April 2020 - tbb-dev - lists.torproject.org

Canvas Breakage Ideas
by Tom Ritter 19 May '20

19 May '20

Sanketh is tackling some fingerprinting patches; he's doing great. We ran across two questions we wanted input on. Background: Frequently sites break from the canvas permission prompt in the following way: User uploads image Website tries to display image back to user Image is white because it rendered the image to a canvas then tries to read the canvas data Examples: https://bugzilla.mozilla.org/show_bug.cgi?id=1631673 https://bugzilla.mozilla.org/show_bug.cgi?id=1456378 https://bugzilla.mozilla.org/show_bug.cgi?id=1573834 1) Sanketh had the idea of after granting permission, we show an additional prompt suggesting the user reload the page; since websites are not built to handle our 'well just try it again, it'l work this time' change to canvas APIs. Thoughts? 2) In https://bugzilla.mozilla.org/show_bug.cgi?id=1631673 Gijs had the idea of changing our behavior if the user has uploaded a file, and using this as a queue to automatically allow canvas extraction. Specifically he focused on allowing the website to read out the file the user has just uploaded; and that only. That would be ideal, but -with no testing and just hypothesizing - I doubt it would work because some as simple as e.g resizing the image would cause the match to fail and be dis-allowed. But we could test this. My idea was much simpler: if the user has uploaded a file, we take that as a queue they trust the service; and then grant the canvas permission prompt. (In as tightly as scoped a manner as possible, but the scoping is really just a bandaid over the problem....) Sanketh and Simon pointed out that this is dangerous: just because a user uploaded a file doesn't mean they consented to be fingerprinted. And they're right; if a user is trying to have an anonymous account or something similar, uploading a file is not a trusted relationship permitting fingerprinting. So the question then is, it seems like given Tor's strict stance, the only way this could be implemented was if the data read from the canvas was an exact match on the uploaded data. Is that accurate? If so, the next step would be to test these websites, because if they don't behave that way it's probably not worth implementing this at all. -tom

4 5

Problems auto-installing extensions for new user profiles
by Thomas Klausner 30 Apr '20

30 Apr '20

Hi! I'm trying to improve the default behavior for the tor-browser package in pkgsrc. For this reason, I want to install the noscript and https-everywhere extensions by default for new users, but leave the users the option to update them if they want; the sysadmin probably will be slower than the users. So following a stackoverflow post I found (https://stackoverflow.com/questions/37728865/install-webextensions-on-firef…) I made packages that install the xpi files for noscript and https-everywhere below ${MAINDIR}/distribution/extensions/, like this: -rw-r--r-- 1 root wheel 3076882 Apr 21 21:37 /usr/pkg/lib/tor-browser/distribution/extensions/https-everywhere(a)eff.org.xpi -rw-r--r-- 1 root wheel 582656 Apr 21 21:37 /usr/pkg/lib/tor-browser/distribution/extensions/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi I got the final names under which to install them from a tor-browser user profile into which I installed them manually. When I start tor-browser without a profile, I see that the noscript xpi was copied automatically, but the https-everywhere one was not. I.e., ${PROFILEDIR}/extensions/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi exists but https-everywhere(a)eff.org.xpi is not there. I see the same in about:addons - NoScript is listed, but HTTPS Everywhere is not. Any ideas what I might be doing wrong, or how to find out for sure? Thanks, Thomas (please cc, not subscribed)

1 1

A proposal for signing commits with gpg
by Nicolas Vigier 29 Apr '20

29 Apr '20

Hi, Attached is a proposal for signing commits with gpg. I also added it to this branch (using number 104, although this number can still change before merging): https://gitweb.torproject.org/user/boklm/tor-browser-spec.git/commit/?h=bug… Nicolas

4 9

Re: [tbb-dev] [tbb-commits] How to update tor browser from CMD in Windows 10?
by Georg Koppen 06 Apr '20

06 Apr '20

Keifer Bly: > Hello all, > > I am wondering, is there a way to automatically update tor browser bundle from > the CMD in Windows 10? I am trying to do this to automatically update tor > browser when Windows starts. Thank you. There is no automated way the Tor Browser provides. If you want to use Tor Browser's update mechanism you need to run it. That said I can imagine you could write a script that checks for new Tor Browser versions during Windows start up, downloads them if available and extracts and overwrite the necessary parts if so. I am not aware of such a script, though. (Cc'ing tbb-dev which is a better list than tbb-commits) Georg

1 0

Fast-Forward Tor Browser version numbers
by Matthew Finkel 03 Apr '20

03 Apr '20

Hi everyone, While I'm thinking about this, I opened a ticket for changing the Tor Browser versioning scheme. https://trac.torproject.org/projects/tor/ticket/33809 =================================================== Let's say in the future Tor Browser is based on Firefox 90.0, Tor Browser Beta is based on Firefox 91.0b1, and Tor Browser Nightly is based on 92.0a1. I propose Tor Browser uses the following versioning schemes: Release: ${FF_MAJOR}.${FF_MINOR}.${PATCH} (e.g. 90.0.1) Beta: ${FF_MAJOR}.${FF_MINOR}b${PATCH} (e.g. 91.0b101) Nightly: ${FF_MAJOR}.${FF_MINOR}a1 (i.e. 92.0a1) Where ${PATCH} is (${FF_PATCH}*100) + ${TB_PATCH}), therefore we move the Firefox patch number into the third digit (hundreds) and we place the Tor Browser patch number in the first and second digits. (Initially, I began proposing (${FF_PATCH}*10), but what-if-we-need-11-releases?). That would be a sad month, but probably safe-than-sorry. I think we can re-use Firefox's alpha/nightly version number. The main advantage of this scheme is that the underlying Firefox version is immediately clear when looking at a Tor Browser version number. =================================================== We can use this thread for discussing alternatives. Thanks, Matt

1 0