton Toggle Model suffers from -additional bugs specific to the need to isolate state across the toggle. -Toggle model bugs are considered a lower priority than the bugs against the -Tor Browser model. - </para> - <sect3 id="FirefoxSecurity"> - <title>Bugs impacting security</title> - <para> - -Torbutton has to work around a number of Firefox bugs that impact its -security. Most of these are mentioned elsewhere in this document, but they -have also been gathered here for reference. In order of decreasing severity, -they are: - - </para> - <orderedlist> -<!-- -Duplicated in toggle model. - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=429070%22%3EBug 429070 - exposing -Components.interfaces to untrusted content leaks information about installed -extensions</ulink> - <para> -<ulink url="http://pseudo-flaw.net/">Gregory Fleischer</ulink> demonstrated at Defcon 17 that these interfaces can -also be used to <ulink -url="http://pseudo-flaw.net/tor/torbutton/fingerprint-firefox.html%22%3Efingerpri... -Firefox down the to the minor version</ulink>. Note that his test has not been -updated since 3.5.3, hence it reports 3.5.3 for more recent Firefoxes. This -bug interferes with Torbutton's ability to satisfy its <link -linkend="setpreservation">Anonymity Set Preservation</link> requirement. - </para> - </listitem> - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=280661%22%3EBug 280661 - SOCKS proxy server -connection timeout hard-coded</ulink> - <para> - -This bug prevents us from using the Firefox SOCKS layer directly, and -currently requires us to ship an auxiliary HTTP proxy called <ulink -url="http://www.pps.jussieu.fr/~jch/software/polipo/%22%3EPolipo</ulink>. If this -patch were landed, we would no longer need to ship Polipo, which has a number -of privacy and security issues of its own (in addition to being unmaintained). - - </para> - </listitem> - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=418986%22%3EBug 418986 - window.screen -provides a large amount of identifiable information</ulink> - <para> - -As <link linkend="fingerprinting">mentioned above</link>, a large amount of -information is available from <ulink -url="http://developer.mozilla.org/en/docs/DOM:window.screen%22%3Ewindow.screen</ulink>. -The most sensitive data to anonymity is actually that which is not used in -rendering - such as desktop resolution, and window decoration size. -Currently, there is no way to obscure this information without Javascript -hooking. In addition, many of this same desktop and window decoration -resolution information is available via <ulink -url="https://developer.mozilla.org/En/CSS/Media_queries%22%3ECSS Media -Queries</ulink>, so perhaps some more lower-level rendering controls or -preferences need to be provided. These issues interfere with Torbutton's -ability to fulfill its <link linkend="setpreservation">Anonymity Set -Preservation</link> requirement. - - </para> - </listitem> ---> - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=435159%22%3EBug 435159 - -nsNSSCertificateDB::DeleteCertificate has race conditions</ulink> - <para> - -In Torbutton 1.2.0rc1, code was added to attempt to isolate SSL certificates -the user has installed. Unfortunately, the method call to delete a certificate -from the current certificate database acts lazily: it only sets a variable -that marks a cert for deletion later, and it is not cleared if that -certificate is re-added. This means that if the Tor state is toggled quickly, -that certificate could remain present until it is re-inserted (causing an -error dialog), and worse, it would still be deleted after that. The lack of -this functionality is considered a Torbutton security bug because cert -isolation is considered a <link linkend="state">State Separation</link> -feature. - - </para> - </listitem> - <listitem>Give more visibility into and control over TLS -negotiation - <para> - -There are several <ulink -url="https://trac.torproject.org/projects/tor/ticket/2482%22%3ETLS issues -impacting Torbutton security</ulink>. It is not clear if these should be one -Firefox bug or several, but in particular we need better control over various -aspects of TLS connections. Firefox currently provides no observer capable of -extracting TLS parameters or certificates early enough to cancel a TLS -request. We would like to be able to provide <ulink -url="https://www.eff.org/https-everywhere%22%3EHTTPS-Everywhere</ulink> users with -the ability to <ulink -url="https://trac.torproject.org/projects/tor/wiki/HTTPSEverywhere/SSLObservatory... -their certificates audited</ulink> by a <ulink -url="http://www.networknotary.org/%22%3EPerspectives</ulink>-style set of -notaries. The problem with this is that the API observer points do not exist -for any Firefox addon to actually block authentication token submission over a -TLS channel, so every addon to date (including Perspectives) is actually -providing users with notification *after* their authentication tokens have -already been compromised. This obviously needs to be fixed. - </para> - </listitem> -<!-- -This is under the Tor Browser model. - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=575230%22%3EBug 575230 - Provide option to -reduce precision of Date()</ulink> - <para> - -Currently it is possible to <ulink -url="http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to-... -users based on their typing cadence</ulink> using the high precision timer -available to javascript. Using this same precision, it is possible to compute -an identifier based upon the clock drift of the client from some nominal -source. The latter is not much of a concern for Tor users, as the variable -delay to load and run a page is measured on the order of seconds, but the high -precision timer can still be used to fingerprint aspects of a browser's -javascript engine and processor, and apparently also a user's typing cadence. -This bug hinders Torbutton's ability to satisfy its <link -linkend="setpreservation">Anonymity Set Preservation</link> requirement. - - </para> - </listitem> ---> - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=122752%22%3EBug 122752 - SOCKS -Username/Password Support</ulink> - <para> -We need <ulink url="https://developer.mozilla.org/en/nsIProxyInfo">Firefox -APIs</ulink> or about:config settings to control the SOCKS Username and -Password fields. The reason why we need this support is to utilize an (as yet -unimplemented) scheme to separate Tor traffic based <ulink -url="https://gitweb.torproject.org/torspec.git/blob_plain/HEAD:/proposals/171-sep... -SOCKS username/password</ulink>. - </para> - </listitem> - - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=409737%22%3EBug 409737 - -javascript.enabled and docShell.allowJavascript do not disable all event -handlers</ulink> - <para> - -This bug allows pages to execute javascript via addEventListener and perhaps -other callbacks. In order to prevent this bug from enabling an attacker to -break the <link linkend="isolation">Network Isolation</link> requirement, -Torbutton 1.1.13 began blocking popups and history manipulation from different -Tor states. So long as there are no ways to open popups or redirect the user -to a new page, the <link linkend="contentpolicy">Torbutton content -policy</link> should block Javascript network access. However, if there are -ways to open popups or perform redirects such that Torbutton cannot block -them, pages may still have free reign to break that requirement and reveal a -user's original IP address. - - </para> - </listitem> - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=448743%22%3EBug 448743 - -Decouple general.useragent.locale from spoofing of navigator.language</ulink> - <para> - -Currently, Torbutton spoofs the <command>navigator.language</command> -attribute via <link linkend="jshooks">Javascript hooks</link>. Unfortunately, -these do not work on Firefox 3. It would be ideal to have -a pref to set this value (something like a -<command>general.useragent.override.locale</command>), -to avoid fragmenting the anonymity set of users of foreign locales. This issue -impedes Torbutton from fully meeting its <link -linkend="setpreservation">Anonymity Set Preservation</link> -requirement on Firefox 3. - - </para> - </listitem> - </orderedlist> - </sect3> -<!-- XXX: Need to create a bug for DOM storage APIs at some point --> - <sect3 id="FirefoxWishlist"> - <title>Bugs blocking functionality</title> - <para> -The following bugs impact Torbutton and similar extensions' functionality. - </para> - - <orderedlist> - -<!-- - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=445696%22%3EBug 445696 - -Extensions cannot determine if Firefox is full screen</ulink> - <para> - -The windowState property of <ulink -url="https://developer.mozilla.org/en/XUL/window%22%3EChromeWindows</ulink> does not accurately reflect the true -state of the window in some cases on Linux. This causes Torbutton to attempt -to resize maximized and minimized windows when it should not. - - </para> - </listitem> ---> - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=629820%22%3EBug 629820 - nsIContentPolicy::shouldLoad not -called for web request in Firefox Mobile</ulink> - <para> - -The new <ulink -url="https://wiki.mozilla.org/Mobile/Fennec/Extensions/Electrolysis%22%3EElectrol...</ulink> -multiprocess system appears to have some pretty rough edge cases with respect -to registering XPCOM category managers such as the nsIContentPolicy, which -make it difficult to do a straight-forward port of Torbutton or -HTTPS-Everywhere to Firefox Mobile. It probably also has similar issues with -wrapping existing <link linkend="hookedxpcom">Firefox XPCOM components</link>, -which will also cause more problems for porting Torbutton. - - </para> - </listitem> -<!-- - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=290456%22%3EBug 290456 - -Block/clear Flash MX "cookies" as well</ulink> - <para> - -Today, it is possible to allow plugins if you have a transparent proxy such as -<ulink url="http://anonymityanywhere.com/incognito/">Incognito</ulink> to prevent proxy bypass. However, flash cookies can still be used to -link your Tor and Non-Tor activity, and this reveal your IP to an adversary -that does so. This can be solved by manually removing your flash cookies (like -<ulink -url="https://addons.mozilla.org/en-US/firefox/addon/6623%22%3EBetterPrivacy</ulink> does), but -it would be nice if there was a standard way to do this from a Firefox API. - - </para> - </listitem> ---> - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=417869%22%3EBug 417869 - -Browser context is difficult to obtain from many XPCOM callbacks</ulink> - <para> - -It is difficult to determine which tabbrowser many XPCOM callbacks originate -from, and in some cases absolutely no context information is provided at all. -While this doesn't have much of an effect on Torbutton, it does make writing -extensions that would like to do per-tab settings and content filters (such as -FoxyProxy) difficult to impossible to implement securely. - - </para> - </listitem> -<!-- -FIXME: This doesn't really apply anymore. - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=418321%22%3EBug 418321 - -Components do not expose disk interfaces</ulink> - <para> - -Several components currently provide no way of reimplementing their disk -access to easily satisfy Torbutton's <link linkend="disk">Disk -Avoidance</link> requirements. Workarounds exist, but they are <link -linkend="sessionstore">clunky</link>, and -some of them involve disabling functionality during Tor usage. - - </para> - </listitem> ---> - -<!-- -FIXME: Need to use new observer methods if possible - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=448741%22%3EBug 448741 - -nsISessionStore uses private methods and is not extensible</ulink> - <para> - -Similar to the above bug, in the specific case of the sessionstore component, -the API is not amenable to Contract ID hooking, and this requires that -Torbutton include modified copies of this component for Firefox 2 and 3, which -has <ulink -url="https://bugs.torproject.org/flyspray/index.php?do=details&id=722%22%3Era... -objections</ulink> from some developers. - - </para> - </listitem> - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=439384%22%3EBug 439384 - -"profile-do-change" event does not cause cookie table reload</ulink> - <para> - -In Firefox 3, the change to the new SQLlite database for cookie storage has a -bug that prevents Torbutton's cookie jaring from working properly. The -"profile-do-change" observer event no longer properly causes either a sync or -reload of the cookie database from disk after it is copied into place. -Torbutton currently works around this by issuing the SQLLite queries manually -to store and rebuild the cookie database. - - </para> - </listitem> - - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=248970%22%3EBug 248970 (PrivateBrowsing) - Private Browsing mode (global toggle for -saving/caching everything)</ulink> - <para> - -This bug catalogs the discussion of a 'Private Mode' in Firefox that would -perform many, but not all, of the activities of Torbutton. It would be useful -to leverage the resulting setting to simplify Torbutton. This bug is listed so -we can track this progress and ensure that it doesn't end up defining -behaviors contrary to and incompatible with Torbutton's requirements (though a -subset of the <link linkend="requirements">requirements</link> is of course fine). - - </para> - </listitem> ---> - - - - </orderedlist> - </sect3> - <sect3 id="FirefoxMiscBugs"> - <title>Low Priority Bugs</title> - <para> -The following bugs have an effect upon Torbutton, but are superseded by more -practical and more easily fixable variant bugs above; or have stable, simple -workarounds. - </para> - - <orderedlist> -<!-- - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=435151%22%3EBug 435151 - XPCSafeJSObjectWrapper breaks evalInSandbox</ulink> - <para> - -Under Firefox 3, the XPCSafeJSObjectWrapper breaks when you try to use -constructors of classes defined from within the scope of the sandbox, among -other things. This prevents Torbutton from applying the Timezone hooks under -Firefox 3, but a better solution for Torbutton's specific date hooking needs -would be a fix for the above mentioned Bug 392274. Of course, many more -extensions may be interested in the sandbox hooking functionality working -properly though. - - </para> - </listitem> ---> - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=440892%22%3EBug 440892 - -network.protocol-handler.warn-external are ignored</ulink> - <para> - -Sometime in the Firefox 3 development cycle, the preferences that governed -warning a user when external apps were launched got disconnected from the code -that does the launching. Torbutton depended on these prefs to prevent websites -from launching specially crafted documents and application arguments that -caused Proxy Bypass. We currently work around this issue by <link -linkend="appblocker">wrapping the app launching components</link> to present a -popup before launching external apps while Tor is enabled. While this works, -it would be nice if these prefs were either fixed or removed. - - </para> - </listitem> - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=437014%22%3EBug 437014 - -nsIContentPolicy::shouldLoad no longer called for favicons</ulink> - <para> - -Firefox 3.0 stopped calling the shouldLoad call of content policy for favicon -loads. Torbutton had relied on this call to block favicon loads for opposite -Tor states. The workaround it employs for Firefox 3 is to cancel the request -when it arrives in the <command>torbutton_http_observer</command> used for -blocking full page plugin loads. This seems to work just fine, but is a bit -dirty. - - </para> - </listitem> -<!-- - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=437016%22%3EBug 437016 - -nsIContentPolicy::shouldLoad not called for livemarks</ulink> - <para> - -An alternative fix for the livemarks bug above would be to block livemarks -fetches from the content policy. Unfortunately shouldLoad is not called for -livemarks fetches. - - </para> - </listitem> ---> - - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=309524%22%3EBug 309524</ulink> -and <ulink url="https://bugzilla.mozilla.org/show_bug.cgi?id=380556">Bug -380556</ulink> - nsIContentPolicy::shouldProcess is not called. - <para> - -This is a call that would be useful to develop a better workaround for the -allowPlugins issue above. If the content policy were called before a URL was -handed over to a plugin or helper app, it would make the workaround for the -above allowPlugins bug a lot cleaner. Obviously this bug is not as severe as -the others though, but it might be nice to have this API as a backup. - - </para> - </listitem> - - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=401296%22%3EBug 401296 - docShell.allowPlugins -not honored for direct links</ulink> (Perhaps subset of <ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=282106%22%3EBug 282106</ulink>?) - <para> - -Similar to the javascript plugin disabling attribute, the plugin disabling -attribute is also not perfect &mdash; it is ignored for direct links to plugin -handled content, as well as meta-refreshes to plugin handled content. This -requires Torbutton to listen to a number of different http events to intercept -plugin-related mime type URLs and cancel their requests. Again, since plugins -are quite horrible about obeying proxy settings, loading a plugin pretty much -ensures a way to break the <link linkend="isolation">Network Isolation</link> -requirement and reveal a user's original IP address. Torbutton's code to -perform this workaround has been subverted at least once already by Kyle -Williams. - - </para> - </listitem> -<!-- -Actually, ECMAScript 5 handles this correctly now. - <listitem><ulink -url="https://bugzilla.mozilla.org/show_bug.cgi?id=419598%22%3EBug 419598 - 'var -Date' is deletable</ulink> - <para> - -Based on Page 62 of the <ulink -url="http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-262.pdf%22... -Javascript spec</ulink>, it seems like it should be possible to do something -like the following to prevent the Date object from being unmasked: -<screen> -with(window) { - var Date = fakeDate; - var otherVariable = 42; -} - -delete window.Date; // Should fail. Instead succeeds, revealing original Date. -delete window.otherVariable; // Fails, leaving window.otherVariable set to 42. -</screen> - -From the ECMA-262 spec: - -<blockquote> -If the variable statement occurs inside a FunctionDeclaration, the variables -are defined with function-local scope in that function, as described in -s10.1.3. Otherwise, they are defined with global scope (that is, they are -created as members of the global object, as described in 10.1.3) using -property attributes { DontDelete }. Variables are created when the execution -scope is entered. A Block does not define a new execution scope. Only Program -and FunctionDeclaration produce a new scope. Variables are initialized to -undefined when created. A variable with an Initialiser is assigned the value -of its AssignmentExpression when the VariableStatement is executed, not when -the variable is created. -</blockquote> - -In fact, this is exactly how the with statement with a variable declaration -behaves <emphasis>for all other variables other than ones that shadow system -variables</emphasis>. Some variables (such as -<command>window.screen</command>, and <command>window.history</command>) can't -even be shadowed in this way, and give an error about lacking a setter. If -such shadowing were possible, it would greatly simplify the Javascript hooking -code, which currently relies on undocumented semantics of -<command>__proto__</command> to copy the original values in the event of a -delete. This <command>__proto__</command> hack unfortunately does not work for -the Date object though. - - </para> - </listitem> ---> - </orderedlist> - </sect3> - </sect2> -</sect1> - -<sect1 id="TestPlan"> - <title>Testing</title> - <para> - -The purpose of this section is to cover all the known ways that Tor browser -security can be subverted from a penetration testing perspective. The hope -is that it will be useful both for creating a &quot;Tor Safety Check&quot; -page, and for developing novel tests and actively attacking Torbutton with the -goal of finding vulnerabilities in either it or the Mozilla components, -interfaces and settings upon which it relies. - - </para> - <sect2 id="SingleStateTesting"> - <title>Single state testing</title> - <para> - -Torbutton is a complicated piece of software. During development, changes to -one component can affect a whole slough of unrelated features. A number of -aggregated test suites exist that can be used to test for regressions in -Torbutton and to help aid in the development of Torbutton-like addons and -other privacy modifications of other browsers. Some of these test suites exist -as a single automated page, while others are a series of pages you must visit -individually. They are provided here for reference and future regression -testing, and also in the hope that some brave soul will one day decide to -combine them into a comprehensive automated test suite. - - <orderedlist> - <listitem><ulink url="http://decloak.net/">Decloak.net</ulink> - <para> - -Decloak.net is the canonical source of plugin and external-application based -proxy-bypass exploits. It is a fully automated test suite maintained by <ulink -url="http://digitaloffense.net/%22%3EHD Moore</ulink> as a service for people to -use to test their anonymity systems. - - </para> - </listitem> - <listitem><ulink url="http://deanonymizer.com/">Deanonymizer.com</ulink> - <para> - -Deanonymizer.com is another automated test suite that tests for proxy bypass -and other information disclosure vulnerabilities. It is maintained by Kyle -Williams, the author of <ulink url="http://www.janusvm.com/">JanusVM</ulink> -and <ulink url="http://www.januspa.com/">JanusPA</ulink>. - - </para> - </listitem> - <listitem><ulink url="https://www.jondos.de/en/anontest">JonDos -AnonTest</ulink> - <para> - -The <ulink url="https://www.jondos.de">JonDos people</ulink> also provide an -anonymity tester. It is more focused on HTTP headers than plugin bypass, and -points out a couple of headers Torbutton could do a better job with -obfuscating. - - </para> - </listitem> - <listitem><ulink url="http://browserspy.dk">Browserspy.dk</ulink> - <para> - -Browserspy.dk provides a tremendous collection of browser fingerprinting and -general privacy tests. Unfortunately they are only available one page at a -time, and there is not really solid feedback on good vs bad behavior in -the test results. - - </para> - </listitem> - <listitem><ulink url="http://analyze.privacy.net/">Privacy -Analyzer</ulink> - <para> - -The Privacy Analyzer provides a dump of all sorts of browser attributes and -settings that it detects, including some information on your origin IP -address. Its page layout and