December 2013 - tor-commits - lists.torproject.org

[goptlib/master] Also need AuthCookie to do ExtOrPort.
by dcf＠torproject.org 11 Dec '13

11 Dec '13

commit f27f30f16d6f8ac0b566a09c5c63c3f899569a14 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Dec 10 23:32:20 2013 -0800 Also need AuthCookie to do ExtOrPort. --- pt.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pt.go b/pt.go index 9ac14e5..3478905 100644 --- a/pt.go +++ b/pt.go @@ -773,7 +773,7 @@ func extOrPortSetup(s io.ReadWriter, addr net.Addr, methodName string) error { // authentication à la 217-ext-orport-auth.txt is done before returning; an // error is returned if authentication fails. func DialOr(info *ServerInfo, addr net.Addr, methodName string) (net.Conn, error) { - if info.ExtendedOrAddr == nil { + if info.ExtendedOrAddr == nil || info.AuthCookie == nil { return net.DialTCP("tcp", nil, info.OrAddr) }

1 0

[goptlib/master] Extended ORPort is in proposal 196, not pt-spec.txt.
by dcf＠torproject.org 11 Dec '13

11 Dec '13

commit 683a1e9754037c42955602871032cdce40cea8d0 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Dec 10 22:05:16 2013 -0800 Extended ORPort is in proposal 196, not pt-spec.txt. --- pt.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pt.go b/pt.go index ec2407f..02cc2c6 100644 --- a/pt.go +++ b/pt.go @@ -95,6 +95,9 @@ // Tor pluggable transports specification: // https://gitweb.torproject.org/torspec.git/blob/HEAD:/pt-spec.txt. // +// Extended ORPort: +// https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/196-transpor…. +// // Extended ORPort Authentication: // https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/217-ext-orpo…. //

1 0

r26468: {website} make the "other donation options" look like a link. (website/trunk/css)
by Andrew Lewman 11 Dec '13

11 Dec '13

Author: phobos Date: 2013-12-11 05:52:12 +0000 (Wed, 11 Dec 2013) New Revision: 26468 Modified: website/trunk/css/layout.css Log: make the "other donation options" look like a link. Modified: website/trunk/css/layout.css =================================================================== --- website/trunk/css/layout.css 2013-12-11 04:51:27 UTC (rev 26467) +++ website/trunk/css/layout.css 2013-12-11 05:52:12 UTC (rev 26468) @@ -1287,5 +1287,4 @@ font-weight: bold; } .dbox.dl select{ -width: 70px; --webkit-appearance: none;-moz-appearance: none;outline-inset:1px;} +width: 70px;outline-inset:1px;}

1 0

r26467: {website} more fixes to the layout css (website/trunk/css)
by Andrew Lewman 11 Dec '13

11 Dec '13

Author: phobos Date: 2013-12-11 04:51:27 +0000 (Wed, 11 Dec 2013) New Revision: 26467 Modified: website/trunk/css/layout.css Log: more fixes to the layout css Modified: website/trunk/css/layout.css =================================================================== --- website/trunk/css/layout.css 2013-12-10 21:46:42 UTC (rev 26466) +++ website/trunk/css/layout.css 2013-12-11 04:51:27 UTC (rev 26467) @@ -1047,7 +1047,7 @@ .dbox input.donate-btn { background: url(../images/btn_donateCC_LG.gif) left top no-repeat transparent; height: 26px; - width: 122px; + width: 150px; margin-top: 0px; display: block; background-color: transparent; @@ -1282,7 +1282,10 @@ } /* End hide from IE-mac */ -.dbox.dl p:last-child a{color:#000; text-decoration:none;} +.dbox.dl p:last-child a{color: #785688; +text-decoration: underline; +font-weight: bold; +} .dbox.dl select{ width: 70px; -webkit-appearance: none;-moz-appearance: none;outline-inset:1px;}

1 0

[tor-browser-bundle/master] Update changelog for Torbutton and Tor Launcher fixups.
by mikeperry＠torproject.org 11 Dec '13

