April 2015 - tbb-dev - lists.torproject.org

FWD: privacy/security guidance docs for W3C groups
by mikeperry＠torproject.org 11 May '15

11 May '15

Yan was kind enough to send this to me as a heads up. We both agreed that the Security & Privacy questionnaire needs a Threat Model for Third Party Tracking, so that it is easier to build a single option for controlling third party tracking identifiers, like we did with our 'privacy.thirdparty.isolate' option. She suggested that we should create an issue for this at https://github.com/mikewest/spec-questionnaire/issues, describing how Tor Browser deals with this threat model, and what we would like to see in terms of how API designers should address it. Are there any other issues or suggestions we should make there, in either that document, or the fingerprinting guidance draft? ----- Forwarded message from Yan Zhu <yzhu(a)yahoo-inc.com> ----- Date: Thu, 19 Mar 2015 16:06:27 +0000 (UTC) From: Yan Zhu <yzhu(a)yahoo-inc.com> Subject: privacy/security guidance docs for W3C groups Hi technologist-ish people, The W3C has been working on some privacy and security guides for working groups to consider when writing new specs. As you probably know, it has historically been easy for new specifications to accidentally (or intentionally) introduce web tracking methods and increase browser security surface. We are trying to take steps towards preventing this by encouraging/forcing working groups to do a security/privacy self-review of specs in the future. I'd be curious to hear your feedback on the following two guides if you have any: * https://mikewest.github.io/spec-questionnaire/security-privacy/ - a general collection of security/privacy questions that groups should ask about new specs * https://w3c.github.io/fingerprinting-guidance/ - a guide to mitigating fingerprinting. I'm thinking the "Best Practices Section" could get merged into the questionnaire above. Thanks,Yan ----- End forwarded message ----- -- Mike Perry

3 3

Rationale behind the move to Disconnect Search?
by intrigeri 04 May '15

04 May '15

Hi, we're in the process of upgrading Tor Browser to 4.5 in Tails, and I noticed the migration to Disconnect Search as the default search engine. That's the kind of changes that we often have to justify in face of users and auditors, but I wasn't able to find the rationale behind this decision on the corresponding ticket [1]. I see the release announcement [2] says: > Disconnect provides private Google search results to Tor users > without Captchas or bans. And below, Georg commented: > Startpage was not happy with our traffic and showed sometimes > CAPTCHAs. Disconnect on the other hand approached us with respect to > search engine traffic and donated some money. So, just to clarify: is that the entire rationale behind this move? [1] https://trac.torproject.org/projects/tor/ticket/14490 [2] https://blog.torproject.org/blog/tor-browser-45-released Cheers, -- intrigeri

2 2

automatic updates for add-ons in Tor Browser
by sajolida 06 Apr '15

06 Apr '15

Hi, I'm part of the people working on Tails and I have a doubt about Tor Browser that I couldn't solve by reading your design document. Are automatic updates performed on additional extensions that the user might install in Tor Browser? The design document only mentions that "addon updates" are proxied as well which might mean that they still happen but it's not explicit. According to Giorgio Maone, a regular Firefox checks for updates of the extensions once per day but we were not sure whether Tor Browser prevents this for some reason. -- sajolida

2 2

Chrome Document on Client Identification
by Tom Ritter 06 Apr '15

06 Apr '15

Via my friend Aaron, Google at some point published the below document on client fingerprinting. Somewhat similar to the TBB Design Document. https://www.chromium.org/Home/chromium-security/client-identification-mecha… -tom

3 2

Tor Browser meeting next Monday?
by Georg Koppen 05 Apr '15

05 Apr '15

Hi, this is something I forgot to bring up at our last meeting but at least here (and I know in a bunch of other countries) next Monday is holiday. Although I'll probably work on that day I won't be able to attend the meeting. I am fine if the meeting is happening without me but if that would affect more of the team it might be better to reschedule it. Opinions? Georg

4 4

Localized search plugins for the Tor Browser in Tails
by anonym 01 Apr '15

01 Apr '15

Hi, In Tails we use the same Tor Browser installation for all locales, and put some localized search plugins into `distribution/searchplugins/locale`. However, those search plugins are not used. Instead of repeating myself, I'm gonna point you to our ticket about this: https://labs.riseup.net/code/issues/9146 So, do you have any idea why the Tor Browser is ignoring our localized search plugins? Any pointers on where to look further when debugging this? Feel free to comment either on the ticket, or in this thread if it suites you better. Cheers!

1 0