- tbb-dev - lists.torproject.org

NTLM authentication (was: [tor-qa] Testing ESR 31 based Nightlies)
by Lunar 02 Oct '14

02 Oct '14

[switching list to the more appropriate tbb-dev] Mike Perry: > > I still can't do NTLM authentication, despite > > `network.negotiate-auth.allow-insecure-ntlm-v1-https` being set to > > `true`. That's a bit annoying. > > Are there actually public sites that use NTLM? I thought NTLM was mostly > an enterprise LAN thing, which we were unlikely to encounter via Tor and > the public Internet. Is this something you have noticed, or is this > becoming a common support question? It's used by SharePoint and IIS intranets. One being one I need to invoice the Tor Project. :D I could keep a copy of Tor Browser 3.6.4 around just for that, but I'd rather see the issue fixed. I fear this is not going to be a common support question, but it might bite other people, eventually. See: https://bugzilla.mozilla.org/show_bug.cgi?id=828183#c46 > We disabled it because the NTLM protocol can leak username, hostname, > perform non-Tor DNS lookups, etc. It's also very hard to control all of > this, because many auth mechanisms are implemented by the underlying OS > and not by Firefox, and if you lump in SPNEGO, there's a ton of crazy > shit that can happen. *sigh* At least NTLMv1 is implemented by Firefox on OS X and Linux, from what I understood in the previously mentioned bug report. From <http://www.janbambas.cz/ntlm-v1-and-firefox/>, I understand that setting `network.auth.force-generic-ntlm` would make it the case on Windows as well. -- Lunar <lunar(a)torproject.org>

1 0

Reproducibility of incremental MAR files
by Nicolas Vigier 29 Sep '14

29 Sep '14

During the IRC meeting last week, we discussed about the best place to generate the incremental MAR files, and because we want them to be reproducible, gitian looked like the right place to do it. In order to see how easy it is to reproduce incremental MAR files, I decided to generate an incremental MAR on two different Linux distributions between tor-browser-linux32-4.0-alpha-2_fr.mar and tor-browser-linux32-4.0-alpha-3_fr.mar. And the result was that without doing anything special, the MAR file that was created was identical on both hosts. So it seems that using gitian is not needed in order to be able to reproduce those incremental MAR files.

1 0

ESR31 and Tor Browser 4.x
by intrigeri 23 Sep '14

23 Sep '14

Hi, is it the plan that the first Tor Browser release using ESR31 (mid-October) will be based on the Tor Browser 4.x branch, or are two efforts mostly independent from each other? Cheers, -- intrigeri

2 1

Notes from the help desk
by Matt Pagan 23 Sep '14

23 Sep '14

Hi browser devs, Apologies for missing the IRC meeting today. Some news from this past week: There's been an increase in the number of users who have trouble using Tor Browser with a VPN. In news that may or may not be related, the new silk road apparently has some instructions on their site telling users that they should use Tor from behind a VPN. So far none of the VPN users I've spoken too have provided me their Tor logs. Hopefully someone will soon. It's great that more and more YouTube videos are available in HTML5 format nowadays. However, demand for Flash in Tor Browser is still quite strong. BBC and Grooveshark are two popular sites Tor users wish they could enjoy while using Tor Browser. Another popular help desk request is for general tips on staying safe on the web. I usually direct these folks to https://www.torproject.org/download/download-easy.html.en#warning All the best, Matt Pagan

1 0

Tor Browser self-updater vs. sandboxing
by intrigeri 22 Sep '14

22 Sep '14

Hi, while discussing opportunities for increased cooperation between Tails and Freepto [1] recently, I've mentioned the upcoming Tor Browser's self-updater, and one of the Freepto developers rightly noted that there may be a fundamental incompatibility between this updater, and the desire to confine the browser in a sandbox. Indeed, it seems quite clear to me that one of the important tasks such a sandbox should fulfill would be... to avoid the confined program from modifying itself. It seems that supporting such sandboxes is part of your plans ([2], [3]), so I'm curious: what's the TBB team's take on this problem? [1] http://www.freepto.mx/ [2] https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorP [3] https://trac.torproject.org/projects/tor/ticket/5791 Cheers, -- intrigeri