11 Dec '13

commit f2c20ad417865f6e68b60f79b8475c9d4bfb2f6c Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Dec 10 20:01:55 2013 -0800 Update changelog for Torbutton and Tor Launcher fixups. --- Bundle-Data/Docs/ChangeLog.txt | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index c359de1..ad1ad0f 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,15 +1,17 @@ -Tor Browser Bundle 3.5rc1 -- Dec 9 2013 +Tor Browser Bundle 3.5rc1 -- Dec 11 2013 * All Platforms * Update Firefox to 24.2.0esr * Update NoScript to 2.6.8.7 * Update HTTPS-Everywhere to 3.4.4tbb (special TBB tag) * Tag includes a patch to handle enabling/disabling Mixed Content Blocking * Misc: Disable HTTPS-Everywhere first-run tooltips - * Update Tor Launcher to 0.2.4 + * Update Tor Launcher to 0.2.4.1 + * Bug 10147: Adblock Plus interferes w/Tor Launcher dialog * Bug 10201: FF ESR 24 hangs during exit on Mac OS * Bug 9984: Support running Tor Launcher from InstantBird * Misc: Support browser directory location API changes in Firefox 24 - * Update Torbutton to 1.6.5 + * Update Torbutton to 1.6.5.1 + * Bug 10352: Clear FF24 Private Browsing Mode data during New Identity * Bug 8167: Update cache isolation for FF24 API changes * Bug 10201: FF ESR 24 hangs during exit on Mac OS * Bug 10078: Properly clear crypto tokens during New Identity on FF24

1 0

[tor-browser-bundle/master] Name Linus's gpg key properly.
by mikeperry＠torproject.org 11 Dec '13

11 Dec '13

commit 40c778c9a3a31b42d1f7e3a6ce3be3a90a5d241c Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Dec 10 20:04:50 2013 -0800 Name Linus's gpg key properly. --- gitian/gpg/linus.gpg | Bin 0 -> 61902 bytes gitian/gpg/ln5.gpg | Bin 61902 -> 0 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/linus.gpg b/gitian/gpg/linus.gpg new file mode 100644 index 0000000..66a2f68 Binary files /dev/null and b/gitian/gpg/linus.gpg differ diff --git a/gitian/gpg/ln5.gpg b/gitian/gpg/ln5.gpg deleted file mode 100644 index 66a2f68..0000000 Binary files a/gitian/gpg/ln5.gpg and /dev/null differ

1 0

[tor-browser-bundle/master] Bump Torbutton version for New Identity fix.
by mikeperry＠torproject.org 11 Dec '13

11 Dec '13

commit bc9239652ea8cecf0ed93cdd31f015da06a2165d Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Dec 10 20:05:03 2013 -0800 Bump Torbutton version for New Identity fix. --- gitian/versions.alpha | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 9789f04..845e811 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -7,7 +7,7 @@ TORBROWSER_TAG=tor-browser-24.2.0esr-3.5rc1-build2 TOR_TAG=tor-0.2.4.18-rc OPENSSL_TAG=openssl-101e-no-gmt-time-v1 TORLAUNCHER_TAG=0.2.4.1 -TORBUTTON_TAG=1.6.5 +TORBUTTON_TAG=1.6.5.1 HTTPSE_TAG=3.4.4tbb NSIS_TAG=v0.1 ZLIB_TAG=v1.2.8

1 0

[torbutton/master] Bug 10352: Clear Private Browsing Mode data during New Identity
by mikeperry＠torproject.org 11 Dec '13

11 Dec '13

commit 06f74292f7e0e886f1d1fdde1307e9f54d3e9bf9 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Dec 10 19:56:20 2013 -0800 Bug 10352: Clear Private Browsing Mode data during New Identity Needed on FF24. The current cache, cookie and DOM Storage APIs do not otherwise clear private browsing mode data. --- src/chrome/content/torbutton.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 3b76595..b870048 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -1593,6 +1593,9 @@ function torbutton_do_new_identity() { } } + torbutton_log(3, "Ending any remaining private browsing sessions."); + obsSvc.notifyObservers(null, "last-pb-context-exited", ""); + torbutton_log(3, "New Identity: Opening a new browser window"); // Open a new window with the TBB check homepage

1 0

[torbutton/master] Update changelog and version for 1.6.5.1.
by mikeperry＠torproject.org 11 Dec '13

11 Dec '13

commit 05e78c9063f10ab08ed9e46273984035dc631bb6 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Dec 10 19:58:11 2013 -0800 Update changelog and version for 1.6.5.1. --- src/CHANGELOG | 4 ++++ src/install.rdf | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 4028ca3..befcf4f 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,7 @@ +1.6.5.1: + 10 Dec 2013 + * Bug 10352: Clear FF24 Private Browsing Mode data during New Identity + 1.6.5: 9 Dec 2013 * Bug 8167: Update cache isolation to use getFirstPartyURIFromChannel() for FF24 diff --git a/src/install.rdf b/src/install.rdf index 4423fca..89163bb 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.6.5</em:version> + <em:version>1.6.5.1</em:version> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0

r26466: {website} Cleanup; added FAQ entries. (in website/trunk: docs/en download/en)
by Matt Pagan 10 Dec '13

