August 2020 - tbb-dev - lists.torproject.org

Re: [tbb-dev] Canvas Breakage Ideas
by Alex Catarineu 21 Sep '20

21 Sep '20

On 5/19/20 6:02 AM, Matthew Finkel wrote: > On Wed, Apr 29, 2020 at 01:07:40PM +0200, Alex Catarineu wrote: >> With respect to 2), I think it's interesting, but I also don't know whether >> it's feasible in practice. Specifically, I was thinking of Gijs idea of >> trying to keep state about whether the canvas is safe to read or not, >> fingerprinting-wise. I assume that there is a (non-empty) subset of canvas >> write operations that are "fingerprinting-safe". … [View More]Probably a bit naively, I'd >> like to think that `canvas.drawImage` is "fp-safe" (irrespective of the >> image source). But even if we have to check the image source, I think >> implementing this could potentially unbreak some of these common legit >> canvas use cases. >> >> For example, in the WhatsApp case mentioned above, I'm quite sure it's >> just used for image format conversion, since the bug does not occur >> when uploading "jpeg" images. So, that would be something like >> `canvas.drawImage(pngImage, 0, 0);` plus `canvas.toDataURL('image/jpeg');`, >> which should be covered if we implement the `canvas.drawImage` exemption >> when the image was uploaded by the user. This "fingerprinting-tainting" >> canvas logic might start with just the `drawImage` case, but perhaps it >> would be possible to extend little by little, if we know that some >> canvas write operation is safe and can help fixing breakage for legit >> use cases. > > I generally agree with your message, but I am curious about this idea. > Are you saying that ctx.drawImage() is fingerprinting-safe, or are you > saying that any "canvas extraction" from a canvas element initialized by > ctx.drawImage is fingerprinting-safe? As far as I'm aware, drawImage() > is not protected by the Canvas prompt (so that should never be a > problem). If your comment was about "subsequent canvas extraction", then > that is worth investigating. Yes, by fingerprinting-safe I meant the subsequent canvas extraction after a `drawImage`. And by checking the image source I meant that we might consider a `drawImage` fp-safe if we know the input is an image uploaded by the user, even if `drawImage` was not "fingerprinting-safe" in general (with the idea that canvas extraction might not result in useful fingerprinting in that case). > Are any of the conversions passed onto the > GPU? Do we know if format conversation is deterministic? True, I did not consider that the extraction (e.g. `toDataURL('image/jpeg')`) might add some entropy by itself. Good questions, we would need to investigate if this approach is going to be pursued. And I agree with tom, it would be good first to investigate what these sites are doing exactly with the canvas to evaluate what would be the best approach. [View Less]

5 10

Release schedule for the Tor Browser alphas?
by anonym 27 Aug '20

27 Aug '20

Hi, I'm in the process of scheduling a release candidate for Tails 4.11 and I'd like it to include the latest possible Tor Browser 10 alpha, so I'm interested in what your plans are for the coming weeks (especially around September 7-11, which likely is when we have to release this release candidate). Do you have any dates set yet? Guesses? Is there a (public) schedule I can look at somewhere so I don't have to ask you in the future? :) Otherwise, do you think we'll miss out on anything … [View More]

2 2

Deriving identity public key from
by Konstantin Y. Rybakov 23 Aug '20

23 Aug '20

Dear developers, How can I derive an identity public key given onion secret key in form of: |ED25519-V3:UJL1wgWVeMz9f7oM+Xrbq0i8tJ2/aeBi3K0cl8VCrlicSts8Gg98agO5DUXHjsfQb+yooLgN0CB0Y0A9U0rMUQ==| ? I assume that a secret key is 64 bytes long, and identity public key is last 32 bytes of decoded private key. So, my algorithm is as follows: |base64Decode(privatekey) //without ED25519-V3: part ||slice resulting buffer in half ||base32Encode(second half of the buffer)| As a result I expect … [View More]

1 0

Nightly builds based on Firefox 78 ESR and beyond
by Georg Koppen 19 Aug '20

19 Aug '20

Hello! Some of you might have seen that our Tor Browser nightly builds for desktop switched to Firefox 78 ESR recently. We've been waiting with a more or less official announcement until we got our nightly setup into a more stable shape, but believe now is a good time to call for wider testing. If you already were on the nightly channel before reading this mail you have likely already got an update to Tor Browser using ESR 78[1], but alas only one, due to a bug we overlooked[2]. So, the … [View More]

3 4

langpacks tarball vs alpha/nightly builds
by anonym 19 Aug '20

19 Aug '20

Hi, list! [I'd prefer to do this over Gitlab MR, but my request for an account hasn't been accepted yet. So email it is.] Back when intrigeri added the generation of a tarball containing all langpacks it was decided to not do so for nightly and alpha builds, and to revisit if we decided we wanted it for those builds too: https://trac.torproject.org/projects/tor/ticket/32676#comment:6 Now I'd like to revisit that decision! Let's first note that Firefox' translation system is pretty … [View More]

2 3

request from a reporter
by isabela 06 Aug '20

06 Aug '20

Hello TBB dev list :) we got an email from a reporter asking how TB protects the user against a series of tracking mechanisms. I was hoping I could 'crowdsource' the answer and use your help with it, here is the email: https://pad.riseup.net/p/t2_CyOhC_G3FiCvRXugx Thank you in advance! cheers, isabela -- Isabela Bagueros Executive Director The Tor Project https://www.torproject.org http://expyuzz4wqqyqhjn.onion/

2 2

Adding defenses against keystroke and mouse stylometry into TBB
by joel04g_t535e＠secmail.pro 03 Aug '20

03 Aug '20

Does Tor browser have any defenses against mouse and keystroke stylometry, if not could some be implemented? It can be as simple as adding an add-on that you can turn on or off. I think this would add extra protection against invasive websites who attempt to identify users. Users could also disable this if the website isn't working or requires a captcha which thinks they are a bot. -Joel

2 1