- tbb-dev - lists.torproject.org

Next weekly Tor Browser meeting on 4/23 1730 UTC in #tor-meeting2
by Georg Koppen 08 Apr '19

08 Apr '19

Hi everyone! Easter is close, so some folks are taking time off/are on vacation. Thus, we won't have a meeting next Monday and, as 4/22 is a holiday in a bunch of jurisdictions, we won't have a meeting on that day either. We therefore decided to have our next weekly meeting on 4/23 1730 UTC in #tor-meeting2. So, place and time stay the same, it's just a Tuesday this time to update each other on what we are working on. See you there, Georg

1 0

Upcoming weekly meeting time change: from next week on 17:30 UTC
by Georg Koppen 26 Mar '19

26 Mar '19

Hi everyone! We'll switch our weekly meeting time to 17:30 UTC starting from April 1st (after the weekend where the EU is doing the daylight saving time thing, too). The location, #tor-meeting2 on the OFTC IRC network, is unchanged, though. See you there, Georg

1 0

Tor Browser 8.x and Letterboxing
by Georg Koppen 21 Mar '19

21 Mar '19

Hello! tjr asked during our last meeting whether we would consider testing Letterboxing[1] in Tor Browser even if it still were on ESR60. Here are a bunch of questions he had and we can think about in this thread: Q: If it was ready in a 60-based Alpha would you ship it then or would you want to wait until 68? I think we could easily test it in 9.x alphas being still on ESR60. This might in fact be a good idea as we got quite some pushback last time when we tried to fix #14429 (which, admittedly, has been a couple if years ago). One thing to worry about is how complicated the backport would be. If not really that problematic, then bonus points for that plan from my side at least. Q: What is the minimal viable product user experience wise? Q: Does the margin needed different color or watermark? I don't think so. Q: Do you need a button to disable it globally or after an individual resize? I'd be fine with a preference being exposed. Q: Do you need it to work on mobile? No. Q: For very low resolution - under 100 pixels in a dimension - does it need to do something intelligent or just not do any margins at all? I am not sure I understand the question, could you elaborate? Q: Does it need a user walkthrough explainer? (Probably I think... maybe you can start thinking of how that would look?) I think that sounds like a good idea. It could be another example for the general task of how to introduce new features (tracked in #29768). One idea could be that we want to have different strategies depending on how invasive a feature is: there might be features that are okay getting introduced with our onboarding and others that might need a different treatment. There are probably cons to this idea, though, like we would start training users to look at different places for getting to know whether there are new features or not. But on the other hand, we probably don't want to put everything into the onboarding either... Georg [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1407366

2 2

CAPTCHA in TBB vs Tails
by airtel＠cock.li 20 Mar '19

20 Mar '19

Hi I have noticed this behavior for some time already. If I boot into a Live Linux, download TBB and use Google, I will encounter reCAPTCHA for c.89% of the time. If I boot into Live Tails, use the installed TBB, I have yet to encounter any reCAPTCHA for Google Search. Anyone has the same issue, as the former reCAPTCHA requires ~10-15 puzzles to solve for each visit? -- Sunil

1 0

A proposal for verifying http downloads
by Tom Ritter 14 Mar '19

14 Mar '19

Third of three. This one is definitely the least fleshed out. The short version is verify most types of files downloaded over a potentially insecure connection. -tom

1 1

A proposal for stopping users from copying potentially-edited cryptocurrency addresses
by Tom Ritter 14 Mar '19

14 Mar '19

The second of three proposals. This one basically stops the user from copying a cryptocurrency address to the clipboard if the address was delivered in a way the exit node could have tempered with it. -tom

1 1

Firefox/NoScript bug with major downstream effects
by Erik Moeller 11 Mar '19

11 Mar '19

Dear TBB developers, I wanted to make sure you've seen this issue regarding uploads and NoScript's "Sanitize cross-site suspicious requests" option: https://bugzilla.mozilla.org/show_bug.cgi?id=1532530 https://github.com/hackademix/noscript/issues/64 https://github.com/freedomofpress/securedrop/issues/4078 https://github.com/micahflee/onionshare/issues/899 As far as we've been able to tell, this option, which is enabled by default and intended to guard against XSS attacks, is causing large uploads in non-JS upload forms to break intermittently. This may ultimately be due to a bug in Firefox itself (the first link). The only reason the SecureDrop and OnionShare issues are closed is that we've implemented ugly workaround instructions for now, and NoScript considers it an upstream issue in Firefox. Since this impacts Tor browser users much more than Firefox users, perhaps some folks on this list may be able to help bring this to a resolution. In any case, I wanted to flag it to this group given the impact his issue is having. Warmly, Erik -- Principal Project Manager Freedom of the Press Foundation

2 5

A Proposal for Double-Checking self-signed certificates
by Tom Ritter 07 Mar '19

07 Mar '19

Attached is one of three user safety proposals I'm trying to write. This one in particular deals with self-signed and similar certificate errors, and basically double checks the cert over a new circuit. If they match, the user can bypass the certificate error page. If they don't, they can't bypass it. -tom

1 0

Off-topic: Dev Meeting July 2019 - Who should the Browser Team invite?
by Pili Guerra 27 Feb '19

27 Feb '19

Hi everyone, Apologies for the slightly off-topic post. We’re brainstorming who we want to join us at the Dev meeting to be held in Stockholm from the 11th - 15th July 2019 and we’d like your help. Can you please send me your suggestions by the end of next week (Friday 8th March)? Please reply to me directly instead of replying to the list :) Thanks! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0

Next weekly Tor Browser meeting on 2/25 1830 UTC in #tor-meeting2
by Georg Koppen 15 Feb '19

15 Feb '19

Hi all! We'll skip the weekly Tor Browser meeting next week and will meet again on February 25 at 1830 UTC in #tor-meeting2 on the OFTC IRC network. See you there, Georg

2 1