10 Dec '13

Author: mttp Date: 2013-12-10 21:46:42 +0000 (Tue, 10 Dec 2013) New Revision: 26466 Modified: website/trunk/docs/en/faq.wml website/trunk/download/en/download-easy.wml website/trunk/download/en/download.wml Log: Cleanup; added FAQ entries. Modified: website/trunk/docs/en/faq.wml =================================================================== --- website/trunk/docs/en/faq.wml 2013-12-10 15:54:24 UTC (rev 26465) +++ website/trunk/docs/en/faq.wml 2013-12-10 21:46:42 UTC (rev 26466) @@ -77,10 +77,7 @@ unsafe?</a></li> <li><a href="#TBBOtherBrowser">I want to use Chrome/IE/Opera/etc with Tor.</a></li> - <li><a href="#TorbuttonOtherBrowser">Will Torbutton be available - for other browsers?</a></li> - <li><a href="#NoDataScrubbing">Does Tor remove personal information - from the data my application sends?</a></li> + <li><a href="#TorbuttonOtherBrowser">Will Torbutton be available for other browsers?</a></li> <li><a href="#TBBCloseBrowser">I want to leave Tor Browser Bundle running but close the browser.</a></li> @@ -203,6 +200,10 @@ websites, not just IP addresses.</a></li> <li><a href="#BlockContent">You should change Tor to prevent users from posting certain content.</a></li> + <li><a href="#SendPadding">You should send padding so it's more secure. + </a></li> + <li><a href="#Steganography">You should use steganography to hide Tor + traffic.</a></li> <li><a href="#IPv6">Tor should support IPv6.</a></li> </ul> @@ -1235,37 +1236,18 @@ <hr> <a id="TorbuttonOtherBrowser"></a> -<h3><a class="anchor" href="#TorbuttonOtherBrowser"> -Will Torbutton be available for other browsers?</a></h3> +<h3><a class="anchor" href="TorbuttonOtherBrowser"> +Will Torbutton be available for other browsers?</a></h3> <p> - We don't support IE, Opera or Safari and never plan to. There are too many - ways that your privacy can go wrong with those browsers, and because of - their closed design it is really hard for us to do anything to change these - privacy problems. + We don't support IE, Opera or Safari and never plan to. There are too many ways that your privacy can go wrong with those browsers, and because of their closed design it is really hard for us to do anything to change these privacy problems. </p> <p> -We are working with the Chrome people to modify Chrome's internals so that -we can eventually support it. But for now, Firefox is the only safe choice. +We are working with the Chrome people to modify Chrome's internals so that we can eventually support it. But for now, Firefox is the only safe choice. </p> <hr> -<a id="NoDataScrubbing"></a> -<h3><a class="anchor" href="#NoDataScrubbing"> -Does Tor remove personal information from the data my application sends? -</a></h3> -<p> -No, it doesn't. You need to use a separate program that understands your -application and protocol and knows how to clean or "scrub" the data it -sends. Privoxy is an example of this for web browsing. But note that even -Privoxy won't protect you completely: you may still fall victim to viruses, -Java Script attacks, etc; and Privoxy can't do anything about text that you -type into forms. Be careful and be smart. -</p> - -<hr> - <a id="TBBCloseBrowser"></a> <h3><a class="anchor" href="#TBBCloseBrowser">I want to leave Tor Browser @@ -3568,33 +3550,100 @@ <hr> + <a id="SendPadding"></a> + <h3><a class="anchor" href="#SendPadding">You should send padding so it's + more secure.</a></h3> + + <p> + Like all anonymous communication networks that are fast enough for web + browsing, Tor is vulnerable to statistical "traffic confirmation" + attacks, where the adversary watches traffic at both ends of a circuit + and confirms his guess that they're communicating. It would be really + nice if we could use cover traffic to confuse this attack. But there + are three problems here: + </p> + + <ul> + <li> + Cover traffic is really expensive. And *every* user needs to be doing + it. This adds up to a lot of extra bandwidth cost for our volunteer + operators, and they're already pushed to the limit. + </li> + <li> + You'd need to always be sending traffic, meaning you'd need to always + be online. Otherwise, you'd need to be sending end-to-end cover + traffic -- not just to the first hop, but all the way to your final + destination -- to prevent the adversary from correlating presence of + traffic at the destination to times when you're online. What does it + mean to send cover traffic to -- and from -- a web server? That is not + supported in most protocols. + </li> + <li> + Even if you *could* send full end-to-end padding between all users and + all destinations all the time, you're *still* vulnerable to active + attacks that block the padding for a short time at one end and look for + patterns later in the path. + </li> + </ul> + + <p> + In short, for a system like Tor that aims to be fast, we don't see any + use for padding, and it would definitely be a serious usability problem. + We hope that one day somebody will prove us wrong, but we are not + optimistic. + </p> + + <hr> + + <a id="Steganography"></a> + <h3><a class="anchor" href="#Steganography">You should use steganography to hide Tor + traffic.