lack of good vs bad test result feedback makes it -not as useful as a user-facing testing tool, but it does provide some -interesting checks in a single page. - - </para> - </listitem> - <listitem><ulink url="http://ha.ckers.org/mr-t/">Mr. T</ulink> - <para> - -Mr. T is a collection of browser fingerprinting and deanonymization exploits -discovered by the <ulink url="http://ha.ckers.org">ha.ckers.org</ulink> crew -and others. It is also not as user friendly as some of the above tests, but it -is a useful collection. - - </para> - </listitem> - <listitem>Gregory Fleischer's <ulink -url="http://pseudo-flaw.net/content/tor/torbutton/%22%3ETorbutton</ulink> and -<ulink -url="http://pseudo-flaw.net/content/defcon/dc-17-demos/d.html%22%3EDefcon -17</ulink> Test Cases - <para> - -Gregory Fleischer has been hacking and testing Firefox and Torbutton privacy -issues for the past 2 years. He has an excellent collection of all his test -cases that can be used for regression testing. In his Defcon work, he -demonstrates ways to infer Firefox version based on arcane browser properties. -We are still trying to determine the best way to address some of those test -cases. - - </para> - </listitem> - <listitem><ulink url="https://torcheck.xenobite.eu/index.php">Xenobite's -TorCheck Page</ulink> - <para> - -This page checks to ensure you are using a valid Tor exit node and checks for -some basic browser properties related to privacy. It is not very fine-grained -or complete, but it is automated and could be turned into something useful -with a bit of work. - - </para> - </listitem> - </orderedlist> - </para> - </sect2> - <sect2> - <title>Multi-state testing</title> - <para> - -The tests in this section are geared towards a page that would instruct the -user to toggle their Tor state after the fetch and perform some operations: -mouseovers, stray clicks, and potentially reloads. - - </para> - <sect3> - <title>Cookies and Cache Correlation</title> - <para> -The most obvious test is to set a cookie, ask the user to toggle tor, and then -have them reload the page. The cookie should no longer be set if they are -using the default Torbutton settings. In addition, it is possible to leverage -the cache to <ulink -url="http://crypto.stanford.edu/sameorigin/safecachetest.html%22%3Estore unique -identifiers</ulink>. The default settings of Torbutton should also protect -against these from persisting across Tor Toggle. - - </para> - </sect3> - <sect3> - <title>Javascript timers and event handlers</title> - <para> - -Javascript can set timers and register event handlers in the hopes of fetching -URLs after the user has toggled Torbutton. - </para> - </sect3> - <sect3> - <title>CSS Popups and non-script Dynamic Content</title> - <para> - -Even if Javascript is disabled, CSS is still able to -<ulink url="http://www.tjkdesign.com/articles/css%20pop%20ups/">create popup-like -windows</ulink> -via the 'onmouseover' CSS attribute, which can cause arbitrary browser -activity as soon as the mouse enters into the content window. It is also -possible for meta-refresh tags to set timers long enough to make it likely -that the user has toggled Tor before fetching content. - - </para> - </sect3> - </sect2> - <sect2 id="HackTorbutton"> - <title>Active testing (aka How to Hack Torbutton)</title> - <para> - -The idea behind active testing is to discover vulnerabilities in Torbutton to -bypass proxy settings, run script in an opposite Tor state, store unique -identifiers, leak location information, or otherwise violate <link -linkend="requirements">its requirements</link>. Torbutton has ventured out -into a strange and new security landscape. It depends on Firefox mechanisms -that haven't necessarily been audited for security, certainly not for the -threat model that Torbutton seeks to address. As such, it and the interfaces -it depends upon still need a 'trial by fire' typical of new technologies. This -section of the document was written with the intention of making that period -as fast as possible. Please help us get through this period by considering -these attacks, playing with them, and reporting what you find (and potentially -submitting the test cases back to be run in the standard batch of Torbutton -tests. - - </para> - <sect3> - <title>Some suggested vectors to investigate</title> - <para> - <itemizedlist> - <listitem>Strange ways to register Javascript <ulink -url="http://en.wikipedia.org/wiki/DOM_Events%22%3Eevents</ulink> and <ulink -url="http://www.devshed.com/c/a/JavaScript/Using-Timers-in-JavaScript/%22%3Etimeo...</ulink> should -be verified to actually be ineffective after Tor has been toggled.</listitem> - <listitem>Other ways to cause Javascript to be executed after -<command>javascript.enabled</command> has been toggled off.</listitem> - <listitem>Odd ways to attempt to load plugins. Kyle Williams has had -some success with direct loads/meta-refreshes of plugin-handled URLs.</listitem> - <listitem>The Date and Timezone hooks should be verified to work with -crazy combinations of iframes, nested iframes, iframes in frames, frames in -iframes, and popups being loaded and -reloaded in rapid succession, and/or from one another. Think race conditions and deep, -parallel nesting, involving iframes from both <ulink -url="http://en.wikipedia.org/wiki/Same_origin_policy%22%3Esame-origin and -non-same-origin</ulink> domains.</listitem> - <listitem>In addition, there may be alternate ways and other -methods to query the timezone, or otherwise use some of the Date object's -methods in combination to deduce the timezone offset. Of course, the author -tried his best to cover all the methods he could foresee, but it's always good -to have another set of eyes try it out.</listitem> - <listitem>Similarly, is there any way to confuse the <link -linkend="contentpolicy">content policy</link> -mentioned above to cause it to allow certain types of page fetches? For -example, it was recently discovered that favicons are not fetched by the -content, but the chrome itself, hence the content policy did not look up the -correct window to determine the current Tor tag for the favicon fetch. Are -there other things that can do this? Popups? Bookmarklets? Active bookmarks? </listitem> - <listitem>Alternate ways to store and fetch unique identifiers. For example, <ulink -url="http://developer.mozilla.org/en/docs/DOM:Storage%22%3EDOM Storage</ulink> -caught us off guard. -It was -also discovered by <ulink url="http://pseudo-flaw.net">Gregory -Fleischer</ulink> that <ulink -url="http://pseudo-flaw.net/content/tor/torbutton/%22%3Econtent window access to -chrome</ulink> can be used to build <link linkend="fingerprinting">unique -identifiers</link>. -Are there any other -arcane or experimental ways that Firefox provides to create and store unique -identifiers? Or perhaps unique identifiers can be queried or derived from -properties of the machine/browser that Javascript has access to? How unique -can these identifiers be? - </listitem> - <listitem>Is it possible to get the browser to write some history to disk -(aside from swap) that can be retrieved later? By default, Torbutton should -write no history, cookie, or other browsing activity information to the -harddisk.</listitem> - <listitem>Do popup windows make it easier to break any of the above -behavior? Are javascript events still canceled in popups? What about recursive -popups from Javascript, data, and other funky URL types? What about CSS -popups? Are they still blocked after Tor is toggled?</listitem> - <listitem>Chrome-escalation attacks. The interaction between the -Torbutton chrome Javascript and the client content window javascript is pretty -well-defined and carefully constructed, but perhaps there is a way to smuggle -javascript back in a return value, or otherwise inject network-loaded -javascript into the chrome (and thus gain complete control of the browser). -</listitem> -</itemizedlist> - - </para> - </sect3> - </sect2> -</sect1> -</article> diff --git a/website/design/index.html.en b/website/design/index.html.en deleted file mode 100644 index 88f305d2..00000000 --- a/website/design/index.html.en +++ /dev/null @@ -1,1453 +0,0 @@ -<?xml version="1.0" encoding="UTF-8"?> -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> -<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="Torbutton Design Documentation"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">Apr 10 2011</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2666923">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span>< /dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#components">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#hookedxpcom">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2690319">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2681735">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2702019">3.1. XUL Windows and Overlays</a></span></dt><dt><span class="sect2"><a href="#id2694797">3.2. Major Chrome Observers</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2696524">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2699452">4.1. Button Click</a></span></dt><dt><span class="sect2"><a href="#id2697978">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2697015"> 4.3. Settings Update</a></span></dt><dt><span class="sect2"><a href="#preferences">4.4. Firefox preferences touched during Toggle</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2702702">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2704948">5.1. Proxy Settings</a></span></dt><dt><span class="sect2"><a href="#id2686645">5.2. Dynamic Content Settings</a></span></dt><dt><span class="sect2"><a href="#id2705261">5.3. History and Forms Settings</a></span></dt><dt><span class="sect2"><a href="#id2705577">5.4. Cache Settings</a></span></dt><dt><span class="sect2"><a href="#id2705686">5.5. Cookie and Auth Settings</a></span></dt><dt><span class="sect2"><a href="#id2705999">5.6. Startup Settings</a></span></dt><dt><span class="sect2"><a href="#id2706113">5.7. Shutdown Settings</a></span></dt><dt><span class="sect2"><a href="#id2706173">5.8. Header Settings</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant F irefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#TorBrowserBugs">6.1. Tor Browser Bugs</a></span></dt><dt><span class="sect2"><a href="#ToggleModelBugs">6.2. Toggle Model Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2707624">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2666923"></a>1. Introduction</h2></div></div></div><p> - -This document describes the goals, operation, and testing procedures of the -Torbutton Firefox extension. It is current as of Torbutton 1.3.2. - - </p><div class="sect2" title="1.1. Adversary Model"><div class="titlepage"><div><div><h3 class="title"><a id="adversary"></a>1.1. Adversary Model</h3></div></div></div><p> - -A Tor web browser adversary has a number of goals, capabilities, and attack -types that can be used to guide us towards a set of requirements for the -Torbutton extension. Let's start with the goals. - - </p><div class="sect3" title="Adversary Goals"><div class="titlepage"><div><div><h4 class="title"><a id="adversarygoals"></a>Adversary Goals</h4></div></div></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><span class="command"><strong>Bypassing proxy settings</strong></span><p>The adversary's primary goal is direct compromise and bypass of -Tor, causing the user to directly connect to an IP of the adversary's -choosing.</p></li><li class="listitem"><span class="command"><strong>Correlation of Tor vs Non-Tor Activity</strong></span><p>If direct proxy bypass is not possible, the adversary will likely -happily settle for the ability to correlate something a user did via Tor with -their non-Tor activity. This can be done with cookies, cache identifiers, -javascript events, and even CSS. Sometimes the fact that a user uses Tor may -be enough for some authorities.</p></li><li class="listitem"><span class="command"><strong>History disclosure</strong></span><p> -The adversary may also be interested in history disclosure: the ability to -query a user's history to see if they have issued certain censored search -queries, or visited censored sites. - </p></li><li class="listitem"><span class="command"><strong>Location information</strong></span><p> - -Location information such as timezone and locality can be useful for the -adversary to determine if a user is in fact originating from one of the -regions they are attempting to control, or to zero-in on the geographical -location of a particular dissident or whistleblower. - - </p></li><li class="listitem"><span class="command"><strong>Miscellaneous anonymity set reduction</strong></span><p> - -Anonymity set reduction is also useful in attempting to zero in on a -particular individual. If the dissident or whistleblower is using a rare build -of Firefox for an obscure operating system, this can be very useful -information for tracking them down, or at least <a class="link" href="#fingerprinting">tracking their activities</a>. - - </p></li><li class="listitem"><span class="command"><strong>History records and other on-disk -information</strong></span><p> -In some cases, the adversary may opt for a heavy-handed approach, such as -seizing the computers of all Tor users in an area (especially after narrowing -the field by the above two pieces of information). History records and cache -data are the primary goals here. - </p></li></ol></div></div><div class="sect3" title="Adversary Capabilities - Positioning"><div class="titlepage"><div><div><h4 class="title"><a id="adversarypositioning"></a>Adversary Capabilities - Positioning</h4></div></div></div><p> -The adversary can position themselves at a number of different locations in -order to execute their attacks. - </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><span class="command"><strong>Exit Node or Upstream Router</strong></span><p> -The adversary can run exit nodes, or alternatively, they may control routers -upstream of exit nodes. Both of these scenarios have been observed in the -wild. - </p></li><li class="listitem"><span class="command"><strong>Adservers and/or Malicious Websites</strong></span><p> -The adversary can also run websites, or more likely, they can contract out -ad space from a number of different adservers and inject content that way. For -some users, the adversary may be the adservers themselves. It is not -inconceivable that adservers may try to subvert or reduce a user's anonymity -through Tor for marketing purposes. - </p></li><li class="listitem"><span class="command"><strong>Local Network/ISP/Upstream Router</strong></span><p> -The adversary can also inject malicious content at the user's upstream router -when they have Tor disabled, in an attempt to correlate their Tor and Non-Tor -activity. - </p></li><li class="listitem"><span class="command"><strong>Physical Access</strong></span><p> -Some users face adversaries with intermittent or constant physical access. -Users in Internet cafes, for example, face such a threat. In addition, in -countries where simply using tools like Tor is illegal, users may face -confiscation of their computer equipment for excessive Tor usage or just -general suspicion. - </p></li></ol></div></div><div class="sect3" title="Adversary Capabilities - Attacks"><div class="titlepage"><div><div><h4 class="title"><a id="attacks"></a>Adversary Capabilities - Attacks</h4></div></div></div><p> - -The adversary can perform the following attacks from a number of different -positions to accomplish various aspects of their goals. It should be noted -that many of these attacks (especially those involving IP address leakage) are -often performed by accident by websites that simply have Javascript, dynamic -CSS elements, and plugins. Others are performed by adservers seeking to -correlate users' activity across different IP addresses, and still others are -performed by malicious agents on the Tor network and at national firewalls. - - </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><span class="command"><strong>Inserting Javascript</strong></span><p> -If not properly disabled, Javascript event handlers and timers -can cause the browser to perform network activity after Tor has been disabled, -thus allowing the adversary to correlate Tor and Non-Tor activity and reveal -a user's non-Tor IP address. Javascript -also allows the adversary to execute <a class="ulink" href="http://whattheinternetknowsaboutyou.com/" target="_top">history disclosure attacks</a>: -to query the history via the different attributes of 'visited' links to search -for particular Google queries, sites, or even to <a class="ulink" href="http://www.mikeonads.com/2008/07/13/using-your-browser-url-history-estimate-gender/" target="_top">profile -users based on gender and other classifications</a>. Finally, -Javascript can be used to query the user's timezone via the -<code class="function">Date()</code> object, and to reduce the anonymity set by querying -the <code class="function">navigator</code> object for operating system, CPU, locale, -and user agent information. - </p></li><li class="listitem"><span class="command"><strong>Inserting Plugins</strong></span><p> - -Plugins are abysmal at obeying the proxy settings of the browser. Every plugin -capable of performing network activity that the author has -investigated is also capable of performing network activity independent of -browser proxy settings - and often independent of its own proxy settings. -Sites that have plugin content don't even have to be malicious to obtain a -user's -Non-Tor IP (it usually leaks by itself), though <a class="ulink" href="http://decloak.net" target="_top">plenty of active -exploits</a> are possible as well. In addition, plugins can be used to store unique identifiers that are more -difficult to clear than standard cookies. -<a class="ulink" href="http://epic.org/privacy/cookies/flash.html" target="_top">Flash-based -cookies</a> fall into this category, but there are likely numerous other -examples. - - </p></li><li class="listitem"><span class="command"><strong>Inserting CSS</strong></span><p> - -CSS can also be used to correlate Tor and Non-Tor activity and reveal a user's -Non-Tor IP address, via the usage of -<a class="ulink" href="http://www.tjkdesign.com/articles/css%20pop%20ups/" target="_top">CSS -popups</a> - essentially CSS-based event handlers that fetch content via -CSS's onmouseover attribute. If these popups are allowed to perform network -activity in a different Tor state than they were loaded in, they can easily -correlate Tor and Non-Tor activity and reveal a user's IP address. In -addition, CSS can also be used without Javascript to perform <a class="ulink" href="http://ha.ckers.org/weird/CSS-history.cgi" target="_top">CSS-only history disclosure -attacks</a>. - </p></li><li class="listitem"><span class="command"><strong>Read and insert cookies</strong></span><p> - -An adversary in a position to perform MITM content alteration can inject -document content elements to both read and inject cookies for -arbitrary domains. In fact, many "SSL secured" websites are vulnerable to this -sort of <a class="ulink" href="http://seclists.org/bugtraq/2007/Aug/0070.html" target="_top">active -sidejacking</a>. - - </p></li><li class="listitem"><span class="command"><strong>Create arbitrary cached content</strong></span><p> - -Likewise, the browser cache can also be used to <a class="ulink" href="http://crypto.stanford.edu/sameorigin/safecachetest.html" target="_top">store unique -identifiers</a>. Since by default the cache has no same-origin policy, -these identifiers can be read by any domain, making them an ideal target for -adserver-class adversaries. - - </p></li><li class="listitem"><a id="fingerprinting"></a><span class="command"><strong>Fingerprint users based on browser -attributes</strong></span><p> - -There is an absurd amount of information available to websites via attributes -of the browser. This information can be used to reduce anonymity set, or even -<a class="ulink" href="http://mandark.fr/0x000000/articles/Total_Recall_On_Firefox..html" target="_top">uniquely -fingerprint individual users</a>. </p><p> -For illustration, let's perform a -back-of-the-envelope calculation on the number of anonymity sets for just the -resolution information available in the <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:window" target="_top">window</a> and -<a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:window.screen" target="_top">window.screen</a> -objects. - - - -Browser window resolution information provides something like -(1280-640)*(1024-480)=348160 different anonymity sets. Desktop resolution -information contributes about another factor of 5 (for about 5 resolutions in -typical use). In addition, the dimensions and position of the desktop taskbar -are available, which can reveal hints on OS information. This boosts the count -by a factor of 5 (for each of the major desktop taskbars - Windows, OSX, KDE -and Gnome, and None). Subtracting the browser content window -size from the browser outer window size provide yet more information. -Firefox toolbar presence gives about a factor of 8 (3 toolbars on/off give -2³=8). Interface effects such as title bar font size -and window manager settings gives a factor of about 9 (say 3 common font sizes -for the title bar and 3 common sizes for browser GUI element fonts). -Multiply this all out, and you have (1280-640)*(1024-480)*5*5*8*9 ~= -2²⁹, or a 29 bit identifier based on resolution -information alone. </p><p> - -Of course, this space is non-uniform in user density and prone to incremental -changes. The <a class="ulink" href="https://wiki.mozilla.org/Fingerprinting#Data" target="_top">Panopticlick study -done</a> by the EFF attempts to measure the actual entropy - the number of -identifying bits of information encoded in browser properties. Their result -data is definitely useful, and the metric is probably the appropriate one for -determining how identifying a particular browser property is. However, some -quirks of their study means that they do not extract as much information as -they could from display information: they only use desktop resolution (which -Torbutton reports as the window resolution) and do not attempt to infer the -size of toolbars. - -</p></li><li class="listitem"><span class="command"><strong>Remotely or locally exploit browser and/or -OS</strong></span><p> -Last, but definitely not least, the adversary can exploit either general -browser vulnerabilities, plugin vulnerabilities, or OS vulnerabilities to -install malware and surveillance software. An adversary with physical access -can perform similar actions. Regrettably, this last attack capability is -outside of Torbutton's ability to defend against, but it is worth mentioning -for completeness. - </p></li></ol></div></div></div><div class="sect2" title="1.2. Torbutton Requirements"><div class="titlepage"><div><div><h3 class="title"><a id="requirements"></a>1.2. Torbutton Requirements</h3></div></div></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3> - -Since many settings satisfy multiple requirements, this design document is -organized primarily by Torbutton components and settings. However, if you are -the type that would rather read the document from the requirements -perspective, it is in fact possible to search for each of the following -requirement phrases in the text to find the relevant features that help meet -that requirement. - -</div><p> - -From the above Adversary Model, a number of requirements become clear. - - </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a id="proxy"></a><span class="command"><strong>Proxy Obedience</strong></span><p>The browser -MUST NOT bypass Tor proxy settings for any content.