2 2

Is JS monkey patching viable as a fingerprinting countermeasure?
by Arthur D. Edelstein 22 Sep '14

22 Sep '14

Hi All, I'm wondering about the history of JS fingerprinting mitigation in Tor Browser. What prompted the change of approach from JavaScript hooks to C++ patches? I had read something about a race condition discovered, but I haven't found more details. I've been thinking about the idea of developing a C++ patch for Tor Browser (and Firefox) that allows extensions to securely replace arbitrary members (functions and properties) of the global window object at runtime, before content is loaded. By "secure" I mean that, by design, there would be no workaround for content scripts to access the original window object members. (Maybe this capability already exists -- I don't know.) The advantages of this monkey patching approach over addressing fingerprinting vulnerabilities with C++ patches is (1) it would (I think) simplify fingerprinting countermeasures, and (2) it would reduce the number of Firefox C++ patches that Mozilla needs to accept. Is this idea worth pursuing further? Thanks, Arthur

3 4

64 bit Mac Builds?
by Tom Ritter 17 Sep '14

17 Sep '14

Hi all, I _think_ I've managed to build a 64-bit version of Tor Browser for Mac OS. Specifically, I built the entire bundle, but only TorBrowser was modified to be 64bit. The changes I made are here: https://github.com/tomrittervg/tor-browser/commit/79fbe1e3ffde1ac3577a9937a… (ignore the last couple lines commenting out some options I had added, then removed). The bundles are here: https://ritter.vg/misc/transient/2014-09-02-4.x-1-build1-tjr5/ It would be fantastic if anyone could test the bundles and/or the patch and determine if a) you agree it's 64 bit b) it works c) anyone else can reproduce a 64 bit build (I'm not going for full reproducibility right now, just a successfull build that is 64 bit) -tom

4 6

Tor Browser Tickets for September/FF31ESR (with volunteer tickets!)
by Mike Perry 02 Sep '14

02 Sep '14

Hey everyone, I finished updating our ticket tags for September. As I said in the IRC meeting today, I think we should be focusing our efforts on FF31ESR-related items this month. As a result, I've pushed out non-FF31ESR tickets into the October tag, but if you run out of FF31ESR items or just end up blocked, waiting for builds, and/or unable to make progress on anything FF31-related, feel free to work on your tickets from October (or anything else that comes up). Here's the link again: https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~Tor… If you're a volunteer, or you're just looking for something simple, I also tagged a few tickets that basically involve writing some content window JS or very simple patches: https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~Tor… For reference, here's the current October tickets: https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~Tor… Also for reference, here's the roadmap for the rest of the SponsorP work due Oct 31st (note that we've slipped on some items already, but right now getting FF31 working+released is more important than playing catchup on the roadmap): https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorP It would also be helpful if you could ensure that stuff you would like to work on this month is assigned to you instead of tbb-team or someone else. Feel free to reassign as necessary, especially so we can avoid duplicate work and ensure everything gets done. Also feel free to state that you may need some help from others, especially if you notice that you end up with a lot of tickets assigned to yourself :). -- Mike Perry

1 0

Alpha versions string
by Nicolas Vigier 01 Sep '14

01 Sep '14

Hello, The latest tbb alpha version is tagged on git as 'tbb-4.0a2-build1'. The testsuite scripts use the git tags to find the latest versions available that need testing, and will extract the version number from the tag as '4.0a2'. However, it is available on people.tpo in the directory '4.0-alpha-2', so the scripts won't be able to find it automatically (unless I add some code to do the translation 'a' -> '-alpha-', if this difference is wanted). Is there some reason for using a different version string in the git tag and the directory name, or could this be changed for the next alpha release ? Nicolas

1 0

TBB and h.264 default configuration
by La Colectividad 07 Aug '14

07 Aug '14

Hi folks, I have a simple question: why is that TBB has by default the option media.gstreamer as "false"? (At least in Linux). I need to have it "enabled" in order to watch videos on, say, Vimeo (which requires h.264). I know how to do this from about:config, but this makes me wonder whether it is safe to enable it and surf the web with TBB (I guess this is my real question). Thanks a lot. Best, Col.

1 0