</a></h3> + + <p> + Many people suggest that we should use steganography to make it hard + to notice Tor connections on the Internet. There are a few problems + with this idea though: + </p> + + <p> + First, in the current network topology, the Tor relays list <a + href="#HideExits">is public</a> and can be accessed by attackers. + An attacker who wants to detect or block anonymous users could + always just notice <b>any connection</b> to or from a Tor relay's + IP address. + </p> + + <hr> + <a id="IPv6"></a> <h3><a class="anchor" href="#IPv6">Tor should support IPv6.</a></h3> <p> - That's a great idea! There are two aspects for IPv6 support that Tor needs. - First, Tor needs to support exit to hosts that only have IPv6 addresses. - Second, Tor needs to support Tor relays that only have IPv6 addresses. + That's a great idea! There are two aspects for IPv6 support that Tor needs. + First, Tor needs to support exit to hosts that only have IPv6 addresses. + Second, Tor needs to support Tor relays that only have IPv6 addresses. </p> <p> -The first is far easier: the protocol changes are relatively simple and isolated. -It would be like another kind of exit policy. + The first is far easier: the protocol changes are relatively simple and + isolated. It would be like another kind of exit policy. </p> <p> -The second is a little harder: right now, we assume that (mostly) every -Tor relay can connect to every other. This has problems of its own, and -adding IPv6-address-only relays adds problems too: it means that only -relays with IPv6 abilities can connect to IPv6-address-only relays. This -makes it possible for the attacker to make some inferences about client -paths that it would not be able to make otherwise. + The second is a little harder: right now, we assume that (mostly) every + Tor relay can connect to every other. This has problems of its own, and + adding IPv6-address-only relays adds problems too: it means that only + relays with IPv6 abilities can connect to IPv6-address-only relays. This + makes it possible for the attacker to make some inferences about client + paths that it would not be able to make otherwise. </p> <p> -There is an IPv6 exit proposal to address the first step for anonymous -access to IPv6 resources on the Internet. + There is an <a + href="https://gitweb.torproject.org/tor.git/blob/HEAD:/doc/spec/proposals/117-ipv…"> + IPv6 exit proposal</a> to address the first step for anonymous access to + IPv6 resources on the Internet. </p> <p> -Full IPv6 support is definitely on our "someday" list; it will come along -faster if somebody who wants it does some of the work. + Full IPv6 support is definitely on our "someday" list; it will come along + faster if somebody who wants it does some of the work. </p> <hr> Modified: website/trunk/download/en/download-easy.wml =================================================================== --- website/trunk/download/en/download-easy.wml 2013-12-10 15:54:24 UTC (rev 26465) +++ website/trunk/download/en/download-easy.wml 2013-12-10 21:46:42 UTC (rev 26466) @@ -167,8 +167,8 @@ often send out your real IP address in the tracker GET request, because that's how torrents work. Not only do you <a href="https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea"> -deanonymize your torrent traffic and your other simultaneous Tor web traffic -</a> this way, you also slow down the entire Tor network for everyone else. +deanonymize your torrent traffic and your other simultaneous Tor web +traffic</a> this way, you also slow down the entire Tor network for everyone else. </p> </li> <li><b>Don't enable or install browser plugins</b> Modified: website/trunk/download/en/download.wml =================================================================== --- website/trunk/download/en/download.wml 2013-12-10 15:54:24 UTC (rev 26465) +++ website/trunk/download/en/download.wml 2013-12-10 21:46:42 UTC (rev 26466) @@ -285,8 +285,8 @@ often send out your real IP address in the tracker GET request, because that's how torrents work. Not only do you <a href="https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea"> -deanonymize your torrent traffic and your other simultaneous Tor web traffic -</a> this way, you also slow down the entire Tor network for everyone else. +deanonymize your torrent traffic and your other simultaneous Tor web +traffic</a> this way, you also slow down the entire Tor network for everyone else. </p> </li>

1 0