</p></li><li class="listitem"><a id="state"></a><span class="command"><strong>State Separation</strong></span><p>Browser state (cookies, cache, history, 'DOM storage'), accumulated in - one Tor state MUST NOT be accessible via the network in - another Tor state.</p></li><li class="listitem"><a id="isolation"></a><span class="command"><strong>Network Isolation</strong></span><p>Pages MUST NOT perform any network activity in a Tor state different - from the state they were originally loaded in.</p><p>Note that this requirement is -being de-emphasized due to the coming shift to supporting only the Tor Browser -Bundles, which do not support a Toggle operation.</p></li><li class="listitem"><a id="undiscoverability"></a><span class="command"><strong>Tor Undiscoverability</strong></span><p>With -the advent of bridge support in Tor 0.2.0.x, there are now a class of Tor -users whose network fingerprint does not obviously betray the fact that they -are using Tor. This should extend to the browser as well - Torbutton MUST NOT -reveal its presence while Tor is disabled. -</p><p>Note that this requirement is -being de-emphasized due to the coming shift to supporting only the Tor Browser -Bundles, which do not support a Toggle operation.</p></li><li class="listitem"><a id="disk"></a><span class="command"><strong>Disk Avoidance</strong></span><p>The browser SHOULD NOT write any Tor-related state to disk, or store it - in memory beyond the duration of one Tor toggle.</p></li><li class="listitem"><a id="location"></a><span class="command"><strong>Location Neutrality</strong></span><p>The browser SHOULD NOT leak location-specific information, such as - timezone or locale via Tor.</p></li><li class="listitem"><a id="setpreservation"></a><span class="command"><strong>Anonymity Set -Preservation</strong></span><p>The browser SHOULD NOT leak any other anonymity -set reducing or fingerprinting information - (such as user agent, extension presence, and resolution information) -automatically via Tor. The assessment of the attacks above should make it clear -that anonymity set reduction is a very powerful method of tracking and -eventually identifying anonymous users. -</p></li><li class="listitem"><a id="updates"></a><span class="command"><strong>Update Safety</strong></span><p>The browser -SHOULD NOT perform unauthenticated updates or upgrades via Tor.</p></li><li class="listitem"><a id="interoperate"></a><span class="command"><strong>Interoperability</strong></span><p>Torbutton SHOULD interoperate with third-party proxy switchers that - enable the user to switch between a number of different proxies. It MUST - provide full Tor protection in the event a third-party proxy switcher has - enabled the Tor proxy settings.</p></li></ol></div></div><div class="sect2" title="1.3. Extension Layout"><div class="titlepage"><div><div><h3 class="title"><a id="layout"></a>1.3. Extension Layout</h3></div></div></div><p>Firefox extensions consist of two main categories of code: 'Components' and -'Chrome'. Components are a fancy name for classes that implement a given -interface or interfaces. In Firefox, components <a class="ulink" href="https://developer.mozilla.org/en/XPCOM" target="_top">can be -written</a> in C++, -Javascript, or a mixture of both. Components have two identifiers: their -'<a class="ulink" href="http://www.mozilla.org/projects/xpcom/book/cxc/html/quicktour2.html#1005005" target="_top">Contract -ID</a>' (a human readable path-like string), and their '<a class="ulink" href="http://www.mozilla.org/projects/xpcom/book/cxc/html/quicktour2.html#1005329" target="_top">Class -ID</a>' (a GUID hex-string). In addition, the interfaces they implement each have a hex -'Interface ID'. It is possible to 'hook' system components - to reimplement -their interface members with your own wrappers - but only if the rest of the -browser refers to the component by its Contract ID. If the browser refers to -the component by Class ID, it bypasses your hooks in that use case. -Technically, it may be possible to hook Class IDs by unregistering the -original component, and then re-registering your own, but this relies on -obsolete and deprecated interfaces and has proved to be less than -stable.</p><p>'Chrome' is a combination of XML and Javascript used to describe a window. -Extensions are allowed to create 'overlays' that are 'bound' to existing XML -window definitions, or they can create their own windows. The DTD for this XML -is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" title="2. Components"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="components"></a>2. Components</h2></div></div></div><p> - -Torbutton installs components for two purposes: hooking existing components to -reimplement their interfaces; and creating new components that provide -services to other pieces of the extension. - - </p><div class="sect2" title="2.1. Hooked Components"><div class="titlepage"><div><div><h3 class="title"><a id="hookedxpcom"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some -of its own standalone components as well. Let's discuss the hooked components -first.</p><div class="sect3" title="@mozilla.org/uriloader/external-protocol-service;1 , @mozilla.org/uriloader/external-helper-app-service;1, and @mozilla.org/mime;1 - components/external-app-blocker.js"><div class="titlepage"><div><div><h4 class="title"><a id="appblocker"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/uriloader/external-protocol-service%3B1" target="_top">@mozilla.org/uriloader/external-protocol-service;1 -</a>, <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/uriloader/external-helper-app-service%3B1" target="_top">@mozilla.org/uriloader/external-helper-app-service;1</a>, -and <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/mime%3B1" target="_top">@mozilla.org/mime;1</a> -- <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/external-app-blocker.js" target="_top">components/external-app-blocker.js</a></h4></div></div></div><p> -Due to <a class="link" href="#FirefoxBugs" title="6. Relevant Firefox Bugs">Firefox Bug</a> <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=440892" target="_top">440892</a> allowing Firefox 3.x to automatically launch some -applications without user intervention, Torbutton had to wrap the three -components involved in launching external applications to provide user -confirmation before doing so while Tor is enabled. Since external applications -do not obey proxy settings, they can be manipulated to automatically connect -back to arbitrary servers outside of Tor with no user intervention. Fixing -this issue helps to satisfy Torbutton's <a class="link" href="#proxy">Proxy -Obedience</a> Requirement. - </p></div><div class="sect3" title="@mozilla.org/browser/global-history;2 - components/ignore-history.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2696239"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/global-history;2" target="_top">@mozilla.org/browser/global-history;2</a> -- <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/ignore-history.js" target="_top">components/ignore-history.js</a></h4></div></div></div><p>This component was contributed by <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin Jackson</a> as a method for defeating -CSS and Javascript-based methods of history disclosure. The global-history -component is what is used by Firefox to determine if a link was visited or not -(to apply the appropriate style to the link). By hooking the <a class="ulink" href="https://developer.mozilla.org/en/nsIGlobalHistory2#isVisited.28.29" target="_top">isVisited</a> -and <a class="ulink" href="https://developer.mozilla.org/en/nsIGlobalHistory2#addURI.28.29" target="_top">addURI</a> -methods, Torbutton is able to selectively prevent history items from being -added or being displayed as visited, depending on the Tor state and the user's -preferences. -</p><p> -This component helps satisfy the <a class="link" href="#state">State Separation</a> -and <a class="link" href="#disk">Disk Avoidance</a> requirements of Torbutton. It -is only needed for Firefox 3.x. On Firefox 4, we omit this component in favor -of the <a class="ulink" href="https://developer.mozilla.org/en/CSS/Privacy_and_the_%3avisited_selector" target="_top">built-in -history protections</a>. -</p></div><div class="sect3" title="@mozilla.org/browser/livemark-service;2 - components/block-livemarks.js"><div class="titlepage"><div><div><h4 class="title"><a id="livemarks"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/livemark-service;2" target="_top">@mozilla.org/browser/livemark-service;2</a> -- <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/block-livemarks.js" target="_top">components/block-livemarks.js</a></h4></div></div></div><p> - -The <a class="ulink" href="http://www.mozilla.com/en-US/firefox/livebookmarks.html" target="_top">livemark</a> service -is started by a timer that runs 5 seconds after Firefox -startup. As a result, we cannot simply call the stopUpdateLivemarks() method to -disable it. We must wrap the component to prevent this start() call from -firing in the event the browser starts in Tor mode. - -</p><p> -This component helps satisfy the <a class="link" href="#isolation">Network -Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set -Preservation</a> requirements. -</p></div></div><div class="sect2" title="2.2. New Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2690319"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the -extension. These components do not hook any interfaces, nor are they used -anywhere besides Torbutton itself.</p><div class="sect3" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js"><div class="titlepage"><div><div><h4 class="title"><a id="cookiejar"></a><a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/cookie-jar-selector.js" target="_top">@torproject.org/cookie-jar-selector;2 -- components/cookie-jar-selector.js</a></h4></div></div></div><p>The cookie jar selector (also based on code from <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin -Jackson</a>) is used by the Torbutton chrome to switch between -Tor and Non-Tor cookies. It stores an XML representation of the current -cookie state in memory and/or on disk. When Tor is toggled, it syncs the -current cookies to this XML store, and then loads the cookies for the other -state from the XML store. -</p><p> -This component helps to address the <a class="link" href="#state">State -Isolation</a> requirement of Torbutton. -</p></div><div class="sect3" title="@torproject.org/torbutton-logger;1 - components/torbutton-logger.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2683534"></a><a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/torbutton-logger.js" target="_top">@torproject.org/torbutton-logger;1 -- components/torbutton-logger.js</a></h4></div></div></div><p>The torbutton logger component allows on-the-fly redirection of torbutton -logging messages to either Firefox stderr -(<span class="command"><strong>extensions.torbutton.logmethod=0</strong></span>), the Javascript error console -(<span class="command"><strong>extensions.torbutton.logmethod=1</strong></span>), or the DebugLogger extension (if -available - <span class="command"><strong>extensions.torbutton.logmethod=2</strong></span>). It also allows you to -change the loglevel on the fly by changing -<span class="command"><strong>extensions.torbutton.loglevel</strong></span> (1-5, 1 is most verbose). -</p></div><div class="sect3" title="@torproject.org/content-window-mapper;1 - components/window-mapper.js"><div class="titlepage"><div><div><h4 class="title"><a id="windowmapper"></a><a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/window-mapper.js" target="_top">@torproject.org/content-window-mapper;1 -- components/window-mapper.js</a></h4></div></div></div><p>Torbutton tags Firefox <a class="ulink" href="https://developer.mozilla.org/en/XUL_Tutorial/Tabboxes" target="_top">tabs</a> with a special variable that indicates the Tor -state the tab was most recently used under to fetch a page. The problem is -that for many Firefox events, it is not possible to determine the tab that is -actually receiving the event. The Torbutton window mapper allows the Torbutton -chrome and other components to look up a <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser" target="_top">browser -tab</a> for a given <a class="ulink" href="https://developer.mozilla.org/en/nsIDOMWindow" target="_top">HTML content -window</a>. It does this by traversing all windows and all browsers, until it -finds the browser with the requested <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser#p-contentWindow" target="_top">contentWindow</a> element. Since the content policy -and page loading in general can generate hundreds of these lookups, this -result is cached inside the component. -</p></div><div class="sect3" title="@torproject.org/crash-observer;1"><div class="titlepage"><div><div><h4 class="title"><a id="crashobserver"></a><a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/crash-observer.js" target="_top">@torproject.org/crash-observer;1</a></h4></div></div></div><p> - -This component detects when Firefox crashes by altering Firefox prefs during -runtime and checking for the same values at startup. It <a class="ulink" href="https://developer.mozilla.org/en/XPCOM_Interface_Reference/nsIPrefService#savePrefFile()" target="_top">synchronizes -the preference service</a> to ensure the altered prefs are written to disk -immediately. - - </p></div><div class="sect3" title="@torproject.org/torbutton-ss-blocker;1"><div class="titlepage"><div><div><h4 class="title"><a id="tbsessionstore"></a><a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/tbSessionStore.js" target="_top">@torproject.org/torbutton-ss-blocker;1</a></h4></div></div></div><p> - -This component subscribes to the Firefox <a class="ulink" href="https://developer.mozilla.org/en/Observer_Notifications#Session_Store" target="_top">sessionstore-state-write</a> -observer event to filter out URLs from tabs loaded during Tor, to prevent them -from being written to disk. To do this, it checks the -<span class="command"><strong>__tb_tor_fetched</strong></span> tag of tab objects before writing them out. If -the tag is from a blocked Tor state, the tab is not written to disk. This is -a rather expensive operation that involves potentially very large JSON -evaluations and object tree traversals, but it preferable to replacing the -Firefox session store with our own implementation, which is what was done in -years past. - - </p></div><div class="sect3" title="@torproject.org/torRefSpoofer;1"><div class="titlepage"><div><div><h4 class="title"><a id="refspoofer"></a><a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/torRefSpoofer.js" target="_top">@torproject.org/torRefSpoofer;1</a></h4></div></div></div><p> -This component handles optional referer spoofing for Torbutton. It implements a -form of "smart" referer spoofing using <a class="ulink" href="https://developer.mozilla.org/en/Setting_HTTP_request_headers" target="_top">http-on-modify-request</a> -to modify the Referer header. The code sends the default browser referer -header only if the destination domain is a suffix of the source, or if the -source is a suffix of the destination. Otherwise, it sends no referer. This -strange suffix logic is used as a heuristic: some rare sites on the web block -requests without proper referer headers, and this logic is an attempt to cater -to them. Unfortunately, it may not be enough. For example, google.fr will not -send a referer to google.com using this logic. Hence, it is off by default. - </p></div><div class="sect3" title="@torproject.org/cssblocker;1 - components/cssblocker.js"><div class="titlepage"><div><div><h4 class="title"><a id="contentpolicy"></a><a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/cssblocker.js" target="_top">@torproject.org/cssblocker;1 -- components/cssblocker.js</a></h4></div></div></div><p>This is a key component to Torbutton's security measures. When Tor is -toggled, Javascript is disabled, and pages are instructed to stop loading. -However, CSS is still able to perform network operations by loading styles for -onmouseover events and other operations. In addition, favicons can still be -loaded by the browser. The cssblocker component prevents this by implementing -and registering an <a class="ulink" href="https://developer.mozilla.org/en/nsIContentPolicy" target="_top">nsIContentPolicy</a>. -When an nsIContentPolicy is registered, Firefox checks every attempted network -request against its <a class="ulink" href="https://developer.mozilla.org/en/nsIContentPolicy#shouldLoad()" target="_top">shouldLoad</a> -member function to determine if the load should proceed. In Torbutton's case, -the content policy looks up the appropriate browser tab using the <a class="link" href="#windowmapper" title="@torproject.org/content-window-mapper;1 - components/window-mapper.js">window mapper</a>, -and checks that tab's load tag against the current Tor state. If the tab was -loaded in a different state than the current state, the fetch is denied. -Otherwise, it is allowed.</p> This helps to achieve the <a class="link" href="#isolation">Network -Isolation</a> requirements of Torbutton. - -<p>In addition, the content policy also blocks website javascript from -<a class="ulink" href="http://webdevwonders.com/detecting-firefox-add-ons/" target="_top">querying for -versions and existence of extension chrome</a> while Tor is enabled, and -also masks the presence of Torbutton to website javascript while Tor is -disabled. </p><p> - -Finally, some of the work that logically belongs to the content policy is -instead handled by the <span class="command"><strong>torbutton_http_observer</strong></span> and -<span class="command"><strong>torbutton_weblistener</strong></span> in <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/torbutton.js" target="_top">torbutton.js</a>. These two objects handle blocking of -Firefox 3 favicon loads, popups, and full page plugins, which for whatever -reason are not passed to the Firefox content policy itself (see Firefox Bugs -<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=437014" target="_top">437014</a> and -<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296" target="_top">401296</a>). - -</p><p> - -This helps to fulfill both the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirements of -Torbutton.</p></div></div></div><div class="sect1" title="3. Chrome"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2681735"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are -located. </p><div class="sect2" title="3.1. XUL Windows and Overlays"><div class="titlepage"><div><div><h3 class="title"><a id="id2702019"></a>3.1. XUL Windows and Overlays</h3></div></div></div><p> -Each window is described as an <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XML file</a>, with zero or more Javascript -files attached. The scope of these Javascript files is their containing -window. XUL files that add new elements and script to existing Firefox windows -are called overlays.</p><div class="sect3" title="Browser Overlay - torbutton.xul"><div class="titlepage"><div><div><h4 class="title"><a id="browseroverlay"></a>Browser Overlay - <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/torbutton.xul" target="_top">torbutton.xul</a></h4></div></div></div><p>The browser overlay, torbutton.xul, defines the toolbar button, the status -bar, and events for toggling the button. The overlay code is in <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/torbutton.js" target="_top">chrome/content/torbutton.js</a>. -It contains event handlers for preference update, shutdown, upgrade, and -location change events.</p></div><div class="sect3" title="Preferences Window - preferences.xul"><div class="titlepage"><div><div><h4 class="title"><a id="id2704559"></a>Preferences Window - <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/preferences.xul" target="_top">preferences.xul</a></h4></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with -handlers located in <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/preferences.js" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect3" title="Other Windows"><div class="titlepage"><div><div><h4 class="title"><a id="id2669673"></a>Other Windows</h4></div></div></div><p>There are additional windows that describe popups for right clicking on -the status bar, the toolbutton, and the about page.</p></div></div><div class="sect2" title="3.2. Major Chrome Observers"><div class="titlepage"><div><div><h3 class="title"><a id="id2694797"></a>3.2. Major Chrome Observers</h3></div></div></div><p> -In addition to the <a class="link" href="#components" title="2. Components">components described -above</a>, Torbutton also instantiates several observers in the browser -overlay window. These mostly grew due to scoping convenience, and many should -probably be relocated into their own components. - </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><span class="command"><strong>torbutton_window_pref_observer</strong></span><p> -This is an observer that listens for Torbutton state changes, for the purposes -of updating the Torbutton button graphic as the Tor state changes. - </p></li><li class="listitem"><span class="command"><strong>torbutton_unique_pref_observer</strong></span><p> - -This is an observer that only runs in one window, called the main window. It -listens for changes to all of the Torbutton preferences, as well as Torbutton -controlled Firefox preferences. It is what carries out the toggle path when -the proxy settings change. When the main window is closed, the -torbutton_close_window event handler runs to dub a new window the "main -window". - - </p></li><li class="listitem"><span class="command"><strong>tbHistoryListener</strong></span><p> -The tbHistoryListener exists to prevent client window Javascript from -interacting with window.history to forcibly navigate a user to a tab session -history entry from a different Tor state. It also expunges the window.history -entries during toggle. This listener helps Torbutton -satisfy the <a class="link" href="#isolation">Network Isolation</a> requirement as -well as the <a class="link" href="#state">State Separation</a> requirement. - - </p></li><li class="listitem"><span class="command"><strong>torbutton_http_observer</strong></span><p> - -The torbutton_http_observer performs some of the work that logically belongs -to the content policy. This handles blocking of -Firefox 3 favicon loads, which for whatever -reason are not passed to the Firefox content policy itself (see Firefox Bugs -<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=437014" target="_top">437014</a> and -<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296" target="_top">401296</a>). - - </p><p> -The observer is also responsible for redirecting users to alternate -search engines when Google presents them with a Captcha, as well as copying -Google Captcha-related cookies between international Google domains. - </p></li><li class="listitem"><span class="command"><strong>torbutton_proxyservice</strong></span><p> -The Torbutton proxy service handles redirecting Torbutton-related update -checks on addons.mozilla.org through Tor. This is done to help satisfy the -<a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirement. - </p></li><li class="listitem"><span class="command"><strong>torbutton_weblistener</strong></span><p>The <a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgressListener#onLocationChange" target="_top">location -change</a> <a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgress" target="_top">webprogress -listener</a>, <span class="command"><strong>torbutton_weblistener</strong></span> is one of the most -important parts of the chrome from a security standpoint. It is a <a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgressListener" target="_top">webprogress -listener</a> that handles receiving an event every time a page load or -iframe load occurs. This class eventually calls down to -<code class="function">torbutton_update_tags()</code> and -<code class="function">torbutton_hookdoc()</code>, which apply the browser Tor load -state tags, plugin permissions, and install the Javascript hooks to hook the -<a class="ulink" href="https://developer.mozilla.org/en/DOM/window.screen" target="_top">window.screen</a> -object to obfuscate browser and desktop resolution information. - -</p></li></ol></div></div></div><div class="sect1" title="4. Toggle Code Path"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2696524"></a>4. Toggle Code Path</h2></div></div></div><p> - -The act of toggling is connected to <code class="function">torbutton_toggle()</code> -via the <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/torbutton.xul" target="_top">torbutton.xul</a> -and <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/popup.xul" target="_top">popup.xul</a> -overlay files. Most of the work in the toggling process is present in <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/torbutton.js" target="_top">torbutton.js</a> - -</p><p> - -Toggling is a 3 stage process: Button Click, Proxy Update, and -Settings Update. These stages are reflected in the prefs -<span class="command"><strong>extensions.torbutton.tor_enabled</strong></span>, -<span class="command"><strong>extensions.torbutton.proxies_applied</strong></span>, and -<span class="command"><strong>extensions.torbutton.settings_applied</strong></span>. The reason for the -three stage preference update is to ensure immediate enforcement of <a class="link" href="#isolation">Network Isolation</a> via the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>. Since the content window -javascript runs on a different thread than the chrome javascript, it is -important to properly convey the stages to the content policy to avoid race -conditions and leakage, especially with <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737" target="_top">Firefox Bug -409737</a> unfixed. The content policy does not allow any network activity -whatsoever during this three stage transition. - - </p><div class="sect2" title="4.1. Button Click"><div class="titlepage"><div><div><h3 class="title"><a id="id2699452"></a>4.1. Button Click</h3></div></div></div><p> - -This is the first step in the toggling process. When the user clicks the -toggle button or the toolbar, <code class="function">torbutton_toggle()</code> is -called. This function checks the current Tor status by comparing the current -proxy settings to the selected Tor settings, and then sets the proxy settings -to the opposite state, and sets the pref -<span class="command"><strong>extensions.torbutton.tor_enabled</strong></span> to reflect the new state. -It is this proxy pref update that gives notification via the <a class="ulink" href="https://developer.mozilla.org/en/NsIPrefBranch2#addObserver.28.29" target="_top">pref -observer</a> -<span class="command"><strong>torbutton_unique_pref_observer</strong></span> to perform the rest of the -toggle. - - </p></div><div class="sect2" title="4.2. Proxy Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2697978"></a>4.2. Proxy Update</h3></div></div></div><p> - -When Torbutton receives any proxy change notifications via its -<span class="command"><strong>torbutton_unique_pref_observer</strong></span>, it calls -<code class="function">torbutton_set_status()</code> which checks against the Tor -settings to see if the Tor proxy settings match the current settings. If so, -it calls <code class="function">torbutton_update_status()</code>, which determines if -the Tor state has actually changed, and sets -<span class="command"><strong>extensions.torbutton.proxies_applied</strong></span> to the appropriate Tor -state value, and ensures that -<span class="command"><strong>extensions.torbutton.tor_enabled</strong></span> is also set to the correct -value. This is decoupled from the button click functionality via the pref -observer so that other addons (such as SwitchProxy) can switch the proxy -settings between multiple proxies. - - </p></div><div class="sect2" title="4.3. Settings Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2697015"></a>4.3. Settings Update</h3></div></div></div><p> - -The next stage is also handled by -<code class="function">torbutton_update_status()</code>. This function sets scores of -Firefox preferences, saving the original values to prefs under -<span class="command"><strong>extensions.torbutton.saved.*</strong></span>, and performs the <a class="link" href="#cookiejar" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js">cookie jarring</a>, state clearing (such as window.name -and DOM storage), and <a class="link" href="#preferences" title="4.4. Firefox preferences touched during Toggle">preference -toggling</a>. At the -end of its work, it sets -<span class="command"><strong>extensions.torbutton.settings_applied</strong></span>, which signifies the -completion of the toggle operation to the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>. - - </p></div><div class="sect2" title="4.4. Firefox preferences touched during Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="preferences"></a>4.4. Firefox preferences touched during Toggle</h3></div></div></div><p> -There are also a number of Firefox preferences set in -<code class="function">torbutton_update_status()</code> that aren't governed by any -Torbutton setting. These are: -</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Network.security.ports.banned" target="_top">network.security.ports.banned</a><p> -Torbutton sets this setting to add ports 8123, 8118, 9050 and 9051 (which it -reads from <span class="command"><strong>extensions.torbutton.banned_ports</strong></span>) to the list -of ports Firefox is forbidden to access. These ports are Polipo, Privoxy, Tor, -and the Tor control port, respectively. This is set for both Tor and Non-Tor -usage, and prevents websites from attempting to do http fetches from these -ports to see if they are open, which addresses the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirement. - </p></li><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Browser.send_pings" target="_top">browser.send_pings</a><p> -This setting is currently always disabled. If anyone ever complains saying -that they *want* their browser to be able to send ping notifications to a -page or arbitrary link, I'll make this a pref or Tor-only. But I'm not holding -my breath. I haven't checked if the content policy is called for pings, but if -not, this setting helps with meeting the <a class="link" href="#isolation">Network -Isolation</a> requirement. - </p></li><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Browser.safebrowsing.remoteLookups" target="_top">browser.safebrowsing.remoteLookups</a><p> -Likewise for this setting. I find it hard to imagine anyone who wants to ask -Google in real time if each URL they visit is safe, especially when the list -of unsafe URLs is downloaded anyway. This helps fulfill the <a class="link" href="#disk">Disk Avoidance</a> requirement, by preventing your entire -browsing history from ending up on Google's disks. - </p></li><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Browser.safebrowsing.enabled" target="_top">browser.safebrowsing.enabled</a><p> -Safebrowsing does <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=360387" target="_top">unauthenticated -updates under Firefox 2</a>, so it is disabled during Tor usage. -This helps fulfill the <a class="link" href="#updates">Update -Safety</a> requirement. Firefox 3 has the fix for that bug, and so -safebrowsing updates are enabled during Tor usage. - </p></li><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Network.protocol-handler.warn-external.%28protocol%29" target="_top">network.protocol-handler.warn-external.(protocol)</a><p> -If Tor is enabled, we need to prevent random external applications from -launching without at least warning the user. This group of settings only -partially accomplishes this, however. Applications can still be launched via -plugins. The mechanisms for handling this are described under the "Disable -Plugins During Tor Usage" preference. This helps fulfill the <a class="link" href="#proxy">Proxy Obedience</a> requirement, by preventing external -applications from accessing network resources at the command of Tor-fetched -pages. Unfortunately, due to <a class="link" href="#FirefoxBugs" title="6. Relevant Firefox Bugs">Firefox Bug</a> -<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=440892" target="_top">440892</a>, -these prefs are no longer obeyed. They are set still anyway out of respect for -the dead. - </p></li><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Browser.sessionstore.max_tabs_undo" target="_top">browser.sessionstore.max_tabs_undo</a><p> - -To help satisfy the Torbutton <a class="link" href="#state">State Separation</a> -and <a class="link" href="#isolation">Network Isolation</a> requirements, -Torbutton needs to purge the Undo Tab history on toggle to prevent repeat -"Undo Close" operations from accidentally restoring tabs from a different Tor -State. This purge is accomplished by setting this preference to 0 and then -restoring it to the previous user value upon toggle. - - </p></li><li class="listitem"><span class="command"><strong>security.enable_ssl2</strong></span> or <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/interfaces/nsIDOMCrypto" target="_top">nsIDOMCrypto::logout()</a><p> -TLS Session IDs can persist for an indefinite duration, providing an -identifier that is sent to TLS sites that can be used to link activity. This -is particularly troublesome now that we have certificate verification in place -in Firefox 3: The OCSP server can use this Session ID to build a history of -TLS sites someone visits, and also correlate their activity as users move from -network to network (such as home to work to coffee shop, etc), inside and -outside of Tor. To handle this and to help satisfy our <a class="link" href="#state">State Separation Requirement</a>, we call the logout() -function of nsIDOMCrypto. Since this may be absent, or may fail, we fall back -to toggling -<span class="command"><strong>security.enable_ssl2</strong></span>, which clears the SSL Session ID -cache via the pref observer at <a class="ulink" href="http://mxr.mozilla.org/security/source/security/manager/ssl/src/nsNSSComponent.cpp" target="_top">nsNSSComponent.cpp</a>. - </p></li><li class="listitem"><span class="command"><strong>security.OCSP.enabled</strong></span><p> -Similarly, we toggle <span class="command"><strong>security.OCSP.enabled</strong></span>, which clears the OCSP certificate -validation cache via the pref observer at <a class="ulink" href="http://mxr.mozilla.org/security/source/security/manager/ssl/src/nsNSSComponent.cpp" target="_top">nsNSSComponent.cpp</a>. -In this way, exit nodes will not be able to fingerprint you -based the fact that non-Tor OCSP lookups were obviously previously cached. -To handle this and to help satisfy our <a class="link" href="#state">State Separation Requirement</a>, - </p></li><li class="listitem"><span class="command"><strong><a class="ulink" href="http://kb.mozillazine.org/Updating_extensions#Disabling_update_checks_for_individual_add-ons_-_Advanced_users" target="_top">extensions.e0204bd5-9d31-402b-a99d-a6aa8ffebdca.getAddons.cache.enabled</a></strong></span><p> -We permanently disable addon usage statistic reporting to the -addons.mozilla.org statistics engine. These statistics send version -information about Torbutton users via non-Tor, allowing their Tor use to be -uncovered. Disabling this reporting helps Torbutton to satisfy its <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirement. - - </p></li><li class="listitem"><span class="command"><strong><a class="ulink" href="http://www.mozilla.com/en-US/firefox/geolocation/" target="_top">geo.enabled</a></strong></span><p> - -Torbutton disables Geolocation support in Firefox 3.5 and above whenever tor -is enabled. This helps Torbutton maintain its -<a class="link" href="#location">Location Neutrality</a> requirement. -While Firefox does prompt before divulging geolocational information, -the assumption is that Tor users will never want to give their -location away during Tor usage, and even allowing websites to prompt -them to do so will only cause confusion and accidents to happen. Moreover, -just because users may approve a site to know their location in non-Tor mode -does not mean they want it divulged during Tor mode. - - </p></li><li class="listitem"><span class="command"><strong><a class="ulink" href="http://kb.mozillazine.org/Browser.zoom.siteSpecific" target="_top">browser.zoom.siteSpecific</a></strong></span><p> - -Firefox actually remembers your zoom settings for certain sites. CSS -and Javascript rule can use this to recognize previous visitors to a site. -This helps Torbutton fulfill its <a class="link" href="#state">State Separation</a> -requirement. - - </p></li><li class="listitem"><span class="command"><strong><a class="ulink" href="https://developer.mozilla.org/en/controlling_dns_prefetching" target="_top">network.dns.disablePrefetch</a></strong></span><p> - -Firefox 3.5 and above implement prefetching of DNS resolution for hostnames in -links on a page to decrease page load latency. While Firefox does typically -disable this behavior when proxies are enabled, we set this pref for added -safety during Tor usage. Additionally, to prevent Tor-loaded tabs from having -their links prefetched after a toggle to Non-Tor mode occurs, -we also set the docShell attribute -<a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsIDocShell" target="_top"> -allowDNSPrefetch</a> to false on Tor loaded tabs. This happens in the same -positions in the code as those for disabling plugins via the allowPlugins -docShell attribute. This helps Torbutton fulfill its <a class="link" href="#isolation">Network Isolation</a> requirement. - - </p></li><li class="listitem"><span class="command"><strong><a class="ulink" href="http://kb.mozillazine.org/Browser.cache.offline.enable" target="_top">browser.cache.offline.enable</a></strong></span><p> - -Firefox has the ability to store web applications in a special cache to allow -them to continue to operate while the user is offline. Since this subsystem -is actually different than the normal disk cache, it must be dealt with -separately. Thus, Torbutton sets this preference to false whenever Tor is -enabled. This helps Torbutton fulfill its <a class="link" href="#disk">Disk -Avoidance</a> and <a class="link" href="#state">State Separation</a> -requirements. - - </p></li></ol></div></div></div><div class="sect1" title="5. Description of Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2702702"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each -option is presented as the string from the preferences window, a summary, the -preferences it touches, and the effect this has on the components, chrome, and -browser properties.</p><div class="sect2" title="5.1. Proxy Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2704948"></a>5.1. Proxy Settings</h3></div></div></div><div class="sect3" title="Test Settings"><div class="titlepage"><div><div><h4 class="title"><a id="id2683681"></a>Test Settings</h4></div></div></div><p> -This button under the Proxy Settings tab provides a way to verify that the -proxy settings are correct, and actually do route through the Tor network. It -performs this check by issuing an <a class="ulink" href="http://developer.mozilla.org/en/docs/XMLHttpRequest" target="_top">XMLHTTPRequest</a> -for <a class="ulink" href="https://check.torproject.org/?TorButton=True" target="_top">https://check.torproject.org/?Torbutton=True</a>. -This is a special page that returns very simple, yet well-formed XHTML that -Torbutton can easily inspect for a hidden link with an id of -<span class="command"><strong>TorCheckResult</strong></span> and a target of <span class="command"><strong>success</strong></span> -or <span class="command"><strong>failure</strong></span> to indicate if the -user hit the page from a Tor IP, a non-Tor IP. This check is handled in -<code class="function">torbutton_test_settings()</code> in <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/torbutton.js" target="_top">torbutton.js</a>. -Presenting the results to the user is handled by the <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/preferences.xul" target="_top">preferences -window</a> -callback <code class="function">torbutton_prefs_test_settings()</code> in <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/preferences.js" target="_top">preferences.js</a>. - - </p></div></div><div class="sect2" title="5.2. Dynamic Content Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2686645"></a>5.2. Dynamic Content Settings</h3></div></div></div><div class="sect3" title="Disable plugins on Tor Usage (crucial)"><div class="titlepage"><div><div><h4 class="title"><a id="plugins"></a>Disable plugins on Tor Usage (crucial)</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_tor_plugins</strong></span></p><p>Java and plugins <a class="ulink" href="http://java.sun.com/j2se/1.5.0/docs/api/java/net/class-use/NetworkInterface.html" target="_top">can query</a> the <a class="ulink" href="http://www.rgagnon.com/javadetails/java-0095.html" target="_top">local IP -address</a> and report it back to the -remote site. They can also <a class="ulink" href="http://decloak.net" target="_top">bypass proxy settings</a> and directly connect to a -remote site without Tor. Every browser plugin we have tested with Firefox has -some form of network capability, and every one ignores proxy settings or worse - only -partially obeys them. This includes but is not limited to: -QuickTime, Windows Media Player, RealPlayer, mplayerplug-in, AcroRead, and -Flash. - - </p><p> -Enabling this preference causes the above mentioned Torbutton chrome web progress - listener <span class="command"><strong>torbutton_weblistener</strong></span> to disable Java via <span class="command"><strong>security.enable_java</strong></span> and to disable - plugins via the browser <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3adocShell" target="_top">docShell</a> - attribute <span class="command"><strong>allowPlugins</strong></span>. These flags are set every time a new window is - created (<code class="function">torbutton_tag_new_browser()</code>), every time a web -load -event occurs - (<code class="function">torbutton_update_tags()</code>), and every time the tor state is changed - (<code class="function">torbutton_update_status()</code>). As a backup measure, plugins are also - prevented from loading by the content policy in <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/cssblocker.js" target="_top">@torproject.org/cssblocker;1</a> if Tor is - enabled and this option is set. - </p><p>All of this turns out to be insufficient if the user directly clicks -on a plugin-handled mime-type. <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296" target="_top">In this case</a>, -the browser decides that maybe it should ignore all these other settings and -load the plugin anyways, because maybe the user really did want to load it -(never mind this same load-style could happen automatically with meta-refresh -or any number of other ways..). To handle these cases, Torbutton stores a list -of plugin-handled mime-types, and sets the pref -<span class="command"><strong>plugin.disable_full_page_plugin_for_types</strong></span> to this list. -Additionally, (since nothing can be assumed when relying on Firefox -preferences and internals) if it detects a load of one of them from the web -progress listener, it cancels the request, tells the associated DOMWindow to -stop loading, clears the document, AND throws an exception. Anything short of -all this and the plugin managed to find some way to load. - </p><p> - All this could be avoided, of course, if Firefox would either <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296" target="_top">obey - allowPlugins</a> for directly visited URLs, or notify its content policy for such - loads either <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=309524" target="_top">via</a> <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=380556" target="_top">shouldProcess</a> or shouldLoad. The fact that it does not is - not very encouraging. - </p><p> - -Since most plugins completely ignore browser proxy settings, the actions -performed by this setting are crucial to satisfying the <a class="link" href="#proxy">Proxy Obedience</a> requirement. - - </p></div><div class="sect3" title="Isolate Dynamic Content to Tor State (crucial)"><div class="titlepage"><div><div><h4 class="title"><a id="id2688604"></a>Isolate Dynamic Content to Tor State (crucial)</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/cssblocker.js" target="_top">@torproject.org/cssblocker;1</a> content policy -mentioned above, and causes it to block content load attempts in pages an -opposite Tor state from the current state. Freshly loaded <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser" target="_top">browser -tabs</a> are tagged -with a <span class="command"><strong>__tb_load_state</strong></span> member in -<code class="function">torbutton_update_tags()</code> and this -value is compared against the current tor state in the content policy.</p><p>It also kills all Javascript in each page loaded under that state by -toggling the <span class="command"><strong>allowJavascript</strong></span> <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3adocShell" target="_top">docShell</a> property, and issues a -<a class="ulink" href="https://developer.mozilla.org/en/XPCOM_Interface_Reference/nsIWebNavigation#stop()" target="_top">webNavigation.stop(webNavigation.STOP_ALL)</a> to each browser tab (the -equivalent of hitting the STOP button).</p><p> - -Unfortunately, <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737" target="_top">Firefox bug -409737</a> prevents <span class="command"><strong>docShell.allowJavascript</strong></span> from killing -all event handlers, and event handlers registered with <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:element.addEventListener" target="_top">addEventListener()</a> -are still able to execute. The <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">Torbutton Content -Policy</a> should prevent such code from performing network activity within -the current tab, but activity that happens via a popup window or via a -Javascript redirect can still slip by. For this reason, Torbutton blocks -popups by checking for a valid <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:window.opener" target="_top">window.opener</a> -attribute in <code class="function">torbutton_check_progress()</code>. If the window -has an opener from a different Tor state, its load is blocked. The content -policy also takes similar action to prevent Javascript redirects. This also -has the side effect/feature of preventing the user from following any links -from a page loaded in an opposite Tor state. - -</p><p> -This setting is responsible for satisfying the <a class="link" href="#isolation">Network Isolation</a> requirement. -</p></div><div class="sect3" title="Hook Dangerous Javascript"><div class="titlepage"><div><div><h4 class="title"><a id="jshooks"></a>Hook Dangerous Javascript</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.kill_bad_js</strong></span></p><p>This setting enables injection of the <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/jshooks.js" target="_top">Javascript -hooking code</a>. This is done in the chrome in -<code class="function">torbutton_hookdoc()</code>, which is called ultimately by both the -<a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgressListener" target="_top">webprogress -listener</a> <span class="command"><strong>torbutton_weblistener</strong></span> and the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a> (the latter being a hack to handle -javascript: urls). - -In the Firefox 2 days, this option did a lot more than -it does now. It used to be responsible for timezone and improved useragent -spoofing, and history object cloaking. However, now it only provides -obfuscation of the <a class="ulink" href="https://developer.mozilla.org/en/DOM/window.screen" target="_top">window.screen</a> -object to mask your browser and desktop resolution. -The resolution hooks -effectively make the Firefox browser window appear to websites as if the renderable area -takes up the entire desktop, has no toolbar or other GUI element space, and -the desktop itself has no toolbars. -These hooks drastically reduce the amount of information available to do <a class="link" href="#fingerprinting">anonymity set reduction attacks</a> and help to -meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> -requirements. Unfortunately, Gregory Fleischer discovered it is still possible -to retrieve the original screen values by using <a class="ulink" href="http://pseudo-flaw.net/tor/torbutton/unmask-sandbox-xpcnativewrapper.html" target="_top">XPCNativeWrapper</a> -or <a class="ulink" href="http://pseudo-flaw.net/tor/torbutton/unmask-components-lookupmethod.html" target="_top">Components.lookupMethod</a>. -We are still looking for a workaround as of Torbutton 1.3.2. - - - - -</p></div><div class="sect3" title="Resize windows to multiples of 50px during Tor usage (recommended)"><div class="titlepage"><div><div><h4 class="title"><a id="id2663307"></a>Resize windows to multiples of 50px during Tor usage (recommended)</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p> - -This option drastically cuts down on the number of distinct anonymity sets -that divide the Tor web userbase. Without this setting, the dimensions for a -typical browser window range from 600-1200 horizontal pixels and 400-1000 -vertical pixels, or about 600x600 = 360000 different sets. Resizing the -browser window to multiples of 50 on each side reduces the number of sets by -50^2, bringing the total number of sets to 144. Of course, the distribution -among these sets are not uniform, but scaling by 50 will improve the situation -due to this non-uniformity for users in the less common resolutions. -Obviously the ideal situation would be to lie entirely about the browser -window size, but this will likely cause all sorts of rendering issues, and is -also not implementable in a foolproof way from extension land. - -</p><p> - -The implementation of this setting is spread across a couple of different -locations in the Torbutton javascript <a class="link" href="#browseroverlay" title="Browser Overlay - torbutton.xul">browser -overlay</a>. Since resizing minimized windows causes them to be restored, -and since maximized windows remember their previous size to the pixel, windows -must be resized before every document load (at the time of browser tagging) -via <code class="function">torbutton_check_round()</code>, called by -<code class="function">torbutton_update_tags()</code>. To prevent drift, the extension -tracks the original values of the windows and uses this to perform the -rounding on document load. In addition, to prevent the user from resizing a -window to a non-50px multiple, a resize listener -(<code class="function">torbutton_do_resize()</code>) is installed on every new browser -window to record the new size and round it to a 50px multiple while Tor is -enabled. In all cases, the browser's contentWindow.innerWidth and innerHeight -are set. This ensures that there is no discrepancy between the 50 pixel cutoff -and the actual renderable area of the browser (so that it is not possible to -infer toolbar size/presence by the distance to the nearest 50 pixel roundoff). - -</p><p> -This setting helps to meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements. -</p></div><div class="sect3" title="Disable Search Suggestions during Tor (recommended)"><div class="titlepage"><div><div><h4 class="title"><a id="id2663391"></a>Disable Search Suggestions during Tor (recommended)</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p> -This setting causes Torbutton to disable <a class="ulink" href="http://kb.mozillazine.org/Browser.search.suggest.enabled" target="_top"><span class="command"><strong>browser.search.suggest.enabled</strong></span></a> -during Tor usage. -This governs if you get Google search suggestions during Tor -usage. Your Google cookie is transmitted with google search suggestions, hence -this is recommended to be disabled. - -</p><p> -While this setting doesn't satisfy any Torbutton requirements, the fact that -cookies are transmitted for partially typed queries does not seem desirable -for Tor usage. -</p></div><div class="sect3" title="Disable Updates During Tor"><div class="titlepage"><div><div><h4 class="title"><a id="id2663430"></a>Disable Updates During Tor</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Controls_and_State" target="_top">Firefox -update settings</a> during Tor - usage: <span class="command"><strong>extensions.update.enabled</strong></span>, -<span class="command"><strong>app.update.enabled</strong></span>, - <span class="command"><strong>app.update.auto</strong></span>, and -<span class="command"><strong>browser.search.update</strong></span>. These prevent the - browser from updating extensions, checking for Firefox upgrades, and - checking for search plugin updates while Tor is enabled. - </p><p> -This setting satisfies the <a class="link" href="#updates">Update Safety</a> requirement. -</p></div><div class="sect3" title="Redirect Torbutton Updates Via Tor (recommended)"><div class="titlepage"><div><div><h4 class="title"><a id="id2663492"></a>Redirect Torbutton Updates Via Tor (recommended)</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.update_torbutton_via_tor</strong></span></p><p>This setting causes Torbutton to install an - -<a class="ulink" href="https://developer.mozilla.org/en/nsIProtocolProxyFilter" target="_top">nsIProtocolProxyFilter</a> -in order to redirect all version update checks and Torbutton update downloads -via Tor, regardless of if Tor is enabled or not. This was done both to address -concerns about data retention done by <a class="ulink" href="https://www.addons.mozilla.org" target="_top">addons.mozilla.org</a>, as well as to -help censored users meet the <a class="link" href="#undiscoverability">Tor -Undiscoverability</a> requirement. - - </p></div><div class="sect3" title="Disable livemarks updates during Tor usage (recommended)"><div class="titlepage"><div><div><h4 class="title"><a id="id2663536"></a>Disable livemarks updates during Tor usage (recommended)</h4></div></div></div><p>Option: - </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.disable_livemarks</strong></span></td></tr></table><p> - </p><p> - -This option causes Torbutton to prevent Firefox from loading <a class="ulink" href="http://www.mozilla.com/firefox/livebookmarks.html" target="_top">Livemarks</a> during -Tor usage. Because people often have very personalized Livemarks (such as RSS -feeds of Wikipedia articles they maintain, etc). This is accomplished both by -<a class="link" href="#livemarks" title="@mozilla.org/browser/livemark-service;2 - components/block-livemarks.js">wrapping the livemark-service component</a> and -by calling stopUpdateLivemarks() on the <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/livemark-service;2" target="_top">Livemark -service</a> when Tor is enabled. - -</p><p> -This helps satisfy the <a class="link" href="#isolation">Network -Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set -Preservation</a> requirements. -</p></div><div class="sect3" title="Block Tor/Non-Tor access to network from file:// urls (recommended)"><div class="titlepage"><div><div><h4 class="title"><a id="id2663607"></a>Block Tor/Non-Tor access to network from file:// urls (recommended)</h4></div></div></div><p>Options: - </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tor_file_net</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nontor_file_net</strong></span></td></tr></table><p> - </p><p> - -These settings prevent file urls from performing network operations during the -respective Tor states. Firefox 2's implementation of same origin policy allows -file urls to read and <a class="ulink" href="http://www.gnucitizen.org/blog/content-disposition-hacking/" target="_top">submit -arbitrary files from the local filesystem</a> to arbitrary websites. To -make matters worse, the 'Content-Disposition' header can be injected -arbitrarily by exit nodes to trick users into running arbitrary html files in -the local context. These preferences cause the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a> to block access to any network -resources from File urls during the appropriate Tor state. - -</p><p> - -This preference helps to ensure Tor's <a class="link" href="#isolation">Network -Isolation</a> requirement, by preventing file urls from executing network -operations in opposite Tor states. Also, allowing pages to submit arbitrary -files to arbitrary sites just generally seems like a bad idea. - -</p></div><div class="sect3" title="Close all Tor/Non-Tor tabs and windows on toggle (optional)"><div class="titlepage"><div><div><h4 class="title"><a id="id2663679"></a>Close all Tor/Non-Tor tabs and windows on toggle (optional)</h4></div></div></div><p>Options: - </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.close_nontor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.close_tor</strong></span></td></tr></table><p> - </p><p> - -These settings cause Torbutton to enumerate through all windows and close all -tabs in each window for the appropriate Tor state. This code can be found in -<code class="function">torbutton_update_status()</code>. The main reason these settings -exist is as a backup mechanism in the event of any Javascript or content policy -leaks due to <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737" target="_top">Firefox Bug -409737</a>. Torbutton currently tries to block all Javascript network -activity via the content policy, but until that bug is fixed, there is some -risk that there are alternate ways to bypass the policy. This option is -available as an extra assurance of <a class="link" href="#isolation">Network -Isolation</a> for those who would like to be sure that when Tor is toggled -all page activity has ceased. It also serves as a potential future workaround -in the event a content policy failure is discovered, and provides an additional -level of protection for the <a class="link" href="#disk">Disk Avoidance</a> -protection so that browser state is not sitting around waiting to be swapped -out longer than necessary. - -</p><p> -While this setting doesn't satisfy any Torbutton requirements, the fact that -cookies are transmitted for partially typed queries does not seem desirable -for Tor usage. -</p></div></div><div class="sect2" title="5.3. History and Forms Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2705261"></a>5.3. History and Forms Settings</h3></div></div></div><div class="sect3" title="Isolate Access to History navigation to Tor state (crucial)"><div class="titlepage"><div><div><h4 class="title"><a id="id2705267"></a>Isolate Access to History navigation to Tor state (crucial)</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p> -This setting determines if Torbutton installs an <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistoryListener" target="_top">nsISHistoryListener</a> -attached to the <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">sessionHistory</a> of -of each browser's <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3awebNavigation" target="_top">webNavigatator</a>. -The nsIShistoryListener is instantiated with a reference to the containing -browser window and blocks the back, forward, and reload buttons on the browser -navigation bar when Tor is in an opposite state than the one to load the -current tab. In addition, Tor clears the session history during a new document -load if this setting is enabled. - - </p><p> - -This is marked as a crucial setting in part -because Javascript access to the history object is indistinguishable from -user clicks, and because -<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737" target="_top">Firefox Bug -409737</a> allows javascript to execute in opposite Tor states, javascript -can issue reloads after Tor toggle to reveal your original IP. Even without -this bug, however, Javascript is still able to access previous pages in your -session history that may have been loaded under a different Tor state, to -attempt to correlate your activity. - - </p><p> - -This setting helps to fulfill Torbutton's <a class="link" href="#state">State -Separation</a> and (until Bug 409737 is fixed) <a class="link" href="#isolation">Network Isolation</a> -requirements. - - </p></div><div class="sect3" title="History Access Settings"><div class="titlepage"><div><div><h4 class="title"><a id="id2705344"></a>History Access Settings</h4></div></div></div><p>Options: - </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_thread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_thwrite</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthwrite</strong></span></td></tr></table><p> - </p><p>On Firefox 3.x, these four settings govern the behavior of the <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/ignore-history.js" target="_top">components/ignore-history.js</a> -history blocker component mentioned above. By hooking the browser's view of -the history itself via the <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/global-history;2" target="_top">@mozilla.org/browser/global-history;2</a> -and <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/nav-history-service;1" target="_top">@mozilla.org/browser/nav-history-service;1</a> -components, this mechanism defeats all document-based <a class="ulink" href="http://whattheinternetknowsaboutyou.com/" target="_top">history disclosure -attacks</a>, including <a class="ulink" href="http://ha.ckers.org/weird/CSS-history.cgi" target="_top">CSS-only attacks</a>. - -The component also hooks functions involved in writing history to disk via -both the <a class="ulink" href="http://developer.mozilla.org/en/docs/Places_migration_guide#History" target="_top">Places -Database</a> and the older Firefox 2 mechanisms. - -</p><p> -On Firefox 4, Mozilla finally <a class="ulink" href="https://developer.mozilla.org/en/CSS/Privacy_and_the_%3avisited_selector" target="_top">addressed -these issues</a>, so we can effectively ignore the "read" pair of the -above prefs. We then only need to link the write prefs to -<span class="command"><strong>places.history.enabled</strong></span>, which disabled writing to the -history store while set. -</p><p> -This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect3" title="Clear History During Tor Toggle (optional)"><div class="titlepage"><div><div><h4 class="title"><a id="id2705472"></a>Clear History During Tor Toggle (optional)</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls -<a class="ulink" href="https://developer.mozilla.org/en/nsIBrowserHistory#removeAllPages.28.29" target="_top">nsIBrowserHistory.removeAllPages</a> -and <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">nsISHistory.PurgeHistory</a> -for each tab on Tor toggle.</p><p> -This setting is an optional way to help satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect3" title="Block Password+Form saving during Tor/Non-Tor"><div class="titlepage"><div><div><h4 class="title"><a id="id2705515"></a>Block Password+Form saving during Tor/Non-Tor</h4></div></div></div><p>Options: - </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tforms</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_ntforms</strong></span></td></tr></table><p> - </p><p>These settings govern if Torbutton disables -<span class="command"><strong>browser.formfill.enable</strong></span> -and <span class="command"><strong>signon.rememberSignons</strong></span> during Tor and Non-Tor usage. -Since form fields can be read at any time by Javascript, this setting is a lot -more important than it seems. -</p><p> -This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div></div><div class="sect2" title="5.4. Cache Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2705577"></a>5.4. Cache Settings</h3></div></div></div><div class="sect3" title="Block Tor disk cache and clear all cache on Tor Toggle"><div class="titlepage"><div><div><h4 class="title"><a id="id2705582"></a>Block Tor disk cache and clear all cache on Tor Toggle</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span> - </p><p>This option causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICacheService#evictEntries.28.29" target="_top">nsICacheService.evictEntries(0)</a> -on Tor toggle to remove all entries from the cache. In addition, this setting -causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> to false. -</p><p> -This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect3" title="Block disk and memory cache during Tor"><div class="titlepage"><div><div><h4 class="title"><a id="id2705632"></a>Block disk and memory cache during Tor</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting -causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.memory.enable" target="_top">browser.cache.memory.enable</a>, -<a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> and -<a class="ulink" href="http://kb.mozillazine.org/Network.http.use-cache" target="_top">network.http.use-cache</a> to false during tor usage. -</p><p> -This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div></div><div class="sect2" title="5.5. Cookie and Auth Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2705686"></a>5.5. Cookie and Auth Settings</h3></div></div></div><div class="sect3" title="Clear Cookies on Tor Toggle"><div class="titlepage"><div><div><h4 class="title"><a id="id2705691"></a>Clear Cookies on Tor Toggle</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span> - </p><p> - -This setting causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICookieManager#removeAll.28.29" target="_top">nsICookieManager.removeAll()</a> on -every Tor toggle. In addition, this sets <a class="ulink" href="http://kb.mozillazine.org/Network.cookie.lifetimePolicy" target="_top">network.cookie.lifetimePolicy</a> -to 2 for Tor usage, which causes all cookies to be demoted to session cookies, -which prevents them from being written to disk. - -</p><p> -This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect3" title="Store Non-Tor cookies in a protected jar"><div class="titlepage"><div><div><h4 class="title"><a id="id2705742"></a>Store Non-Tor cookies in a protected jar</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span> - </p><p> - -This setting causes Torbutton to use <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/cookie-jar-selector.js" target="_top">@torproject.org/cookie-jar-selector;2</a> to store -non-tor cookies in a cookie jar during Tor usage, and clear the Tor cookies -before restoring the jar. -</p><p> -This setting also sets <a class="ulink" href="http://kb.mozillazine.org/Network.cookie.lifetimePolicy" target="_top">network.cookie.lifetimePolicy</a> -to 2 for Tor usage, which causes all cookies to be demoted to session cookies, -which prevents them from being written to disk. - -</p><p> -This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect3" title="Store both Non-Tor and Tor cookies in a protected jar (dangerous)"><div class="titlepage"><div><div><h4 class="title"><a id="id2705799"></a>Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span> - </p><p> - -This setting causes Torbutton to use <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/cookie-jar-selector.js" target="_top">@torproject.org/cookie-jar-selector;2</a> to store -both Tor and Non-Tor cookies into protected jars. -</p><p> -This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect3" title="Manage My Own Cookies (dangerous)"><div class="titlepage"><div><div><h4 class="title"><a id="id2705841"></a>Manage My Own Cookies (dangerous)</h4></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above -cookie prefs all to false.</p></div><div class="sect3" title="Disable DOM Storage during Tor usage (crucial)"><div class="titlepage"><div><div><h4 class="title"><a id="id2705856"></a>Disable DOM Storage during Tor usage (crucial)</h4></div></div></div><div class="sect3" title="Do not write Tor/Non-Tor cookies to disk"><div class="titlepage"><div><div><h4 class="title"><a id="id2705859"></a>Do not write Tor/Non-Tor cookies to disk</h4></div></div></div><p>Options: - </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.tor_memory_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.nontor_memory_jar</strong></span></td></tr></table><p> - </p><p> -These settings (contributed by arno) cause Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.cookie.lifetimePolicy" target="_top">network.cookie.lifetimePolicy</a> -to 2 during the appropriate Tor state, and to store cookies acquired in that -state into a Javascript -<a class="ulink" href="http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Guide:Processing_XML_with_E4X" target="_top">E4X</a> -object as opposed to writing them to disk. -</p><p> -This allows Torbutton to provide an option to preserve a user's -cookies while still satisfying the <a class="link" href="#disk">Disk Avoidance</a> -requirement. -</p></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_domstorage</strong></span> - </p><p> - -This setting causes Torbutton to toggle <span class="command"><strong>dom.storage.enabled</strong></span> during Tor -usage to prevent -<a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:Storage" target="_top">DOM Storage</a> from - being used to store persistent information across Tor states.</p><p> -This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect3" title="Clear HTTP Auth on Tor Toggle (recommended)"><div class="titlepage"><div><div><h4 class="title"><a id="id2705960"></a>Clear HTTP Auth on Tor Toggle (recommended)</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span> - </p><p> -This setting causes Torbutton to call <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsIHttpAuthManager" target="_top">nsIHttpAuthManager.clearAll()</a> -every time Tor is toggled. -</p><p> -This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div></div><div class="sect2" title="5.6. Startup Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2705999"></a>5.6. Startup Settings</h3></div></div></div><div class="sect3" title="On Browser Startup, set Tor state to: Tor, Non-Tor"><div class="titlepage"><div><div><h4 class="title"><a id="id2706004"></a>On Browser Startup, set Tor state to: Tor, Non-Tor</h4></div></div></div><p>Options: - <span class="command"><strong>extensions.torbutton.restore_tor</strong></span> - </p><p>This option governs what Tor state tor is loaded in to. -<code class="function">torbutton_set_initial_state()</code> covers the case where the -browser did not crash, and <code class="function">torbutton_crash_recover()</code> -covers the case where the <a class="link" href="#crashobserver" title="@torproject.org/crash-observer;1">crash observer</a> -detected a crash. -</p><p> - -Since the Tor state after a Firefox crash is unknown/indeterminate, this -setting helps to satisfy the <a class="link" href="#state">State Separation</a> -requirement in the event of Firefox crashes by ensuring all cookies, -settings and saved sessions are reloaded from a fixed Tor state. - -</p></div><div class="sect3" title="Prevent session store from saving Non-Tor/Tor-loaded tabs"><div class="titlepage"><div><div><h4 class="title"><a id="id2706055"></a>Prevent session store from saving Non-Tor/Tor-loaded tabs</h4></div></div></div><p>Options: - </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.nonontor_sessionstore</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.notor_sessionstore</strong></span></td></tr></table><p> - </p><p>If these options are enabled, the <a class="link" href="#tbsessionstore" title="@torproject.org/torbutton-ss-blocker;1">tbSessionStore.js</a> component uses the session -store listeners to filter out the appropriate tabs before writing the session -store data to disk. -</p><p> -This setting helps to satisfy the <a class="link" href="#disk">Disk Avoidance</a> -requirement, and also helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox -crashes. - -</p></div></div><div class="sect2" title="5.7. Shutdown Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2706113"></a>5.7. Shutdown Settings</h3></div></div></div><div class="sect3" title="Clear cookies on Tor/Non-Tor shutdown"><div class="titlepage"><div><div><h4 class="title"><a id="id2706119"></a>Clear cookies on Tor/Non-Tor shutdown</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span> - </p><p> This option variable can actually take 3 values: 0, 1, and 2. 0 means no -cookie clearing, 1 means clear only during Tor-enabled shutdown, and 2 means -clear for both Tor and Non-Tor shutdown. When set to 1 or 2, Torbutton listens -for the <a class="ulink" href="http://developer.mozilla.org/en/docs/Observer_Notifications#Application_shutdown" target="_top">quit-application-granted</a> event in -<a class="link" href="#crashobserver" title="@torproject.org/crash-observer;1">crash-observer.js</a> and use <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/cookie-jar-selector.js" target="_top">@torproject.org/cookie-jar-selector;2</a> -to clear out all cookies and all cookie jars upon shutdown. -</p><p> -This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div></div><div class="sect2" title="5.8. Header Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2706173"></a>5.8. Header Settings</h3></div></div></div><div class="sect3" title="Set user agent during Tor usage (crucial)"><div class="titlepage"><div><div><h4 class="title"><a id="id2706179"></a>Set user agent during Tor usage (crucial)</h4></div></div></div><p>Options: - </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.set_uagent</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.platform_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.oscpu_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.buildID_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.productsub_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appname_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appversion_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendor</strong></span></td></tr><tr><td><span class=" command"><strong>extensions.torbutton.useragent_vendorSub</strong></span></td></tr></table><p> - </p><p>On face, user agent switching appears to be straight-forward in Firefox. -It provides several options for controlling the browser user agent string: -<span class="command"><strong>general.appname.override</strong></span>, -<span class="command"><strong>general.appversion.override</strong></span>, -<span class="command"><strong>general.platform.override</strong></span>, -<span class="command"><strong>general.oscpu.override</strong></span>, -<span class="command"><strong>general.productSub.override</strong></span>, -<span class="command"><strong>general.buildID.override</strong></span>, -<span class="command"><strong>general.useragent.override</strong></span>, -<span class="command"><strong>general.useragent.vendor</strong></span>, and -<span class="command"><strong>general.useragent.vendorSub</strong></span>. If -the Torbutton preference <span class="command"><strong>extensions.torbutton.set_uagent</strong></span> is -true, Torbutton copies all of the other above prefs into their corresponding -browser preferences during Tor usage.</p><p> - -It also turns out that it is possible to detect the original Firefox version -by <a class="ulink" href="http://ha.ckers.org/blog/20070516/read-firefox-settings-poc/" target="_top">inspecting -certain resource:// files</a>. These cases are handled by Torbutton's -<a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>. - -</p><p> -This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement. -</p></div><div class="sect3" title="Spoof US English Browser"><div class="titlepage"><div><div><h4 class="title"><a id="id2706353"></a>Spoof US English Browser</h4></div></div></div><p>Options: -</p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.spoof_english</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_charset</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_language</strong></span></td></tr></table><p> -</p><p> This option causes Torbutton to set -<span class="command"><strong>general.useragent.locale</strong></span> -<span class="command"><strong>intl.accept_languages</strong></span> to the value specified in -<span class="command"><strong>extensions.torbutton.spoof_locale</strong></span>, -<span class="command"><strong>extensions.torbutton.spoof_charset</strong></span> and -<span class="command"><strong>extensions.torbutton.spoof_language</strong></span> during Tor usage, as -well as hooking <span class="command"><strong>navigator.language</strong></span> via its <a class="link" href="#jshooks" title="Hook Dangerous Javascript">javascript hooks</a>. - </p><p> -This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and <a class="link" href="#location">Location Neutrality</a> requirements. -</p></div><div class="sect3" title="Referer Spoofing Options"><div class="titlepage"><div><div><h4 class="title"><a id="id2706446"></a>Referer Spoofing Options</h4></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.refererspoof</strong></span> -</p><p> -This option variable has three values. If it is 0, "smart" referer spoofing is -enabled. If it is 1, the referer behaves as normal. If it is 2, no referer is -sent. The default value is 1. The smart referer spoofing is implemented by the -<a class="link" href="#refspoofer" title="@torproject.org/torRefSpoofer;1">torRefSpoofer</a> component. - -</p><p> -This setting also does not directly satisfy any Torbutton requirement, but -some may desire to mask their referer for general privacy concerns. -</p></div><div class="sect3" title="Automatically use an alternate search engine when presented with a Google Captcha"><div class="titlepage"><div><div><h4 class="title"><a id="id2706521"></a>Automatically use an alternate search engine when presented with a -Google Captcha</h4></div></div></div><p>Options: -</p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.asked_google_captcha</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.dodge_google_captcha</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.google_redir_url</strong></span></td></tr></table><p> -</p><p> - -Google's search engine has rate limiting features that cause it to -<a class="ulink" href="http://googleonlinesecurity.blogspot.com/2007/07/reason-behind-were-sorry-message.html" target="_top">present -captchas</a> and sometimes even outright ban IPs that issue large numbers -of search queries, especially if a lot of these queries appear to be searching -for software vulnerabilities or unprotected comment areas. - -</p><p> - -Despite multiple discussions with Google, we were unable to come to a solution -or any form of compromise that would reduce the number of captchas and -outright bans seen by Tor users issuing regular queries. - -</p><p> -As a result, we've implemented this option as an <a class="ulink" href="https://developer.mozilla.org/en/XUL_School/Intercepting_Page_Loads#HTTP_Observers" target="_top">'http-on-modify-request'</a> -http observer to optionally redirect banned or captcha-triggering Google -queries to search engines that do not rate limit Tor users. The current -options are duckduckgo.com, ixquick.com, bing.com, yahoo.com and scroogle.org. These are -encoded in the preferences -<span class="command"><strong>extensions.torbutton.redir_url.[1-5]</strong></span>. - -</p></div><div class="sect3" title="Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)"><div class="titlepage"><div><div><h4 class="title"><a id="id2706601"></a>Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h4></div></div></div><p>Options: -</p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.jar_certs</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.jar_ca_certs</strong></span></td></tr></table><p> -</p><p> - -These settings govern if Torbutton attempts to isolate the user's SSL -certificates into separate jars for each Tor state. This isolation is -implemented in <code class="function">torbutton_jar_certs()</code> in <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/chrome/content/torbutton.js" target="_top">chrome/content/torbutton.js</a>, -which calls <code class="function">torbutton_jar_cert_type()</code> and -<code class="function">torbutton_unjar_cert_type()</code> for each certificate type in -the <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/security/nsscertcache;1" target="_top">@mozilla.org/security/nsscertcache;1</a>. -Certificates are deleted from and imported to the <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/security/x509certdb;1" target="_top">@mozilla.org/security/x509certdb;1</a>. -</p><p> -The first time this pref is used, a backup of the user's certificates is -created in their profile directory under the name -<code class="filename">cert8.db.bak</code>. This file can be copied back to -<code class="filename">cert8.db</code> to fully restore the original state of the -user's certificates in the event of any error. -</p><p> -Since exit nodes and malicious sites can insert content elements sourced to -specific SSL sites to query if a user has a certain certificate, -this setting helps to satisfy the <a class="link" href="#state">State -Separation</a> requirement of Torbutton. Unfortunately, <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=435159" target="_top">Firefox Bug -435159</a> prevents it from functioning correctly in the event of rapid Tor toggle, so it -is currently not exposed via the preferences UI. - -</p></div></div></div><div class="sect1" title="6. Relevant Firefox Bugs"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="FirefoxBugs"></a>6. Relevant Firefox Bugs</h2></div></div></div><p> -Future releases of Torbutton are going to be designed around supporting only -<a class="ulink" href="https://www.torproject.org/projects/torbrowser.html.en" target="_top">Tor -Browser Bundle</a>, which greatly simplifies the number and nature of Firefox -bugs we must fix. This allows us to abandon the complexities of <a class="link" href="#state">State -Separation</a> and <a class="link" href="#isolation">Network Isolation</a> requirements -associated with the Toggle Model. - </p><div class="sect2" title="6.1. Tor Browser Bugs"><div class="titlepage"><div><div><h3 class="title"><a id="TorBrowserBugs"></a>6.1. Tor Browser Bugs</h3></div></div></div><p> -The list of Firefox patches we must create to improve privacy on the -Tor Browser Bundle are collected in the Tor Bug Tracker under <a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/2871" target="_top">ticket -#2871</a>. These bugs are also applicable to the Toggle Model, and -should be considered higher priority than all Toggle Model specific bugs -below. - </p></div><div class="sect2" title="6.2. Toggle Model Bugs"><div class="titlepage"><div><div><h3 class="title"><a id="ToggleModelBugs"></a>6.2. Toggle Model Bugs</h3></div></div></div><p> -In addition to the Tor Browser bugs, the Torbutton Toggle Model suffers from -additional bugs specific to the need to isolate state across the toggle. -Toggle model bugs are considered a lower priority than the bugs against the -Tor Browser model. - </p><div class="sect3" title="Bugs impacting security"><div class="titlepage"><div><div><h4 class="title"><a id="FirefoxSecurity"></a>Bugs impacting security</h4></div></div></div><p> - -Torbutton has to work around a number of Firefox bugs that impact its -security. Most of these are mentioned elsewhere in this document, but they -have also been gathered here for reference. In order of decreasing severity, -they are: - - </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=435159" target="_top">Bug 435159 - -nsNSSCertificateDB::DeleteCertificate has race conditions</a><p> - -In Torbutton 1.2.0rc1, code was added to attempt to isolate SSL certificates -the user has installed. Unfortunately, the method call to delete a certificate -from the current certificate database acts lazily: it only sets a variable -that marks a cert for deletion later, and it is not cleared if that -certificate is re-added. This means that if the Tor state is toggled quickly, -that certificate could remain present until it is re-inserted (causing an -error dialog), and worse, it would still be deleted after that. The lack of -this functionality is considered a Torbutton security bug because cert -isolation is considered a <a class="link" href="#state">State Separation</a> -feature. - - </p></li><li class="listitem">Give more visibility into and control over TLS -negotiation - <p> - -There are several <a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/2482" target="_top">TLS issues -impacting Torbutton security</a>. It is not clear if these should be one -Firefox bug or several, but in particular we need better control over various -aspects of TLS connections. Firefox currently provides no observer capable of -extracting TLS parameters or certificates early enough to cancel a TLS -request. We would like to be able to provide <a class="ulink" href="https://www.eff.org/https-everywhere" target="_top">HTTPS-Everywhere</a> users with -the ability to <a class="ulink" href="https://trac.torproject.org/projects/tor/wiki/HTTPSEverywhere/SSLObservatorySubmission" target="_top">have -their certificates audited</a> by a <a class="ulink" href="http://www.networknotary.org/" target="_top">Perspectives</a>-style set of -notaries. The problem with this is that the API observer points do not exist -for any Firefox addon to actually block authentication token submission over a -TLS channel, so every addon to date (including Perspectives) is actually -providing users with notification *after* their authentication tokens have -already been compromised. This obviously needs to be fixed. - </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=122752" target="_top">Bug 122752 - SOCKS -Username/Password Support</a><p> -We need <a class="ulink" href="https://developer.mozilla.org/en/nsIProxyInfo" target="_top">Firefox -APIs</a> or about:config settings to control the SOCKS Username and -Password fields. The reason why we need this support is to utilize an (as yet -unimplemented) scheme to separate Tor traffic based <a class="ulink" href="https://gitweb.torproject.org/torspec.git/blob_plain/HEAD:/proposals/171-separate-streams.txt" target="_top">on -SOCKS username/password</a>. - </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737" target="_top">Bug 409737 - -javascript.enabled and docShell.allowJavascript do not disable all event -handlers</a><p> - -This bug allows pages to execute javascript via addEventListener and perhaps -other callbacks. In order to prevent this bug from enabling an attacker to -break the <a class="link" href="#isolation">Network Isolation</a> requirement, -Torbutton 1.1.13 began blocking popups and history manipulation from different -Tor states. So long as there are no ways to open popups or redirect the user -to a new page, the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">Torbutton content -policy</a> should block Javascript network access. However, if there are -ways to open popups or perform redirects such that Torbutton cannot block -them, pages may still have free reign to break that requirement and reveal a -user's original IP address. - - </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448743" target="_top">Bug 448743 - -Decouple general.useragent.locale from spoofing of navigator.language</a><p> - -Currently, Torbutton spoofs the <span class="command"><strong>navigator.language</strong></span> -attribute via <a class="link" href="#jshooks" title="Hook Dangerous Javascript">Javascript hooks</a>. Unfortunately, -these do not work on Firefox 3. It would be ideal to have -a pref to set this value (something like a -<span class="command"><strong>general.useragent.override.locale</strong></span>), -to avoid fragmenting the anonymity set of users of foreign locales. This issue -impedes Torbutton from fully meeting its <a class="link" href="#setpreservation">Anonymity Set Preservation</a> -requirement on Firefox 3. - - </p></li></ol></div></div><div class="sect3" title="Bugs blocking functionality"><div class="titlepage"><div><div><h4 class="title"><a id="FirefoxWishlist"></a>Bugs blocking functionality</h4></div></div></div><p> -The following bugs impact Torbutton and similar extensions' functionality. - </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=629820" target="_top">Bug 629820 - nsIContentPolicy::shouldLoad not -called for web request in Firefox Mobile</a><p> - -The new <a class="ulink" href="https://wiki.mozilla.org/Mobile/Fennec/Extensions/Electrolysis" target="_top">Electrolysis</a> -multiprocess system appears to have some pretty rough edge cases with respect -to registering XPCOM category managers such as the nsIContentPolicy, which -make it difficult to do a straight-forward port of Torbutton or -HTTPS-Everywhere to Firefox Mobile. It probably also has similar issues with -wrapping existing <a class="link" href="#hookedxpcom" title="2.1. Hooked Components">Firefox XPCOM components</a>, -which will also cause more problems for porting Torbutton. - - </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=417869" target="_top">Bug 417869 - -Browser context is difficult to obtain from many XPCOM callbacks</a><p> - -It is difficult to determine which tabbrowser many XPCOM callbacks originate -from, and in some cases absolutely no context information is provided at all. -While this doesn't have much of an effect on Torbutton, it does make writing -extensions that would like to do per-tab settings and content filters (such as -FoxyProxy) difficult to impossible to implement securely. - - </p></li></ol></div></div><div class="sect3" title="Low Priority Bugs"><div class="titlepage"><div><div><h4 class="title"><a id="FirefoxMiscBugs"></a>Low Priority Bugs</h4></div></div></div><p> -The following bugs have an effect upon Torbutton, but are superseded by more -practical and more easily fixable variant bugs above; or have stable, simple -workarounds. - </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=440892" target="_top">Bug 440892 - -network.protocol-handler.warn-external are ignored</a><p> - -Sometime in the Firefox 3 development cycle, the preferences that governed -warning a user when external apps were launched got disconnected from the code -that does the launching. Torbutton depended on these prefs to prevent websites -from launching specially crafted documents and application arguments that -caused Proxy Bypass. We currently work around this issue by <a class="link" href="#appblocker" title="@mozilla.org/uriloader/external-protocol-service;1 , @mozilla.org/uriloader/external-helper-app-service;1, and @mozilla.org/mime;1 - components/external-app-blocker.js">wrapping the app launching components</a> to present a -popup before launching external apps while Tor is enabled. While this works, -it would be nice if these prefs were either fixed or removed. - - </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=437014" target="_top">Bug 437014 - -nsIContentPolicy::shouldLoad no longer called for favicons</a><p> - -Firefox 3.0 stopped calling the shouldLoad call of content policy for favicon -loads. Torbutton had relied on this call to block favicon loads for opposite -Tor states. The workaround it employs for Firefox 3 is to cancel the request -when it arrives in the <span class="command"><strong>torbutton_http_observer</strong></span> used for -blocking full page plugin loads. This seems to work just fine, but is a bit -dirty. - - </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=309524" target="_top">Bug 309524</a> -and <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=380556" target="_top">Bug -380556</a> - nsIContentPolicy::shouldProcess is not called. - <p> - -This is a call that would be useful to develop a better workaround for the -allowPlugins issue above. If the content policy were called before a URL was -handed over to a plugin or helper app, it would make the workaround for the -above allowPlugins bug a lot cleaner. Obviously this bug is not as severe as -the others though, but it might be nice to have this API as a backup. - - </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296" target="_top">Bug 401296 - docShell.allowPlugins -not honored for direct links</a> (Perhaps subset of <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=282106" target="_top">Bug 282106</a>?) - <p> - -Similar to the javascript plugin disabling attribute, the plugin disabling -attribute is also not perfect — it is ignored for direct links to plugin -handled content, as well as meta-refreshes to plugin handled content. This -requires Torbutton to listen to a number of different http events to intercept -plugin-related mime type URLs and cancel their requests. Again, since plugins -are quite horrible about obeying proxy settings, loading a plugin pretty much -ensures a way to break the <a class="link" href="#isolation">Network Isolation</a> -requirement and reveal a user's original IP address. Torbutton's code to -perform this workaround has been subverted at least once already by Kyle -Williams. - - </p></li></ol></div></div></div></div><div class="sect1" title="7. Testing"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="TestPlan"></a>7. Testing</h2></div></div></div><p> - -The purpose of this section is to cover all the known ways that Tor browser -security can be subverted from a penetration testing perspective. The hope -is that it will be useful both for creating a "Tor Safety Check" -page, and for developing novel tests and actively attacking Torbutton with the -goal of finding vulnerabilities in either it or the Mozilla components, -interfaces and settings upon which it relies. - - </p><div class="sect2" title="7.1. Single state testing"><div class="titlepage"><div><div><h3 class="title"><a id="SingleStateTesting"></a>7.1. Single state testing</h3></div></div></div><p> - -Torbutton is a complicated piece of software. During development, changes to -one component can affect a whole slough of unrelated features. A number of -aggregated test suites exist that can be used to test for regressions in -Torbutton and to help aid in the development of Torbutton-like addons and -other privacy modifications of other browsers. Some of these test suites exist -as a single automated page, while others are a series of pages you must visit -individually. They are provided here for reference and future regression -testing, and also in the hope that some brave soul will one day decide to -combine them into a comprehensive automated test suite. - - </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="http://decloak.net/" target="_top">Decloak.net</a><p> - -Decloak.net is the canonical source of plugin and external-application based -proxy-bypass exploits. It is a fully automated test suite maintained by <a class="ulink" href="http://digitaloffense.net/" target="_top">HD Moore</a> as a service for people to -use to test their anonymity systems. - - </p></li><li class="listitem"><a class="ulink" href="http://deanonymizer.com/" target="_top">Deanonymizer.com</a><p> - -Deanonymizer.com is another automated test suite that tests for proxy bypass -and other information disclosure vulnerabilities. It is maintained by Kyle -Williams, the author of <a class="ulink" href="http://www.janusvm.com/" target="_top">JanusVM</a> -and <a class="ulink" href="http://www.januspa.com/" target="_top">JanusPA</a>. - - </p></li><li class="listitem"><a class="ulink" href="https://www.jondos.de/en/anontest" target="_top">JonDos -AnonTest</a><p> - -The <a class="ulink" href="https://www.jondos.de" target="_top">JonDos people</a> also provide an -anonymity tester. It is more focused on HTTP headers than plugin bypass, and -points out a couple of headers Torbutton could do a better job with -obfuscating. - - </p></li><li class="listitem"><a class="ulink" href="http://browserspy.dk" target="_top">Browserspy.dk</a><p> - -Browserspy.dk provides a tremendous collection of browser fingerprinting and -general privacy tests. Unfortunately they are only available one page at a -time, and there is not really solid feedback on good vs bad behavior in -the test results. - - </p></li><li class="listitem"><a class="ulink" href="http://analyze.privacy.net/" target="_top">Privacy -Analyzer</a><p> - -The Privacy Analyzer provides a dump of all sorts of browser attributes and -settings that it detects, including some information on your origin IP -address. Its page layout and lack of good vs bad test result feedback makes it -not as useful as a user-facing testing tool, but it does provide some -interesting checks in a single page. - - </p></li><li class="listitem"><a class="ulink" href="http://ha.ckers.org/mr-t/" target="_top">Mr. T</a><p> - -Mr. T is a collection of browser fingerprinting and deanonymization exploits -discovered by the <a class="ulink" href="http://ha.ckers.org" target="_top">ha.ckers.org</a> crew -and others. It is also not as user friendly as some of the above tests, but it -is a useful collection. - - </p></li><li class="listitem">Gregory Fleischer's <a class="ulink" href="http://pseudo-flaw.net/content/tor/torbutton/" target="_top">Torbutton</a> and -<a class="ulink" href="http://pseudo-flaw.net/content/defcon/dc-17-demos/d.html" target="_top">Defcon -17</a> Test Cases - <p> - -Gregory Fleischer has been hacking and testing Firefox and Torbutton privacy -issues for the past 2 years. He has an excellent collection of all his test -cases that can be used for regression testing. In his Defcon work, he -demonstrates ways to infer Firefox version based on arcane browser properties. -We are still trying to determine the best way to address some of those test -cases. - - </p></li><li class="listitem"><a class="ulink" href="https://torcheck.xenobite.eu/index.php" target="_top">Xenobite's -TorCheck Page</a><p> - -This page checks to ensure you are using a valid Tor exit node and checks for -some basic browser properties related to privacy. It is not very fine-grained -or complete, but it is automated and could be turned into something useful -with a bit of work. - - </p></li></ol></div><p> - </p></div><div class="sect2" title="7.2. Multi-state testing"><div class="titlepage"><div><div><h3 class="title"><a id="id2707624"></a>7.2. Multi-state testing</h3></div></div></div><p> - -The tests in this section are geared towards a page that would instruct the -user to toggle their Tor state after the fetch and perform some operations: -mouseovers, stray clicks, and potentially reloads. - - </p><div class="sect3" title="Cookies and Cache Correlation"><div class="titlepage"><div><div><h4 class="title"><a id="id2707636"></a>Cookies and Cache Correlation</h4></div></div></div><p> -The most obvious test is to set a cookie, ask the user to toggle tor, and then -have them reload the page. The cookie should no longer be set if they are -using the default Torbutton settings. In addition, it is possible to leverage -the cache to <a class="ulink" href="http://crypto.stanford.edu/sameorigin/safecachetest.html" target="_top">store unique -identifiers</a>. The default settings of Torbutton should also protect -against these from persisting across Tor Toggle. - - </p></div><div class="sect3" title="Javascript timers and event handlers"><div class="titlepage"><div><div><h4 class="title"><a id="id2707658"></a>Javascript timers and event handlers</h4></div></div></div><p> - -Javascript can set timers and register event handlers in the hopes of fetching -URLs after the user has toggled Torbutton. - </p></div><div class="sect3" title="CSS Popups and non-script Dynamic Content"><div class="titlepage"><div><div><h4 class="title"><a id="id2707671"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p> - -Even if Javascript is disabled, CSS is still able to -<a class="ulink" href="http://www.tjkdesign.com/articles/css%20pop%20ups/" target="_top">create popup-like -windows</a> -via the 'onmouseover' CSS attribute, which can cause arbitrary browser -activity as soon as the mouse enters into the content window. It is also -possible for meta-refresh tags to set timers long enough to make it likely -that the user has toggled Tor before fetching content. - - </p></div></div><div class="sect2" title="7.3. Active testing (aka How to Hack Torbutton)"><div class="titlepage"><div><div><h3 class="title"><a id="HackTorbutton"></a>7.3. Active testing (aka How to Hack Torbutton)</h3></div></div></div><p> - -The idea behind active testing is to discover vulnerabilities in Torbutton to -bypass proxy settings, run script in an opposite Tor state, store unique -identifiers, leak location information, or otherwise violate <a class="link" href="#requirements" title="1.2. Torbutton Requirements">its requirements</a>. Torbutton has ventured out -into a strange and new security landscape. It depends on Firefox mechanisms -that haven't necessarily been audited for security, certainly not for the -threat model that Torbutton seeks to address. As such, it and the interfaces -it depends upon still need a 'trial by fire' typical of new technologies. This -section of the document was written with the intention of making that period -as fast as possible. Please help us get through this period by considering -these attacks, playing with them, and reporting what you find (and potentially -submitting the test cases back to be run in the standard batch of Torbutton -tests. - - </p><div class="sect3" title="Some suggested vectors to investigate"><div class="titlepage"><div><div><h4 class="title"><a id="id2707726"></a>Some suggested vectors to investigate</h4></div></div></div><p> - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">Strange ways to register Javascript <a class="ulink" href="http://en.wikipedia.org/wiki/DOM_Events" target="_top">events</a> and <a class="ulink" href="http://www.devshed.com/c/a/JavaScript/Using-Timers-in-JavaScript/" target="_top">timeouts</a> should -be verified to actually be ineffective after Tor has been toggled.</li><li class="listitem">Other ways to cause Javascript to be executed after -<span class="command"><strong>javascript.enabled</strong></span> has been toggled off.</li><li class="listitem">Odd ways to attempt to load plugins. Kyle Williams has had -some success with direct loads/meta-refreshes of plugin-handled URLs.</li><li class="listitem">The Date and Timezone hooks should be verified to work with -crazy combinations of iframes, nested iframes, iframes in frames, frames in -iframes, and popups being loaded and -reloaded in rapid succession, and/or from one another. Think race conditions and deep, -parallel nesting, involving iframes from both <a class="ulink" href="http://en.wikipedia.org/wiki/Same_origin_policy" target="_top">same-origin and -non-same-origin</a> domains.</li><li class="listitem">In addition, there may be alternate ways and other -methods to query the timezone, or otherwise use some of the Date object's -methods in combination to deduce the timezone offset. Of course, the author -tried his best to cover all the methods he could foresee, but it's always good -to have another set of eyes try it out.</li><li class="listitem">Similarly, is there any way to confuse the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a> -mentioned above to cause it to allow certain types of page fetches? For -example, it was recently discovered that favicons are not fetched by the -content, but the chrome itself, hence the content policy did not look up the -correct window to determine the current Tor tag for the favicon fetch. Are -there other things that can do this? Popups? Bookmarklets? Active bookmarks? </li><li class="listitem">Alternate ways to store and fetch unique identifiers. For example, <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:Storage" target="_top">DOM Storage</a> -caught us off guard. -It was -also discovered by <a class="ulink" href="http://pseudo-flaw.net" target="_top">Gregory -Fleischer</a> that <a class="ulink" href="http://pseudo-flaw.net/content/tor/torbutton/" target="_top">content window access to -chrome</a> can be used to build <a class="link" href="#fingerprinting">unique -identifiers</a>. -Are there any other -arcane or experimental ways that Firefox provides to create and store unique -identifiers? Or perhaps unique identifiers can be queried or derived from -properties of the machine/browser that Javascript has access to? How unique -can these identifiers be? - </li><li class="listitem">Is it possible to get the browser to write some history to disk -(aside from swap) that can be retrieved later? By default, Torbutton should -write no history, cookie, or other browsing activity information to the -harddisk.</li><li class="listitem">Do popup windows make it easier to break any of the above -behavior? Are javascript events still canceled in popups? What about recursive -popups from Javascript, data, and other funky URL types? What about CSS -popups? Are they still blocked after Tor is toggled?</li><li class="listitem">Chrome-escalation attacks. The interaction between the -Torbutton chrome Javascript and the client content window javascript is pretty -well-defined and carefully constructed, but perhaps there is a way to smuggle -javascript back in a return value, or otherwise inject network-loaded -javascript into the chrome (and thus gain complete control of the browser). -</li></ul></div><p> - - </p></div></div></div></div></body></html> diff --git a/website/gimpy.css b/website/gimpy.css deleted file mode 100644 index 277f0160..00000000 --- a/website/gimpy.css +++ /dev/null @@ -1,3 +0,0 @@ -LI:first-line { - font-weight: bold -} diff --git a/website/index.html.en b/website/index.html.en deleted file mode 100644 index 5909b26e..00000000 --- a/website/index.html.en +++ /dev/null @@ -1,532 +0,0 @@ -<html> -<head> -<title>Torbutton - Quickly toggle Firefox's use of the Tor network</title> -<LINK REL="stylesheet" TYPE="text/css" HREF="gimpy.css"> - -<link rel="search" type="application/opensearchdescription+xml" title="Google Canada" href="search/google-ca.xml"> -<link rel="search" type="application/opensearchdescription+xml" title="Google UK" href="http://torbutton.torproject.org/dev/search/google-uk.xml"> -<link rel="search" type="application/opensearchdescription+xml" title="Google USA" href="search/google-us.xml"> -<script> - -function addSearchProvider(prov) { - -try { -window.external.AddSearchProvider(prov); -} - -catch (e) { -alert("Search plugins require Firefox 2"); -return; -} -} - -function addEngine(name,ext,cat,pid) -{ - if ((typeof window.sidebar == "object") && (typeof window.sidebar.addSearchEngine == "function")) { - window.sidebar.addSearchEngine( - "http://mycroft.mozdev.org/install.php/" + pid + "/" + name + ".src", - "http://mycroft.mozdev.org/install.php/" + pid + "/" + name + "."+ ext, name, cat ); - } else { - alert("You will need a browser which supports Sherlock to install this plugin."); - } -} - -function addOpenSearch(name,ext,cat,pid,meth) -{ - if ((typeof window.external == "object") && ((typeof window.external.AddSearchProvider == "unknown") || (typeof window.external.AddSearchProvider == "function"))) { - if ((typeof window.external.AddSearchProvider == "unknown") && meth == "p") { - alert("This plugin uses POST which is not currently supported by Internet Explorer's implementation of OpenSearch."); - } else { - window.external.AddSearchProvider( - "http://mycroft.mozdev.org/installos.php/" + pid + "/" + name + ".xml"); - } - } else { - alert("You will need a browser which supports OpenSearch to install this plugin."); - } -} - -function addOpenSearch2(name,ext,cat,pid,meth) -{ - if ((typeof window.external == "object") && ((typeof window.external.AddSearchProvider == "unknown") || (typeof window.external.AddSearchProvider == "function"))) { - if ((typeof window.external.AddSearchProvider == "unknown") && meth == "p") { - alert("This plugin uses POST which is not currently supported by Internet Explorer's implementation of OpenSearch."); - } else { - window.external.AddSearchProvider( - "http://torbutton.torproject.org/dev/search/" + name + ".xml"); - } - } else { - alert("You will need a browser which supports OpenSearch to install this plugin."); - } -} - -function install (aEvent) -{ - var params = { - "Torbutton": { URL: aEvent.target.href, - Hash: aEvent.target.getAttribute("hash"), - toString: function () { return this.URL; } - } - }; - InstallTrigger.install(params); - - return false; -} - - -</script> -</head> -<body> - -<h1>Torbutton Development Branch</h1> -<strong>Current version:</strong> 1.2.0rc6 (12 Jul 2008)<br/> -<br/> -<strong>Authors:</strong> Scott Squires &amp; Mike Perry<br> -<strong>Email:</strong> squires at freehaven dot net, mikeperry (o) fscked/org<br/> -<br/> -<strong>Install:</strong> -<a href="http://torbutton.torproject.org/dev/torbutton-current.xpi" - hash="sha1:7f01c577641b6222781cd880c9825d6f50ff1cc4" - onclick="return install(event);">Local (Javascript verified)</a><br/> -<strong>Past Releases:</strong> <a href="releases/">Local (non-https)</a><br/> -<strong>Developer Documentation:</strong> <a href="design/">Torbutton Design Document</a> and <a href="design/MozillaBrownBag.pdf">Slides (Not actively updated)</a><br/> -<strong>Extras:</strong> - -Google search plugins for - -<a href="/jsreq.html" title="Ref: 14938 (googleCA)" - onClick="addOpenSearch('GoogleCanada','ico','General','14937','g');return false">Google CA</a>, and - -<a href="/jsreq.html" title="Ref: 14938 (googleCA)" - onClick="addOpenSearch('googleuk_web','png','General','14445','g');return false">Google UK</a>. -<br/> -<!-- -<strong>Install:</strong> <a href="torbutton-1.0.4.xpi">torbutton-1.0.4.xpi</a><br/> ---> -<strong>Source:</strong> You can <a href="https://tor-svn.freehaven.net/svn/torbutton/trunk/">browse the repository</a> or simply unzip the xpi. -<br/> -<strong>Bug Reports:</strong> <a href="https://bugs.torproject.org/flyspray/index.php?tasks=all&project=5">Torproject flyspray</a><br/> -<strong>Documents:</strong> <b>[</b> <a href="#FAQ">FAQ</a> <b>|</b> <a href="CHANGELOG">changelog</a> <b>|</b> <a href="LICENSE">license</a> <b>|</b> <a href="CREDITS">credits</a> <b>]</b><br/> -<h2>About</h2> -<p> -Torbutton is a 1-click way for Firefox users to enable or disable the browser's use of <a href="https://www.torproject.org/">Tor</a>. It adds a panel to the statusbar that says "Tor Enabled" (in green) or "Tor Disabled" (in red). The user may click on the panel to toggle the status. If the user (or some other extension) changes the proxy settings, the change is automatically reflected in the statusbar. -</p><p> -Some users may prefer a toolbar button instead of a statusbar panel. Such a button is included, and one adds it to the toolbar by right-clicking on the desired toolbar, selecting "Customize...", and then dragging the Torbutton icon onto the toolbar. There is an option in the preferences to hide the statusbar panel (Tools-&gt;Extensions, select Torbutton, and click on Preferences). -</p> -<p> -Newer Firefoxes have the ability to send DNS resolves through the socks proxy, and Torbutton will make use of this feature if it is available in your version of Firefox. -</p> - -<a id="FAQ"></a><h2>FAQ</h2> - -<strong>I can't click on links or hit reload after I toggle Tor! Why?</strong> -<p> - -Due to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737">Firefox -Bug 409737</a>, pages can still open popups and perform Javascript redirects -and history access after Tor has been toggled. These popups and redirects can -be blocked, but unfortunately they are indistinguishable from normal user -interactions with the page (such as clicking on links, opening them in new -tabs/windows, or using the history buttons), and so those are blocked as a -side effect. Once that Firefox bug is fixed, this degree of isolation will -become optional (for people who do not want to accidentally click on links and -give away information via referrers). A workaround is to right click on the -link, and open it in a new tab or window. The tab or window won't load -automatically, but you can hit enter in the URL bar, and it will begin -loading. Hitting enter in the URL bar will also reload the page without -clicking the reload button. - -</p> - -<strong>My browser is in some weird state where nothing works right!</strong> -<p> - -Try to disable Tor by clicking on the button, and then open a new window. If -that doesn't fix the issue, go to the preferences page and hit 'Restore -Defaults'. This should reset the extension and Firefox to a known good -configuration. If you can manage to reproduce whatever issue gets your -Firefox wedged, please file details at <a -href="https://bugs.torproject.org/flyspray/index.php?tasks=all&project=5%22%3E... -bug tracker</a>. - -</p> - -<strong>When I toggle Tor, my sites that use javascript stop working. Why?</strong> -<p> - -Javascript can do things like wait until you have disabled Tor before trying -to contact its source site, thus revealing your IP address. As such, Torbutton -must disable Javascript, Meta-Refresh tags, and certain CSS behavior when Tor -state changes from the state that was used to load a given page. These features -are re-enabled when Torbutton goes back into the state that was used to load -the page, but in some cases (particularly with Javascript and CSS) it is -sometimes not possible to fully recover from the resulting errors, and the -page is broken. Unfortunately, the only thing you can do (and still remain -safe from having your IP address leak) is to reload the page when you toggle -Tor, or just ensure you do all your work in a page before switching tor state. - -</p> - - -<strong>When I use Tor, Firefox is no longer filling in logins/search boxes -for me. Why?</strong> -<p> - -Currently, this is tied to the "<b>Block history writes during Tor</b>" -setting. If you have enabled that setting, all formfill functionality (both -saving and reading) is disabled. If this bothers you, you can uncheck that -option, but both history and forms will be saved. To prevent history -disclosure attacks via Non-Tor usage, it is recommended you disable Non-Tor -history reads if you allow history writing during Tor. - -</p> - - -<strong>Which Firefox extensions should I avoid using?</strong> -<p> - -This is a tough one. There are thousands of Firefox extensions: making a -complete list of ones that are bad for anonymity is near impossible. However, -here are a few examples that should get you started as to what sorts of -behavior are dangerous. - -<ol> - <li>StumbleUpon, et al</li> - These extensions will send all sorts of information about the websites you - visit to the stumbleupon servers, and correlate this information with a - unique identifier. This is obviously terrible for your anonymity. - More generally, any sort of extension that requires registration, or even - extensions that provide information about websites you visit should be - suspect. - - <li>FoxyProxy</li> - -While FoxyProxy is a nice idea in theory, in practice it is impossible to -configure securely for Tor usage without Torbutton. Like all vanilla third -party proxy plugins, the main risks are <a -href="http://www.metasploit.com/research/projects/decloak/%22%3Eplugin leakage</a> -and <a href="http://ha.ckers.org/weird/CSS-history.cgi">history -disclosure</a>, followed closely by cookie theft by exit nodes and tracking by -adservers (see the <a href="design/index.html#adversary">Torbutton Adversary -Model</a> for more information). However, even with Torbutton installed in -tandem and always enabled, it is still very difficult (though not impossible) -to configure FoxyProxy securely. Since FoxyProxy's 'Patterns' mode only -applies to specific urls, and not to an entire tab, setting FoxyProxy to only -send specific sites through Tor will still allow adservers to still learn your -real IP. Worse, if those sites use offsite logging services such as Google -Analytics, you may still end up in their logs with your real IP. Malicious -exit nodes can also cooperate with sites to inject images into pages that -bypass your filters. Setting FoxyProxy to only send certain URLs via Non-Tor -is much more viable, but be very careful with the filters you allow. For -example, something as simple as allowing *google* to go via Non-Tor will still -cause you to end up in all the logs of all websites that use Google Analytics! -See <a href="http://foxyproxy.mozdev.org/faq.html#privacy-01">this -question</a> on the FoxyProxy FAQ for more information. - - <li>NoScript</li> - Torbutton currently mitigates all known anonymity issues with Javascript. - While it may be tempting to get better security by disabling Javascript for - certain sites, you are far better off with an all-or-nothing approach. - NoScript is exceedingly complicated, and has many subtleties that can surprise - even advanced users. For example, addons.mozilla.org verifies extension - integrity via Javascript over https, but downloads them in the clear. Not - adding it to your whitelist effectively - means you are pulling down unverified extensions. Worse still, using NoScript - can actually disable protections that Torbutton itself provides via - Javascript, yet still allow malicious exit nodes to compromise your - anonymity via the default whitelist (which they can spoof to inject any script they want). - -</ol> - -</p> - -<strong>Which Firefox extensions do you recommend?</strong> -<p> -<ol> - <li><a href="https://addons.mozilla.org/en-US/firefox/addon/953">RefControl</a></li> - Mentioned above, this extension allows more fine-grained referrer spoofing -than Torbutton currently provides. It should break less sites than Torbutton's -referrer spoofing option. - <li><a href="https://addons.mozilla.org/en-US/firefox/addon/1474">SafeCache</a></li> - If you use Tor excessively, and rarely disable it, you probably want to -install this extension to minimize the ability of sites to store long term -identifiers in your cache. This extension applies same origin policy to the -cache, so that elements are retrieved from the cache only if they are fetched -from a document in the same origin domain as the cached element. -</ol> - -</p> - -<strong>Are there any other issues I should be concerned about?</strong> -<p> - -There is currently one known unfixed security issue with Torbutton: it is -possible to unmask the javascript hooks that wrap the Date object to conceal -your timezone in Firefox 2, and the timezone masking code does not work at all -on Firefox 3. We are working with the Firefox team to fix one of <a -href="https://bugzilla.mozilla.org/show_bug.cgi?id=392274%22%3EBug 399274</a> or -<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=419598">Bug 419598</a> -to address this. In the meantime, it is possible to set the <b>TZ</b> -environment variable to <b>UTC</b> to cause the browser to use UTC as your -timezone. Under Linux, you can add an <b>export TZ=UTC</b> to the -/usr/bin/firefox script, or edit your system bashrc to do the same. Under -Windows, you can set either a <a -href="http://support.microsoft.com/kb/310519%22%3EUser or System Environment -Variable</a> for TZ via My Computer's properties. In MacOS, the situation is -<a -href="http://developer.apple.com/documentation/MacOSX/Conceptual/BPRuntimeConfig/A... -lot more complicated</a>, unfortunately. - -</p> - -<p> - -In addition, RSS readers such as Firefox Livemarks can perform -periodic fetches. Due to <a -href="https://bugzilla.mozilla.org/show_bug.cgi?id=436250%22%3EFirefox Bug -436250</a>, there is no way to disable Livemark fetches during Tor. This can -be a problem if you have a lot of custom Livemark urls that can give away -information about your identity. - -</p> - -<h2>Description of Options</h2> - -<p>The development branch of Torbutton adds several new security features to -protect your anonymity from all the major threats the author is aware of. The -defaults should be fine for most people, but in case you are the tweaker type, -or if you prefer to try to outsource some options to more flexible extensions, -here is the complete list. (In an ideal world, these descriptions should all be -tooltips in the extension itself, but Firefox bugs <a -href="https://bugzilla.mozilla.org/show_bug.cgi?id=45375%22%3E45375</a> and <a -href="https://bugzilla.mozilla.org/show_bug.cgi?id=218223%22%3E218223</a> currently -prevent this).</p> - -<ul> - <li>Disable plugins on Tor Usage (crucial)</li> - - This option is key to Tor security. Plugins perform their own networking -independent of the browser, and many plugins only partially obey even their own -proxy settings. - - <li>Isolate Dynamic Content to Tor State (crucial)</li> - - Another crucial option, this setting causes the plugin to disable Javascript - on tabs that are loaded during a Tor state different than the current one, - to prevent delayed fetches of injected URLs that contain unique identifiers, - and to prevent meta-refresh tags from revealing your IP when you turn off - Tor. It also prevents all fetches from tabs loaded with an opposite Tor - state. This serves to block non-Javascript dynamic content such as CSS - popups from revealing your IP address if you disable Tor. - - <li>Hook Dangerous Javascript (crucial)</li> - -This setting enables the Javascript hooking code. Javascript is injected into -pages to hook the Date object to mask your timezone, and to hook the navigator -object to mask OS and user agent properties not handled by the standard -Firefox user agent override settings. - - <li>Resize window dimensions to multiples of 50px on toggle (recommended)</li> - -To cut down on the amount of state available to fingerprint users uniquely, -this pref causes windows to be resized to a multiple of 50 pixels on each -side when Tor is enabled and pages are loaded. - - <li>Disable Updates During Tor (recommended)</li> - -Under Firefox 2, many extension authors did not update their extensions from -SSL-enabled websites. It is possible for malicious Tor nodes to hijack these extensions and replace them with malicious ones, or add malicious code to -existing extensions. Since Firefox 3 now enforces encrypted and/or -authenticated updates, this setting is no longer as important as it once -was (though updates do leak information about which extensions you have, it is -fairly infrequent). - - <li>Disable Search Suggestions during Tor (optional)</li> - -This optional setting governs if you get Google search suggestions during Tor -usage. Since no cookie is transmitted during search suggestions, this is a -relatively benign behavior. - - <li>Block Tor/Non-Tor access to network from file:// urls (recommended)</li> - -These settings prevent local html documents from transmitting local files to -arbitrary websites <a href="http://www.gnucitizen.org/blog/content-disposition-hacking/">under Firefox 2</a>. Since exit nodes can insert headers that -force the browser to save arbitrary pages locally (and also inject script into -arbitrary html files you save to disk via Tor), it is probably a good idea to -leave this setting on. - - <li>Close all Non-Tor/Tor windows and tabs on toggle (optional)</li> - -These two settings allow you to obtain a greater degree of assurance that -after you toggle out of Tor, the pages are really gone and can't perform any -extra network activity. Currently, there is no known way that pages can still -perform activity after toggle, but these options exist as a backup measure -just in case a flaw is discovered. They can also serve as a handy 'Boss -Button' feature for clearing all Tor browsing off your screen in a hurry. - - <li>Isolate access to history navigation to Tor state (crucial)</li> - -This setting prevents both Javascript and accidental user clicks from causing -the session history to load pages that were fetched in a different Tor state -than the current one. Since this can be used to correlate Tor and Non-Tor -activity and thus determine your IP address, it is marked as a crucial -setting. - - <li>Block History Reads during Tor (crucial)</li> - - Based on code contributed by <a href="http://www.collinjackson.com/">Collin - Jackson</a>, when enabled and Tor is enabled, this setting prevents the -rendering engine from knowing if certain links were visited. This mechanism -defeats all document-based history disclosure attacks, including CSS-only -attacks. - - <li>Block History Reads during Non-Tor (recommended)</li> - - This setting accomplishes the same but for your Non-Tor activity. - - <li>Block History Writes during Tor (recommended)</li> - - This setting prevents the rendering engine from recording visited URLs, and -also disables download manager history. Note that if you allow writing of Tor history, -it is recommended that you disable non-Tor history reads, since malicious -websites you visit without Tor can query your history for .onion sites and -other history recorded during Tor usage (such as Google queries). - - <li>Block History Writes during Non-Tor (optional)</li> - -This setting also disables recording any history information during Non-Tor -usage. - -<li>Clear History During Tor Toggle (optional)</li> - - This is an alternate setting to use instead of (or in addition to) blocking -history reads or writes. - - <li>Block Password+Form saving during Tor/Non-Tor</li> - - These options govern if the browser writes your passwords and search - submissions to disk for the given state. - - <li>Block Tor disk cache and clear all cache on Tor Toggle</li> - - Since the browser cache can be leveraged to store unique identifiers, cache -must not persist across Tor sessions. This option keeps the memory cache active -during Tor usage for performance, but blocks disk access for caching. - - <li>Block disk and memory cache during Tor</li> - - This setting entirely blocks the cache during Tor, but preserves it for -Non-Tor usage. - - <li>Clear Cookies on Tor Toggle</li> - - Fully clears all cookies on Tor toggle. - - <li>Store Non-Tor cookies in a protected jar</li> - - This option stores your persistent Non-Tor cookies in a special cookie jar - file, in case you wish to preserve some cookies. Based on code contributed - by <a href="http://www.collinjackson.com/">Collin Jackson</a>. It is - compatible with third party extensions that you use to manage your Non-Tor - cookies. Your Tor cookies will be cleared on toggle, of course. - - <li>Store both Non-Tor and Tor cookies in a protected jar (dangerous)</li> - - This option stores your persistent Tor and Non-Tor cookies - separate cookie jar files. Note that it is a bad idea to keep Tor - cookies around for any length of time, as they can be retrieved by exit - nodes that inject spoofed forms into plaintext pages you fetch. - - <li>Manage My Own Cookies (dangerous)</li> - - This setting allows you to manage your own cookies with an alternate -extension, such as <a href="https://addons.mozilla.org/firefox/addon/82">CookieCuller</a>. Note that this is particularly dangerous, -since malicious exit nodes can spoof document elements that appear to be from -sites you have preserved cookies for (and can then do things like fetch your -entire gmail inbox, even if you were not using gmail or visiting any google -pages at the time!). - - <li>Do not write Tor/Non-Tor cookies to disk</li> - - These settings prevent Firefox from writing any cookies to disk during the - corresponding Tor state. If cookie jars are enabled, those jars will - exist in memory only, and will be cleared when Firefox exits. - - <li>Disable DOM Storage during Tor usage (crucial)</li> - - Firefox has recently added the ability to store additional state and - identifiers in persistent tables, called <a - href="http://developer.mozilla.org/en/docs/DOM:Storage%22%3EDOM Storage</a>. - Obviously this can compromise your anonymity if stored content can be - fetched across Tor-state. - - <li>Clear HTTP auth sessions (recommended)</li> - - HTTP authentication credentials can be probed by exit nodes and used to both confirm that you visit a certain site that uses HTTP auth, and also impersonate you on this site. - - <li>Clear cookies on Tor/Non-Tor shutdown</li> - - These settings install a shutdown handler to clear cookies on Tor -and/or Non-Tor browser shutdown. It is independent of your Clear Private Data -settings, and does in fact clear the corresponding cookie jars. - - <li>Prevent session store from saving Tor-loaded tabs (recommended)</li> - - This option augments the session store to prevent it from writing out - Tor-loaded tabs to disk. Unfortunately, this also disables your ability to - undo closed tabs. The reason why this setting is recommended is because - after a session crash, your browser will be in an undefined Tor state, and - can potentially load a bunch of Tor tabs without Tor. The following option - is another alternative to protect against this. - - <li>On normal startup, set state to: Tor, Non-Tor, Shutdown State</li> - - This setting allows you to choose which Tor state you want the browser to - start in normally: Tor, Non-Tor, or whatever state the browser shut down in. - - <li>On crash recovery or session restored startup, restore via: Tor, Non-Tor</li> - - When Firefox crashes, the Tor state upon restart usually is completely - random, and depending on your choice for the above option, may load - a bunch of tabs in the wrong state. This setting allows you to choose - which state the crashed session should always be restored in to. - - <li>Prevent session store from saving Non-Tor/Tor-loaded tabs</li> - - These two settings allow you to control what the Firefox Session Store - writes to disk. Since the session store state is used to automatically - load websites after a crash or upgrade, it is advisable not to allow - Tor tabs to be written to disk, or they may get loaded in Non-Tor - after a crash (or the reverse, depending upon the crash recovery setting, - of course). - - <li>Set user agent during Tor usage (crucial)</li> - - User agent masking is done with the idea of making all Tor users appear -uniform. A recent Firefox 2.0.0.4 Windows build was chosen to mimic for this -string and supporting navigator.* properties, and this version will remain the -same for all TorButton versions until such time as specific incompatibility -issues are demonstrated. Uniformity of this value is obviously very important -to anonymity. Note that for this option to have full effectiveness, the user -must also allow Hook Dangerous Javascript ensure that the navigator.* -properties are reset correctly. The browser does not set some of them via the -exposed user agent override preferences. - - <li>Spoof US English Browser</li> - -This option causes Firefox to send http headers as if it were an English -browser. Useful for internationalized users. - - <li>Don't send referrer during Tor Usage</li> - -This option disables the referrer header, preventing sites from determining -where you came from to visit them. This can break some sites, however. <a -href="http://www.digg.com%22%3EDigg</a> in particular seemed to be broken by this. -A more streamlined, less intrusive version of this option should be available -eventually. In the meantime, <a -href="https://addons.mozilla.org/en-US/firefox/addon/953%22%3ERefControl</a> can -provide this functionality via a default option of <b>Forge</b>. -</ul> - - -</body> -</html> diff --git a/website/update.rdf b/website/update.rdf deleted file mode 100644 index fc876730..00000000 --- a/website/update.rdf +++ /dev/null @@ -1,173 +0,0 @@ -<?xml version="1.0"?> - -<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#" - xmlns:em="http://www.mozilla.org/2004/em-rdf#%22%3E - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}"> - em:updates - <Seq> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.1.14-alpha"/> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.1.15-alpha"/> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.1.16-alpha"/> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.1.17-alpha"/> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.1.18alpha"/> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc1"/> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc2"/> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc3"/> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc4"/> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc5"/> - <li resource="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc6"/> - </Seq> - </em:updates> - - - <!-- following two lines for Firefox 0.9. Specify the most recent version here --> - em:version1.2.0rc6</em:version> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc6.xpi</em:updateLink> - </Description> - - <!-- version 1.1.14 --> - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.1.14-alpha"> - em:version1.1.14-alpha</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.0b*</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.1.14-alpha.xpi</em:updateLink> - em:updateHashsha1:b316f9d84930ecf23b0797f93a6433334a4c38d5</em:updateHash> - </Description> - </em:targetApplication> - </Description> - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.1.15-alpha"> - em:version1.1.15-alpha</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.0b*</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.1.15-alpha.xpi</em:updateLink> - em:updateHashsha1:fa0d47c98d258ba904d828bea15b140ab438eb56</em:updateHash> - </Description> - </em:targetApplication> - </Description> - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.1.16-alpha"> - em:version1.1.16-alpha</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.0b*</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.1.16-alpha.xpi</em:updateLink> - em:updateHashsha1:f892dac7e5da8c63005f896c9aa1436e3f77ab4b</em:updateHash> - </Description> - </em:targetApplication> - </Description> - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.1.17-alpha"> - em:version1.1.17-alpha</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.0b*</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.1.17-alpha.xpi</em:updateLink> - em:updateHashsha1:93e17f955655eb31e5a6ff9f71dfde479a5b7a6d</em:updateHash> - </Description> - </em:targetApplication> - </Description> - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.1.18alpha"> - em:version1.1.18alpha</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.0b*</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.1.18alpha.xpi</em:updateLink> - em:updateHashsha1:6fdcebcb1e6cc694b45065c2b6df07ffb12ea164</em:updateHash> - </Description> - </em:targetApplication> - </Description> - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc1"> - em:version1.2.0rc1</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.1a1pre</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc1.xpi</em:updateLink> - em:updateHashsha1:8c8cb5e7e3844b8310151c5b56fb622134ea67f6</em:updateHash> - </Description> - </em:targetApplication> - </Description> - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc2"> - em:version1.2.0rc2</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.1a1pre</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc2.xpi</em:updateLink> - em:updateHashsha1:f0d6e121e2b0fbd4d1db7c3f333b8d7ab5c1d906</em:updateHash> - </Description> - </em:targetApplication> - </Description> - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc3"> - em:version1.2.0rc3</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.1a1pre</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc3.xpi</em:updateLink> - em:updateHashsha1:184294b480119bb7b943ede116345c52ee7772fc</em:updateHash> - </Description> - </em:targetApplication> - </Description> - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc4"> - em:version1.2.0rc4</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.1a1pre</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc4.xpi</em:updateLink> - em:updateHashsha1:23df6a12c7140b5817338136da1cd7737412bbbb</em:updateHash> - </Description> - </em:targetApplication> - </Description> - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc5"> - em:version1.2.0rc5</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.1a1pre</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc5.xpi</em:updateLink> - em:updateHashsha1:050925e2c02e61f2f0ceb4683600fc0c58a835bb</em:updateHash> - </Description> - </em:targetApplication> - </Description> - - <Description about="urn:mozilla:extension:{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0rc6"> - em:version1.2.0rc6</em:version> - em:targetApplication - <Description> - em:id{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - em:minVersion0.9</em:minVersion> - em:maxVersion3.1a1pre</em:maxVersion> - em:updateLinkhttps://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc6.xpi</em:updateLink> - em:updateHashsha1:7f01c577641b6222781cd880c9825d6f50ff1cc4</em:updateHash> - </Description> - </em:targetApplication> - </Description> - -</RDF>